policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 # Allow graphical boot to check battery lifespan
 676                 apm_stream_connect($1_usertype)
 677         ')
 678
 679         optional_policy(`
 680                 canna_stream_connect($1_usertype)
 681         ')
 682
 683         optional_policy(`
 684                 chrome_role($1_r, $1_usertype)
 685         ')
 686
 687         optional_policy(`
 688                 colord_read_lib_files($1_usertype)
 689         ')
 690
 691         optional_policy(`
 692                 dbus_system_bus_client($1_usertype)
 693
 694                 allow $1_usertype $1_usertype:dbus  send_msg;
 695
 696                 optional_policy(`
 697                         avahi_dbus_chat($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         policykit_dbus_chat($1_usertype)
 702                 ')
 703
 704                 optional_policy(`
 705                         bluetooth_dbus_chat($1_usertype)
 706                 ')
 707
 708                 optional_policy(`
 709                         consolekit_dbus_chat($1_usertype)
 710                         consolekit_read_log($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         devicekit_dbus_chat($1_usertype)
 715                         devicekit_dbus_chat_power($1_usertype)
 716                         devicekit_dbus_chat_disk($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         evolution_dbus_chat($1_usertype)
 721                         evolution_alarm_dbus_chat($1_usertype)
 722                 ')
 723
 724                 optional_policy(`
 725                         gnome_dbus_chat_gconfdefault($1_usertype)
 726                 ')
 727
 728                 optional_policy(`
 729                         hal_dbus_chat($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         kde_dbus_chat_backlighthelper($1_usertype)
 734                 ')
 735
 736                 optional_policy(`
 737                         modemmanager_dbus_chat($1_usertype)
 738                 ')
 739
 740                 optional_policy(`
 741                         networkmanager_dbus_chat($1_usertype)
 742                         networkmanager_read_lib_files($1_usertype)
 743                 ')
 744
 745                 optional_policy(`
 746                         vpn_dbus_chat($1_usertype)
 747                 ')
 748         ')
 749
 750         optional_policy(`
 751                 git_session_role($1_r, $1_usertype)
 752         ')
 753
 754         optional_policy(`
 755                 inetd_use_fds($1_usertype)
 756                 inetd_rw_tcp_sockets($1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 inn_read_config($1_usertype)
 761                 inn_read_news_lib($1_usertype)
 762                 inn_read_news_spool($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 lircd_stream_connect($1_usertype)
 767         ')
 768
 769         optional_policy(`
 770                 locate_read_lib_files($1_usertype)
 771         ')
 772
 773         # for running depmod as part of the kernel packaging process
 774         optional_policy(`
 775                 modutils_read_module_config($1_usertype)
 776         ')
 777
 778         optional_policy(`
 779                 mta_rw_spool($1_usertype)
 780                 mta_manage_queue($1_usertype)
 781                 mta_filetrans_home_content($1_usertype)
 782         ')
 783
 784         optional_policy(`
 785                 nsplugin_role($1_r, $1_usertype)
 786         ')
 787
 788         optional_policy(`
 789                 tunable_policy(`allow_user_mysql_connect',`
 790                         mysql_stream_connect($1_t)
 791                 ')
 792         ')
 793
 794         optional_policy(`
 795                 oident_manage_user_content($1_t)
 796                 oident_relabel_user_content($1_t)
 797         ')
 798
 799         optional_policy(`
 800                 # to allow monitoring of pcmcia status
 801                 pcmcia_read_pid($1_usertype)
 802         ')
 803
 804         optional_policy(`
 805                 pcscd_read_pub_files($1_usertype)
 806                 pcscd_stream_connect($1_usertype)
 807         ')
 808
 809         optional_policy(`
 810                 tunable_policy(`allow_user_postgresql_connect',`
 811                         postgresql_stream_connect($1_usertype)
 812                         postgresql_tcp_connect($1_usertype)
 813                 ')
 814         ')
 815
 816         optional_policy(`
 817                 resmgr_stream_connect($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 rpc_dontaudit_getattr_exports($1_usertype)
 822                 rpc_manage_nfs_rw_content($1_usertype)
 823         ')
 824
 825         optional_policy(`
 826                 rpcbind_stream_connect($1_usertype)
 827         ')
 828
 829         optional_policy(`
 830                 samba_stream_connect_winbind($1_usertype)
 831         ')
 832
 833         optional_policy(`
 834                 sandbox_transition($1_usertype, $1_r)
 835         ')
 836
 837         optional_policy(`
 838                 seunshare_role_template($1, $1_r, $1_t)
 839         ')
 840
 841         optional_policy(`
 842                 slrnpull_search_spool($1_usertype)
 843         ')
 844
 845         optional_policy(`
 846                 thumb_role($1_r, $1_usertype)
 847         ')
 848 ')
 849
 850 #######################################
 851 ## <summary>
 852 ##      The template for creating a login user.
 853 ## </summary>
 854 ## <desc>
 855 ##      <p>
 856 ##      This template creates a user domain, types, and
 857 ##      rules for the user's tty, pty, home directories,
 858 ##      tmp, and tmpfs files.
 859 ##      </p>
 860 ## </desc>
 861 ## <param name="userdomain_prefix">
 862 ##      <summary>
 863 ##      The prefix of the user domain (e.g., user
 864 ##      is the prefix for user_t).
 865 ##      </summary>
 866 ## </param>
 867 #
 868 template(`userdom_login_user_template', `
 869         gen_require(`
 870                 class context contains;
 871         ')
 872
 873         userdom_base_user_template($1)
 874
 875         userdom_manage_home_role($1_r, $1_usertype)
 876
 877         userdom_manage_tmp_role($1_r, $1_usertype)
 878         userdom_manage_tmpfs_role($1_r, $1_usertype)
 879
 880         ifelse(`$1',`unconfined',`',`
 881                 gen_tunable(allow_$1_exec_content, true)
 882
 883                 tunable_policy(`allow_$1_exec_content',`
 884                         userdom_exec_user_tmp_files($1_usertype)
 885                         userdom_exec_user_home_content_files($1_usertype)
 886                 ')
 887                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 888                         fs_exec_nfs_files($1_usertype)
 889                 ')
 890
 891                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 892                         fs_exec_cifs_files($1_usertype)
 893                 ')
 894         ')
 895
 896         userdom_change_password_template($1)
 897
 898         ##############################
 899         #
 900         # User domain Local policy
 901         #
 902
 903         allow $1_t self:capability { setgid chown fowner };
 904         dontaudit $1_t self:capability { sys_nice fsetid };
 905
 906         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 907         dontaudit $1_t self:process setrlimit;
 908         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 909
 910         allow $1_t self:context contains;
 911
 912         kernel_dontaudit_read_system_state($1_usertype)
 913         kernel_dontaudit_list_all_proc($1_usertype)
 914
 915         dev_read_sysfs($1_usertype)
 916         dev_read_urand($1_usertype)
 917
 918         domain_use_interactive_fds($1_usertype)
 919         # Command completion can fire hundreds of denials
 920         domain_dontaudit_exec_all_entry_files($1_usertype)
 921
 922         files_dontaudit_list_default($1_usertype)
 923         files_dontaudit_read_default_files($1_usertype)
 924         # Stat lost+found.
 925         files_getattr_lost_found_dirs($1_usertype)
 926
 927         fs_get_all_fs_quotas($1_usertype)
 928         fs_getattr_all_fs($1_usertype)
 929         fs_search_all($1_usertype)
 930         fs_list_inotifyfs($1_usertype)
 931         fs_rw_anon_inodefs_files($1_usertype)
 932
 933         auth_dontaudit_write_login_records($1_t)
 934         auth_rw_cache($1_t)
 935
 936         application_exec_all($1_t)
 937         # The library functions always try to open read-write first,
 938         # then fall back to read-only if it fails.
 939         init_dontaudit_rw_utmp($1_t)
 940
 941         # Stop warnings about access to /dev/console
 942         init_dontaudit_use_fds($1_usertype)
 943         init_dontaudit_use_script_fds($1_usertype)
 944
 945         libs_exec_lib_files($1_usertype)
 946
 947         logging_dontaudit_getattr_all_logs($1_usertype)
 948
 949         # for running TeX programs
 950         miscfiles_read_tetex_data($1_usertype)
 951         miscfiles_exec_tetex_data($1_usertype)
 952
 953         seutil_read_config($1_usertype)
 954
 955         optional_policy(`
 956                 cups_read_config($1_usertype)
 957                 cups_stream_connect($1_usertype)
 958                 cups_stream_connect_ptal($1_usertype)
 959         ')
 960
 961         optional_policy(`
 962                 kerberos_use($1_usertype)
 963                 kerberos_filetrans_home_content($1_usertype)
 964         ')
 965
 966         optional_policy(`
 967                 mta_dontaudit_read_spool_symlinks($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 quota_dontaudit_getattr_db($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 rpm_read_db($1_usertype)
 976                 rpm_dontaudit_manage_db($1_usertype)
 977                 rpm_read_cache($1_usertype)
 978         ')
 979
 980         optional_policy(`
 981                 oddjob_run_mkhomedir($1_t, $1_r)
 982         ')
 983 ')
 984
 985 #######################################
 986 ## <summary>
 987 ##      The template for creating a unprivileged login user.
 988 ## </summary>
 989 ## <desc>
 990 ##      <p>
 991 ##      This template creates a user domain, types, and
 992 ##      rules for the user's tty, pty, home directories,
 993 ##      tmp, and tmpfs files.
 994 ##      </p>
 995 ## </desc>
 996 ## <param name="userdomain_prefix">
 997 ##      <summary>
 998 ##      The prefix of the user domain (e.g., user
 999 ##      is the prefix for user_t).
1000 ##      </summary>
1001 ## </param>
1002 #
1003 template(`userdom_restricted_user_template',`
1004         gen_require(`
1005                 attribute unpriv_userdomain;
1006         ')
1007
1008         userdom_login_user_template($1)
1009
1010         typeattribute $1_t unpriv_userdomain;
1011         domain_interactive_fd($1_t)
1012
1013         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1014         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1015
1016         ##############################
1017         #
1018         # Local policy
1019         #
1020
1021         optional_policy(`
1022                 loadkeys_run($1_t, $1_r)
1023         ')
1024 ')
1025
1026 #######################################
1027 ## <summary>
1028 ##      The template for creating a unprivileged xwindows login user.
1029 ## </summary>
1030 ## <desc>
1031 ##      <p>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ##      </p>
1034 ##      <p>
1035 ##      This template creates a user domain, types, and
1036 ##      rules for the user's tty, pty, home directories,
1037 ##      tmp, and tmpfs files.
1038 ##      </p>
1039 ## </desc>
1040 ## <param name="userdomain_prefix">
1041 ##      <summary>
1042 ##      The prefix of the user domain (e.g., user
1043 ##      is the prefix for user_t).
1044 ##      </summary>
1045 ## </param>
1046 #
1047 template(`userdom_restricted_xwindows_user_template',`
1048
1049         userdom_restricted_user_template($1)
1050
1051         ##############################
1052         #
1053         # Local policy
1054         #
1055
1056         auth_role($1_r, $1_t)
1057         auth_search_pam_console_data($1_usertype)
1058         auth_dontaudit_read_login_records($1_usertype)
1059
1060         dev_read_sound($1_usertype)
1061         dev_write_sound($1_usertype)
1062         # gnome keyring wants to read this.
1063         dev_dontaudit_read_rand($1_usertype)
1064         # temporarily allow since openoffice requires this
1065         dev_read_rand($1_usertype)
1066
1067         dev_read_video_dev($1_usertype)
1068         dev_write_video_dev($1_usertype)
1069         dev_rw_wireless($1_usertype)
1070
1071         libs_dontaudit_setattr_lib_files($1_usertype)
1072
1073         tunable_policy(`user_rw_noexattrfile',`
1074                 dev_rw_usbfs($1_t)
1075                 dev_rw_generic_usb_dev($1_usertype)
1076
1077                 fs_manage_noxattr_fs_files($1_usertype)
1078                 fs_manage_noxattr_fs_dirs($1_usertype)
1079                 fs_manage_dos_dirs($1_usertype)
1080                 fs_manage_dos_files($1_usertype)
1081                 storage_raw_read_removable_device($1_usertype)
1082                 storage_raw_write_removable_device($1_usertype)
1083         ')
1084
1085         logging_send_syslog_msg($1_usertype)
1086         logging_dontaudit_send_audit_msgs($1_t)
1087
1088         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1089         logging_send_audit_msgs($1_t)
1090         selinux_get_enforce_mode($1_t)
1091         seutil_exec_restorecond($1_t)
1092         seutil_read_file_contexts($1_t)
1093         seutil_read_default_contexts($1_t)
1094
1095         xserver_restricted_role($1_r, $1_t)
1096
1097         optional_policy(`
1098                 alsa_read_rw_config($1_usertype)
1099         ')
1100
1101          # cjp: needed by KDE apps
1102          # bug: #682499
1103          optional_policy(`
1104                 gnome_read_usr_config($1_usertype)
1105                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1106                 # cjp: telepathy F15 bugs
1107                 telepathy_role($1_r, $1_t, $1)
1108         ')
1109
1110         optional_policy(`
1111                 dbus_role_template($1, $1_r, $1_usertype)
1112                 dbus_system_bus_client($1_usertype)
1113                 allow $1_usertype $1_usertype:dbus send_msg;
1114
1115                 optional_policy(`
1116                         abrt_dbus_chat($1_usertype)
1117                         abrt_run_helper($1_usertype, $1_r)
1118                 ')
1119
1120                 optional_policy(`
1121                         consolekit_dontaudit_read_log($1_usertype)
1122                         consolekit_dbus_chat($1_usertype)
1123                 ')
1124
1125                 optional_policy(`
1126                         cups_dbus_chat($1_usertype)
1127                         cups_dbus_chat_config($1_usertype)
1128                 ')
1129
1130                 optional_policy(`
1131                         devicekit_dbus_chat($1_usertype)
1132                         devicekit_dbus_chat_disk($1_usertype)
1133                         devicekit_dbus_chat_power($1_usertype)
1134                 ')
1135
1136                 optional_policy(`
1137                         fprintd_dbus_chat($1_t)
1138                 ')
1139         ')
1140
1141         optional_policy(`
1142                 openoffice_role_template($1, $1_r, $1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 policykit_role($1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 pulseaudio_role($1_r, $1_usertype)
1151                 pulseaudio_filetrans_admin_home_content($1_usertype)
1152                 pulseaudio_filetrans_home_content($1_usertype)
1153         ')
1154
1155         optional_policy(`
1156                 rtkit_scheduled($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 setroubleshoot_dontaudit_stream_connect($1_t)
1161         ')
1162
1163         optional_policy(`
1164                 udev_read_db($1_usertype)
1165         ')
1166
1167         optional_policy(`
1168                 wm_role_template($1, $1_r, $1_t)
1169         ')
1170 ')
1171
1172 #######################################
1173 ## <summary>
1174 ##      The template for creating a unprivileged user roughly
1175 ##      equivalent to a regular linux user.
1176 ## </summary>
1177 ## <desc>
1178 ##      <p>
1179 ##      The template for creating a unprivileged user roughly
1180 ##      equivalent to a regular linux user.
1181 ##      </p>
1182 ##      <p>
1183 ##      This template creates a user domain, types, and
1184 ##      rules for the user's tty, pty, home directories,
1185 ##      tmp, and tmpfs files.
1186 ##      </p>
1187 ## </desc>
1188 ## <param name="userdomain_prefix">
1189 ##      <summary>
1190 ##      The prefix of the user domain (e.g., user
1191 ##      is the prefix for user_t).
1192 ##      </summary>
1193 ## </param>
1194 #
1195 template(`userdom_unpriv_user_template', `
1196
1197         ##############################
1198         #
1199         # Declarations
1200         #
1201
1202         # Inherit rules for ordinary users.
1203         userdom_restricted_xwindows_user_template($1)
1204         userdom_common_user_template($1)
1205
1206         ##############################
1207         #
1208         # Local policy
1209         #
1210
1211         # port access is audited even if dac would not have allowed it, so dontaudit it here
1212 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1213         # Need the following rule to allow users to run vpnc
1214         corenet_tcp_bind_xserver_port($1_t)
1215         corenet_tcp_bind_generic_node($1_usertype)
1216
1217         storage_rw_fuse($1_t)
1218
1219         files_exec_usr_files($1_t)
1220    # cjp: why?
1221         files_read_kernel_symbol_table($1_t)
1222
1223         ifndef(`enable_mls',`
1224                 fs_exec_noxattr($1_t)
1225
1226                 tunable_policy(`user_rw_noexattrfile',`
1227                         fs_manage_noxattr_fs_files($1_t)
1228                         fs_manage_noxattr_fs_dirs($1_t)
1229                         # Write floppies
1230                         storage_raw_read_removable_device($1_t)
1231                         storage_raw_write_removable_device($1_t)
1232                 ',`
1233                         storage_raw_read_removable_device($1_t)
1234                 ')
1235         ')
1236
1237         miscfiles_read_hwdata($1_usertype)
1238
1239         # Allow users to run TCP servers (bind to ports and accept connection from
1240         # the same domain and outside users) disabling this forces FTP passive mode
1241         # and may change other protocols
1242
1243         tunable_policy(`user_share_music',`
1244                 corenet_tcp_bind_daap_port($1_usertype)
1245         ')
1246
1247         tunable_policy(`user_tcp_server',`
1248                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_setrlimit',`
1252                 allow $1_usertype self:process setrlimit;
1253         ')
1254
1255         optional_policy(`
1256                 cdrecord_role($1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 cron_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 games_rw_data($1_usertype)
1265         ')
1266
1267         optional_policy(`
1268                 gpg_role($1_r, $1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gnomeclock_dbus_chat($1_t)
1273         ')
1274
1275         optional_policy(`
1276                 gpm_stream_connect($1_usertype)
1277         ')
1278
1279         optional_policy(`
1280                 execmem_role_template($1, $1_r, $1_t)
1281         ')
1282
1283         optional_policy(`
1284                 java_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 mono_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mount_run_fusermount($1_t, $1_r)
1293                 mount_read_pid_files($1_t)
1294         ')
1295
1296         optional_policy(`
1297                 wine_role_template($1, $1_r, $1_t)
1298         ')
1299
1300         optional_policy(`
1301                 postfix_run_postdrop($1_t, $1_r)
1302                 postfix_search_spool($1_t)
1303         ')
1304
1305         # Run pppd in pppd_t by default for user
1306         optional_policy(`
1307                 ppp_run_cond($1_t, $1_r)
1308         ')
1309
1310         optional_policy(`
1311                 vdagent_getattr_log($1_t)
1312                 vdagent_getattr_exec($1_t)
1313                 vdagent_stream_connect($1_t)
1314         ')
1315 ')
1316
1317 #######################################
1318 ## <summary>
1319 ##      The template for creating an administrative user.
1320 ## </summary>
1321 ## <desc>
1322 ##      <p>
1323 ##      This template creates a user domain, types, and
1324 ##      rules for the user's tty, pty, home directories,
1325 ##      tmp, and tmpfs files.
1326 ##      </p>
1327 ##      <p>
1328 ##      The privileges given to administrative users are:
1329 ##      <ul>
1330 ##              <li>Raw disk access</li>
1331 ##              <li>Set all sysctls</li>
1332 ##              <li>All kernel ring buffer controls</li>
1333 ##              <li>Create, read, write, and delete all files but shadow</li>
1334 ##              <li>Manage source and binary format SELinux policy</li>
1335 ##              <li>Run insmod</li>
1336 ##      </ul>
1337 ##      </p>
1338 ## </desc>
1339 ## <param name="userdomain_prefix">
1340 ##      <summary>
1341 ##      The prefix of the user domain (e.g., sysadm
1342 ##      is the prefix for sysadm_t).
1343 ##      </summary>
1344 ## </param>
1345 #
1346 template(`userdom_admin_user_template',`
1347         gen_require(`
1348                 attribute admindomain;
1349                 class passwd { passwd chfn chsh rootok crontab };
1350         ')
1351
1352         ##############################
1353         #
1354         # Declarations
1355         #
1356
1357         # Inherit rules for ordinary users.
1358         userdom_login_user_template($1)
1359         userdom_common_user_template($1)
1360
1361         domain_obj_id_change_exemption($1_t)
1362         role system_r types $1_t;
1363
1364         typeattribute $1_t admindomain;
1365
1366         ifdef(`direct_sysadm_daemon',`
1367                 domain_system_change_exemption($1_t)
1368         ')
1369
1370         ##############################
1371         #
1372         # $1_t local policy
1373         #
1374
1375         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1376         allow $1_t self:capability2 syslog;
1377         allow $1_t self:process { setexec setfscreate };
1378         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1379         allow $1_t self:tun_socket create;
1380         # Set password information for other users.
1381         allow $1_t self:passwd { passwd chfn chsh };
1382         # Skip authentication when pam_rootok is specified.
1383         allow $1_t self:passwd rootok;
1384
1385         # Manipulate other users crontab.
1386         allow $1_t self:passwd crontab;
1387
1388         kernel_read_software_raid_state($1_t)
1389         kernel_getattr_core_if($1_t)
1390         kernel_getattr_message_if($1_t)
1391         kernel_change_ring_buffer_level($1_t)
1392         kernel_clear_ring_buffer($1_t)
1393         kernel_read_ring_buffer($1_t)
1394         kernel_get_sysvipc_info($1_t)
1395         kernel_rw_all_sysctls($1_t)
1396         # signal unlabeled processes:
1397         kernel_kill_unlabeled($1_t)
1398         kernel_signal_unlabeled($1_t)
1399         kernel_sigstop_unlabeled($1_t)
1400         kernel_signull_unlabeled($1_t)
1401         kernel_sigchld_unlabeled($1_t)
1402         kernel_signal($1_t)
1403
1404         corenet_tcp_bind_generic_port($1_t)
1405         # allow setting up tunnels
1406         corenet_rw_tun_tap_dev($1_t)
1407
1408         dev_getattr_generic_blk_files($1_t)
1409         dev_getattr_generic_chr_files($1_t)
1410         # for lsof
1411         dev_getattr_mtrr_dev($1_t)
1412         # Allow MAKEDEV to work
1413         dev_create_all_blk_files($1_t)
1414         dev_create_all_chr_files($1_t)
1415         dev_delete_all_blk_files($1_t)
1416         dev_delete_all_chr_files($1_t)
1417         dev_rename_all_blk_files($1_t)
1418         dev_rename_all_chr_files($1_t)
1419         dev_create_generic_symlinks($1_t)
1420         dev_rw_generic_usb_dev($1_t)
1421         dev_rw_usbfs($1_t)
1422
1423         domain_setpriority_all_domains($1_t)
1424         domain_read_all_domains_state($1_t)
1425         domain_getattr_all_domains($1_t)
1426         domain_getcap_all_domains($1_t)
1427         domain_dontaudit_ptrace_all_domains($1_t)
1428         # signal all domains:
1429         domain_kill_all_domains($1_t)
1430         domain_signal_all_domains($1_t)
1431         domain_signull_all_domains($1_t)
1432         domain_sigstop_all_domains($1_t)
1433         domain_sigstop_all_domains($1_t)
1434         domain_sigchld_all_domains($1_t)
1435         # for lsof
1436         domain_getattr_all_sockets($1_t)
1437         domain_dontaudit_getattr_all_sockets($1_t)
1438
1439         files_exec_usr_src_files($1_t)
1440
1441         fs_getattr_all_fs($1_t)
1442         fs_getattr_all_files($1_t)
1443         fs_list_all($1_t)
1444         fs_set_all_quotas($1_t)
1445         fs_exec_noxattr($1_t)
1446
1447         storage_raw_read_removable_device($1_t)
1448         storage_raw_write_removable_device($1_t)
1449         storage_dontaudit_read_fixed_disk($1_t)
1450
1451         term_use_all_inherited_terms($1_t)
1452         term_use_unallocated_ttys($1_t)
1453
1454         auth_getattr_shadow($1_t)
1455         # Manage almost all files
1456         files_manage_non_security_dirs($1_t)
1457         files_manage_non_security_files($1_t)
1458         # Relabel almost all files
1459         files_relabel_non_security_files($1_t)
1460
1461         init_telinit($1_t)
1462
1463         logging_send_syslog_msg($1_t)
1464
1465         optional_policy(`
1466                 modutils_domtrans_insmod($1_t)
1467                 modutils_domtrans_depmod($1_t)
1468         ')
1469
1470         # The following rule is temporary until such time that a complete
1471         # policy management infrastructure is in place so that an administrator
1472         # cannot directly manipulate policy files with arbitrary programs.
1473         seutil_manage_src_policy($1_t)
1474         # Violates the goal of limiting write access to checkpolicy.
1475         # But presently necessary for installing the file_contexts file.
1476         seutil_manage_bin_policy($1_t)
1477
1478         systemd_config_all_services($1_t)
1479
1480         userdom_manage_user_home_content_dirs($1_t)
1481         userdom_manage_user_home_content_files($1_t)
1482         userdom_manage_user_home_content_symlinks($1_t)
1483         userdom_manage_user_home_content_pipes($1_t)
1484         userdom_manage_user_home_content_sockets($1_t)
1485         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1486
1487         tunable_policy(`user_rw_noexattrfile',`
1488                 fs_manage_noxattr_fs_files($1_t)
1489                 fs_manage_noxattr_fs_dirs($1_t)
1490         ',`
1491                 fs_read_noxattr_fs_files($1_t)
1492         ')
1493
1494         optional_policy(`
1495                 postgresql_unconfined($1_t)
1496         ')
1497
1498         optional_policy(`
1499                 userhelper_exec($1_t)
1500         ')
1501 ')
1502
1503 ########################################
1504 ## <summary>
1505 ##      Allow user to run as a secadm
1506 ## </summary>
1507 ## <desc>
1508 ##      <p>
1509 ##      Create objects in a user home directory
1510 ##      with an automatic type transition to
1511 ##      a specified private type.
1512 ##      </p>
1513 ##      <p>
1514 ##      This is a templated interface, and should only
1515 ##      be called from a per-userdomain template.
1516 ##      </p>
1517 ## </desc>
1518 ## <param name="domain">
1519 ##      <summary>
1520 ##      Domain allowed access.
1521 ##      </summary>
1522 ## </param>
1523 ## <param name="role">
1524 ##      <summary>
1525 ##      The role  of the object to create.
1526 ##      </summary>
1527 ## </param>
1528 #
1529 template(`userdom_security_admin_template',`
1530         allow $1 self:capability { dac_read_search dac_override };
1531
1532         corecmd_exec_shell($1)
1533
1534         domain_obj_id_change_exemption($1)
1535
1536         dev_relabel_all_dev_nodes($1)
1537
1538         files_create_boot_flag($1)
1539         files_create_default_dir($1)
1540         files_root_filetrans_default($1, dir)
1541
1542         # Necessary for managing /boot/efi
1543         fs_manage_dos_files($1)
1544
1545         mls_process_read_up($1)
1546         mls_file_read_all_levels($1)
1547         mls_file_upgrade($1)
1548         mls_file_downgrade($1)
1549
1550         selinux_set_enforce_mode($1)
1551         selinux_set_all_booleans($1)
1552         selinux_set_parameters($1)
1553         selinux_read_policy($1)
1554
1555         files_relabel_all_files($1)
1556         auth_relabel_shadow($1)
1557
1558         init_exec($1)
1559
1560         logging_send_syslog_msg($1)
1561         logging_read_audit_log($1)
1562         logging_read_generic_logs($1)
1563         logging_read_audit_config($1)
1564
1565         seutil_manage_bin_policy($1)
1566         seutil_manage_default_contexts($1)
1567         seutil_manage_file_contexts($1)
1568         seutil_manage_module_store($1)
1569         seutil_manage_config($1)
1570         seutil_run_checkpolicy($1,$2)
1571         seutil_run_loadpolicy($1,$2)
1572         seutil_run_semanage($1,$2)
1573         seutil_run_setsebool($1,$2)
1574         seutil_run_setfiles($1, $2)
1575
1576         seutil_manage_bin_policy($1)
1577     seutil_manage_default_contexts($1)
1578     seutil_manage_file_contexts($1)
1579     seutil_manage_module_store($1)
1580     seutil_manage_config($1)
1581
1582         optional_policy(`
1583                 aide_run($1,$2)
1584         ')
1585
1586         optional_policy(`
1587                 consoletype_exec($1)
1588         ')
1589
1590         optional_policy(`
1591                 dmesg_exec($1)
1592         ')
1593
1594         optional_policy(`
1595                 ipsec_run_setkey($1,$2)
1596         ')
1597
1598         optional_policy(`
1599                 netlabel_run_mgmt($1,$2)
1600         ')
1601
1602         optional_policy(`
1603                 samhain_run($1, $2)
1604         ')
1605 ')
1606
1607 ########################################
1608 ## <summary>
1609 ##      Make the specified type usable in a
1610 ##      user home directory.
1611 ## </summary>
1612 ## <param name="type">
1613 ##      <summary>
1614 ##      Type to be used as a file in the
1615 ##      user home directory.
1616 ##      </summary>
1617 ## </param>
1618 #
1619 interface(`userdom_user_home_content',`
1620         gen_require(`
1621                 type user_home_t;
1622                 attribute user_home_type;
1623         ')
1624
1625         allow $1 user_home_t:filesystem associate;
1626         files_type($1)
1627         ubac_constrained($1)
1628
1629         files_poly_member($1)
1630         typeattribute $1  user_home_type;
1631 ')
1632
1633 ########################################
1634 ## <summary>
1635 ##      Make the specified type usable in a
1636 ##      generic temporary directory.
1637 ## </summary>
1638 ## <param name="type">
1639 ##      <summary>
1640 ##      Type to be used as a file in the
1641 ##      generic temporary directory.
1642 ##      </summary>
1643 ## </param>
1644 #
1645 interface(`userdom_user_tmp_content',`
1646         gen_require(`
1647                 attribute user_tmp_type;
1648         ')
1649
1650         typeattribute $1 user_tmp_type;
1651
1652         files_tmp_file($1)
1653         ubac_constrained($1)
1654 ')
1655
1656 ########################################
1657 ## <summary>
1658 ##      Make the specified type usable in a
1659 ##      generic tmpfs_t directory.
1660 ## </summary>
1661 ## <param name="type">
1662 ##      <summary>
1663 ##      Type to be used as a file in the
1664 ##      generic temporary directory.
1665 ##      </summary>
1666 ## </param>
1667 #
1668 interface(`userdom_user_tmpfs_content',`
1669         gen_require(`
1670                 attribute user_tmpfs_type;
1671         ')
1672
1673         typeattribute $1 user_tmpfs_type;
1674
1675         files_tmpfs_file($1)
1676         ubac_constrained($1)
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Allow domain to attach to TUN devices created by administrative users.
1682 ## </summary>
1683 ## <param name="domain">
1684 ##      <summary>
1685 ##      Domain allowed access.
1686 ##      </summary>
1687 ## </param>
1688 #
1689 interface(`userdom_attach_admin_tun_iface',`
1690         gen_require(`
1691                 attribute admindomain;
1692         ')
1693
1694         allow $1 admindomain:tun_socket relabelfrom;
1695         allow $1 self:tun_socket relabelto;
1696 ')
1697
1698 ########################################
1699 ## <summary>
1700 ##      Set the attributes of a user pty.
1701 ## </summary>
1702 ## <param name="domain">
1703 ##      <summary>
1704 ##      Domain allowed access.
1705 ##      </summary>
1706 ## </param>
1707 #
1708 interface(`userdom_setattr_user_ptys',`
1709         gen_require(`
1710                 type user_devpts_t;
1711         ')
1712
1713         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1714 ')
1715
1716 ########################################
1717 ## <summary>
1718 ##      Create a user pty.
1719 ## </summary>
1720 ## <param name="domain">
1721 ##      <summary>
1722 ##      Domain allowed access.
1723 ##      </summary>
1724 ## </param>
1725 #
1726 interface(`userdom_create_user_pty',`
1727         gen_require(`
1728                 type user_devpts_t;
1729         ')
1730
1731         term_create_pty($1, user_devpts_t)
1732 ')
1733
1734 ########################################
1735 ## <summary>
1736 ##      Get the attributes of user home directories.
1737 ## </summary>
1738 ## <param name="domain">
1739 ##      <summary>
1740 ##      Domain allowed access.
1741 ##      </summary>
1742 ## </param>
1743 #
1744 interface(`userdom_getattr_user_home_dirs',`
1745         gen_require(`
1746                 type user_home_dir_t;
1747         ')
1748
1749         allow $1 user_home_dir_t:dir getattr_dir_perms;
1750         files_search_home($1)
1751 ')
1752
1753 ########################################
1754 ## <summary>
1755 ##      Do not audit attempts to get the attributes of user home directories.
1756 ## </summary>
1757 ## <param name="domain">
1758 ##      <summary>
1759 ##      Domain to not audit.
1760 ##      </summary>
1761 ## </param>
1762 #
1763 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1764         gen_require(`
1765                 type user_home_dir_t;
1766         ')
1767
1768         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1769 ')
1770
1771 ########################################
1772 ## <summary>
1773 ##      Search user home directories.
1774 ## </summary>
1775 ## <param name="domain">
1776 ##      <summary>
1777 ##      Domain allowed access.
1778 ##      </summary>
1779 ## </param>
1780 #
1781 interface(`userdom_search_user_home_dirs',`
1782         gen_require(`
1783                 type user_home_dir_t;
1784         ')
1785
1786         allow $1 user_home_dir_t:dir search_dir_perms;
1787         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1788         files_search_home($1)
1789 ')
1790
1791 ########################################
1792 ## <summary>
1793 ##      Do not audit attempts to search user home directories.
1794 ## </summary>
1795 ## <desc>
1796 ##      <p>
1797 ##      Do not audit attempts to search user home directories.
1798 ##      This will supress SELinux denial messages when the specified
1799 ##      domain is denied the permission to search these directories.
1800 ##      </p>
1801 ## </desc>
1802 ## <param name="domain">
1803 ##      <summary>
1804 ##      Domain to not audit.
1805 ##      </summary>
1806 ## </param>
1807 ## <infoflow type="none"/>
1808 #
1809 interface(`userdom_dontaudit_search_user_home_dirs',`
1810         gen_require(`
1811                 type user_home_dir_t;
1812         ')
1813
1814         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1815 ')
1816
1817 ########################################
1818 ## <summary>
1819 ##      List user home directories.
1820 ## </summary>
1821 ## <param name="domain">
1822 ##      <summary>
1823 ##      Domain allowed access.
1824 ##      </summary>
1825 ## </param>
1826 #
1827 interface(`userdom_list_user_home_dirs',`
1828         gen_require(`
1829                 type user_home_dir_t;
1830         ')
1831
1832         allow $1 user_home_dir_t:dir list_dir_perms;
1833         files_search_home($1)
1834
1835         tunable_policy(`use_nfs_home_dirs',`
1836                 fs_list_nfs($1)
1837         ')
1838
1839         tunable_policy(`use_samba_home_dirs',`
1840                 fs_list_cifs($1)
1841         ')
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Do not audit attempts to list user home subdirectories.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain to not audit.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_dontaudit_list_user_home_dirs',`
1855         gen_require(`
1856                 type user_home_dir_t;
1857                 type user_home_t;
1858         ')
1859
1860         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1861         dontaudit $1 user_home_t:dir list_dir_perms;
1862 ')
1863
1864 ########################################
1865 ## <summary>
1866 ##      Create user home directories.
1867 ## </summary>
1868 ## <param name="domain">
1869 ##      <summary>
1870 ##      Domain allowed access.
1871 ##      </summary>
1872 ## </param>
1873 #
1874 interface(`userdom_create_user_home_dirs',`
1875         gen_require(`
1876                 type user_home_dir_t;
1877         ')
1878
1879         allow $1 user_home_dir_t:dir create_dir_perms;
1880 ')
1881
1882 ########################################
1883 ## <summary>
1884 ##      Create user home directories.
1885 ## </summary>
1886 ## <param name="domain">
1887 ##      <summary>
1888 ##      Domain allowed access.
1889 ##      </summary>
1890 ## </param>
1891 #
1892 interface(`userdom_manage_user_home_dirs',`
1893         gen_require(`
1894                 type user_home_dir_t;
1895         ')
1896
1897         allow $1 user_home_dir_t:dir manage_dir_perms;
1898 ')
1899
1900 ########################################
1901 ## <summary>
1902 ##      Relabel to user home directories.
1903 ## </summary>
1904 ## <param name="domain">
1905 ##      <summary>
1906 ##      Domain allowed access.
1907 ##      </summary>
1908 ## </param>
1909 #
1910 interface(`userdom_relabelto_user_home_dirs',`
1911         gen_require(`
1912                 type user_home_dir_t;
1913         ')
1914
1915         allow $1 user_home_dir_t:dir relabelto;
1916 ')
1917
1918
1919 ########################################
1920 ## <summary>
1921 ##      Relabel to user home files.
1922 ## </summary>
1923 ## <param name="domain">
1924 ##      <summary>
1925 ##      Domain allowed access.
1926 ##      </summary>
1927 ## </param>
1928 #
1929 interface(`userdom_relabelto_user_home_files',`
1930         gen_require(`
1931                 type user_home_t;
1932         ')
1933
1934         allow $1 user_home_t:file relabelto;
1935 ')
1936 ########################################
1937 ## <summary>
1938 ##      Relabel user home files.
1939 ## </summary>
1940 ## <param name="domain">
1941 ##      <summary>
1942 ##      Domain allowed access.
1943 ##      </summary>
1944 ## </param>
1945 #
1946 interface(`userdom_relabel_user_home_files',`
1947         gen_require(`
1948                 type user_home_t;
1949         ')
1950
1951         allow $1 user_home_t:file relabel_file_perms;
1952 ')
1953
1954 ########################################
1955 ## <summary>
1956 ##      Create directories in the home dir root with
1957 ##      the user home directory type.
1958 ## </summary>
1959 ## <param name="domain">
1960 ##      <summary>
1961 ##      Domain allowed access.
1962 ##      </summary>
1963 ## </param>
1964 #
1965 interface(`userdom_home_filetrans_user_home_dir',`
1966         gen_require(`
1967                 type user_home_dir_t;
1968         ')
1969
1970         files_home_filetrans($1, user_home_dir_t, dir)
1971 ')
1972
1973 ########################################
1974 ## <summary>
1975 ##      Do a domain transition to the specified
1976 ##      domain when executing a program in the
1977 ##      user home directory.
1978 ## </summary>
1979 ## <desc>
1980 ##      <p>
1981 ##      Do a domain transition to the specified
1982 ##      domain when executing a program in the
1983 ##      user home directory.
1984 ##      </p>
1985 ##      <p>
1986 ##      No interprocess communication (signals, pipes,
1987 ##      etc.) is provided by this interface since
1988 ##      the domains are not owned by this module.
1989 ##      </p>
1990 ## </desc>
1991 ## <param name="source_domain">
1992 ##      <summary>
1993 ##      Domain allowed to transition.
1994 ##      </summary>
1995 ## </param>
1996 ## <param name="target_domain">
1997 ##      <summary>
1998 ##      Domain to transition to.
1999 ##      </summary>
2000 ## </param>
2001 #
2002 interface(`userdom_user_home_domtrans',`
2003         gen_require(`
2004                 type user_home_dir_t, user_home_t;
2005         ')
2006
2007         domain_auto_trans($1, user_home_t, $2)
2008         allow $1 user_home_dir_t:dir search_dir_perms;
2009         files_search_home($1)
2010 ')
2011
2012 ########################################
2013 ## <summary>
2014 ##      Do not audit attempts to search user home content directories.
2015 ## </summary>
2016 ## <param name="domain">
2017 ##      <summary>
2018 ##      Domain to not audit.
2019 ##      </summary>
2020 ## </param>
2021 #
2022 interface(`userdom_dontaudit_search_user_home_content',`
2023         gen_require(`
2024                 type user_home_t;
2025         ')
2026
2027         dontaudit $1 user_home_t:dir search_dir_perms;
2028         fs_dontaudit_list_nfs($1)
2029         fs_dontaudit_list_cifs($1)
2030 ')
2031
2032 ########################################
2033 ## <summary>
2034 ##      List contents of users home directory.
2035 ## </summary>
2036 ## <param name="domain">
2037 ##      <summary>
2038 ##      Domain allowed access.
2039 ##      </summary>
2040 ## </param>
2041 #
2042 interface(`userdom_list_user_home_content',`
2043         gen_require(`
2044                 type user_home_dir_t;
2045                 attribute user_home_type;
2046         ')
2047
2048         files_list_home($1)
2049         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2050 ')
2051
2052 ########################################
2053 ## <summary>
2054 ##      Create, read, write, and delete directories
2055 ##      in a user home subdirectory.
2056 ## </summary>
2057 ## <param name="domain">
2058 ##      <summary>
2059 ##      Domain allowed access.
2060 ##      </summary>
2061 ## </param>
2062 #
2063 interface(`userdom_manage_user_home_content_dirs',`
2064         gen_require(`
2065                 type user_home_dir_t, user_home_t;
2066         ')
2067
2068         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2069         files_search_home($1)
2070 ')
2071
2072 ########################################
2073 ## <summary>
2074 ##      Delete directories in a user home subdirectory.
2075 ## </summary>
2076 ## <param name="domain">
2077 ##      <summary>
2078 ##      Domain allowed access.
2079 ##      </summary>
2080 ## </param>
2081 #
2082 interface(`userdom_delete_user_home_content_dirs',`
2083         gen_require(`
2084                 type user_home_t;
2085         ')
2086
2087         allow $1 user_home_t:dir delete_dir_perms;
2088 ')
2089
2090 ########################################
2091 ## <summary>
2092 ##      Delete all directories in a user home subdirectory.
2093 ## </summary>
2094 ## <param name="domain">
2095 ##      <summary>
2096 ##      Domain allowed access.
2097 ##      </summary>
2098 ## </param>
2099 #
2100 interface(`userdom_delete_all_user_home_content_dirs',`
2101         gen_require(`
2102                 attribute user_home_type;
2103         ')
2104
2105         allow $1 user_home_type:dir delete_dir_perms;
2106 ')
2107
2108 ########################################
2109 ## <summary>
2110 ##      Set the attributes of user home files.
2111 ## </summary>
2112 ## <param name="domain">
2113 ##      <summary>
2114 ##      Domain allowed access.
2115 ##      </summary>
2116 ## </param>
2117 ## <rolecap/>
2118 #
2119 interface(`userdom_setattr_user_home_content_files',`
2120         gen_require(`
2121                 type user_home_t;
2122         ')
2123
2124         allow $1 user_home_t:file setattr;
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Do not audit attempts to set the
2130 ##      attributes of user home files.
2131 ## </summary>
2132 ## <param name="domain">
2133 ##      <summary>
2134 ##      Domain to not audit.
2135 ##      </summary>
2136 ## </param>
2137 #
2138 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2139         gen_require(`
2140                 type user_home_t;
2141         ')
2142
2143         dontaudit $1 user_home_t:file setattr_file_perms;
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Set the attributes of all user home directories.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain allowed access.
2153 ##      </summary>
2154 ## </param>
2155 ## <rolecap/>
2156 #
2157 interface(`userdom_setattr_all_user_home_content_dirs',`
2158         gen_require(`
2159                 attribute user_home_type;
2160         ')
2161
2162         allow $1 user_home_type:dir setattr_dir_perms;
2163 ')
2164
2165 ########################################
2166 ## <summary>
2167 ##      Mmap user home files.
2168 ## </summary>
2169 ## <param name="domain">
2170 ##      <summary>
2171 ##      Domain allowed access.
2172 ##      </summary>
2173 ## </param>
2174 #
2175 interface(`userdom_mmap_user_home_content_files',`
2176         gen_require(`
2177                 type user_home_dir_t, user_home_t;
2178         ')
2179
2180         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2181         files_search_home($1)
2182 ')
2183
2184 ########################################
2185 ## <summary>
2186 ##      Read user home files.
2187 ## </summary>
2188 ## <param name="domain">
2189 ##      <summary>
2190 ##      Domain allowed access.
2191 ##      </summary>
2192 ## </param>
2193 #
2194 interface(`userdom_read_user_home_content_files',`
2195         gen_require(`
2196                 type user_home_dir_t, user_home_t;
2197         ')
2198
2199         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2200         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2201         files_search_home($1)
2202 ')
2203
2204 ########################################
2205 ## <summary>
2206 ##      Do not audit attempts to getattr user home files.
2207 ## </summary>
2208 ## <param name="domain">
2209 ##      <summary>
2210 ##      Domain to not audit.
2211 ##      </summary>
2212 ## </param>
2213 #
2214 interface(`userdom_dontaudit_getattr_user_home_content',`
2215         gen_require(`
2216                 attribute user_home_type;
2217         ')
2218
2219         dontaudit $1 user_home_type:dir getattr;
2220         dontaudit $1 user_home_type:file getattr;
2221 ')
2222
2223 ########################################
2224 ## <summary>
2225 ##      Do not audit attempts to read user home files.
2226 ## </summary>
2227 ## <param name="domain">
2228 ##      <summary>
2229 ##      Domain to not audit.
2230 ##      </summary>
2231 ## </param>
2232 #
2233 interface(`userdom_dontaudit_read_user_home_content_files',`
2234         gen_require(`
2235                 attribute user_home_type;
2236                 type user_home_dir_t;
2237         ')
2238
2239         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2240         dontaudit $1 user_home_type:dir list_dir_perms;
2241         dontaudit $1 user_home_type:file read_file_perms;
2242         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2243 ')
2244
2245 ########################################
2246 ## <summary>
2247 ##      Do not audit attempts to append user home files.
2248 ## </summary>
2249 ## <param name="domain">
2250 ##      <summary>
2251 ##      Domain to not audit.
2252 ##      </summary>
2253 ## </param>
2254 #
2255 interface(`userdom_dontaudit_append_user_home_content_files',`
2256         gen_require(`
2257                 type user_home_t;
2258         ')
2259
2260         dontaudit $1 user_home_t:file append_file_perms;
2261 ')
2262
2263 ########################################
2264 ## <summary>
2265 ##      Do not audit attempts to write user home files.
2266 ## </summary>
2267 ## <param name="domain">
2268 ##      <summary>
2269 ##      Domain to not audit.
2270 ##      </summary>
2271 ## </param>
2272 #
2273 interface(`userdom_dontaudit_write_user_home_content_files',`
2274         gen_require(`
2275                 type user_home_t;
2276         ')
2277
2278         dontaudit $1 user_home_t:file write_file_perms;
2279 ')
2280
2281 ########################################
2282 ## <summary>
2283 ##      Delete files in a user home subdirectory.
2284 ## </summary>
2285 ## <param name="domain">
2286 ##      <summary>
2287 ##      Domain allowed access.
2288 ##      </summary>
2289 ## </param>
2290 #
2291 interface(`userdom_delete_user_home_content_files',`
2292         gen_require(`
2293                 type user_home_t;
2294         ')
2295
2296         allow $1 user_home_t:file delete_file_perms;
2297 ')
2298
2299 ########################################
2300 ## <summary>
2301 ##      Delete all files in a user home subdirectory.
2302 ## </summary>
2303 ## <param name="domain">
2304 ##      <summary>
2305 ##      Domain allowed access.
2306 ##      </summary>
2307 ## </param>
2308 #
2309 interface(`userdom_delete_all_user_home_content_files',`
2310         gen_require(`
2311                 attribute user_home_type;
2312         ')
2313
2314         allow $1 user_home_type:file delete_file_perms;
2315 ')
2316
2317 ########################################
2318 ## <summary>
2319 ##      Delete sock files in a user home subdirectory.
2320 ## </summary>
2321 ## <param name="domain">
2322 ##      <summary>
2323 ##      Domain allowed access.
2324 ##      </summary>
2325 ## </param>
2326 #
2327 interface(`userdom_delete_user_home_content_sock_files',`
2328         gen_require(`
2329                 type user_home_t;
2330         ')
2331
2332         allow $1 user_home_t:sock_file delete_file_perms;
2333 ')
2334
2335 ########################################
2336 ## <summary>
2337 ##      Delete all sock files in a user home subdirectory.
2338 ## </summary>
2339 ## <param name="domain">
2340 ##      <summary>
2341 ##      Domain allowed access.
2342 ##      </summary>
2343 ## </param>
2344 #
2345 interface(`userdom_delete_all_user_home_content_sock_files',`
2346         gen_require(`
2347                 attribute user_home_type;
2348         ')
2349
2350         allow $1 user_home_type:sock_file delete_file_perms;
2351 ')
2352
2353 ########################################
2354 ## <summary>
2355 ##      Do not audit attempts to write user home files.
2356 ## </summary>
2357 ## <param name="domain">
2358 ##      <summary>
2359 ##      Domain to not audit.
2360 ##      </summary>
2361 ## </param>
2362 #
2363 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2364         gen_require(`
2365                 type user_home_t;
2366         ')
2367
2368         dontaudit $1 user_home_t:file relabel_file_perms;
2369 ')
2370
2371 ########################################
2372 ## <summary>
2373 ##      Read user home subdirectory symbolic links.
2374 ## </summary>
2375 ## <param name="domain">
2376 ##      <summary>
2377 ##      Domain allowed access.
2378 ##      </summary>
2379 ## </param>
2380 #
2381 interface(`userdom_read_user_home_content_symlinks',`
2382         gen_require(`
2383                 type user_home_dir_t, user_home_t;
2384         ')
2385
2386         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2387 ')
2388
2389 ########################################
2390 ## <summary>
2391 ##      Execute user home files.
2392 ## </summary>
2393 ## <param name="domain">
2394 ##      <summary>
2395 ##      Domain allowed access.
2396 ##      </summary>
2397 ## </param>
2398 ## <rolecap/>
2399 #
2400 interface(`userdom_exec_user_home_content_files',`
2401         gen_require(`
2402                 type user_home_dir_t;
2403                 attribute user_home_type;
2404         ')
2405
2406         files_search_home($1)
2407         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2408         dontaudit $1 user_home_type:sock_file execute;
2409         ')
2410
2411 ########################################
2412 ## <summary>
2413 ##      Do not audit attempts to execute user home files.
2414 ## </summary>
2415 ## <param name="domain">
2416 ##      <summary>
2417 ##      Domain to not audit.
2418 ##      </summary>
2419 ## </param>
2420 #
2421 interface(`userdom_dontaudit_exec_user_home_content_files',`
2422         gen_require(`
2423                 type user_home_t;
2424         ')
2425
2426         dontaudit $1 user_home_t:file exec_file_perms;
2427 ')
2428
2429 ########################################
2430 ## <summary>
2431 ##      Create, read, write, and delete files
2432 ##      in a user home subdirectory.
2433 ## </summary>
2434 ## <param name="domain">
2435 ##      <summary>
2436 ##      Domain allowed access.
2437 ##      </summary>
2438 ## </param>
2439 #
2440 interface(`userdom_manage_user_home_content_files',`
2441         gen_require(`
2442                 type user_home_dir_t, user_home_t;
2443         ')
2444
2445         manage_files_pattern($1, user_home_t, user_home_t)
2446         allow $1 user_home_dir_t:dir search_dir_perms;
2447         files_search_home($1)
2448 ')
2449
2450 ########################################
2451 ## <summary>
2452 ##      Do not audit attempts to create, read, write, and delete directories
2453 ##      in a user home subdirectory.
2454 ## </summary>
2455 ## <param name="domain">
2456 ##      <summary>
2457 ##      Domain to not audit.
2458 ##      </summary>
2459 ## </param>
2460 #
2461 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2462         gen_require(`
2463                 type user_home_dir_t, user_home_t;
2464         ')
2465
2466         dontaudit $1 user_home_t:dir manage_dir_perms;
2467 ')
2468
2469 ########################################
2470 ## <summary>
2471 ##      Create, read, write, and delete symbolic links
2472 ##      in a user home subdirectory.
2473 ## </summary>
2474 ## <param name="domain">
2475 ##      <summary>
2476 ##      Domain allowed access.
2477 ##      </summary>
2478 ## </param>
2479 #
2480 interface(`userdom_manage_user_home_content_symlinks',`
2481         gen_require(`
2482                 type user_home_dir_t, user_home_t;
2483         ')
2484
2485         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2486         allow $1 user_home_dir_t:dir search_dir_perms;
2487         files_search_home($1)
2488 ')
2489
2490 ########################################
2491 ## <summary>
2492 ##      Delete symbolic links in a user home directory.
2493 ## </summary>
2494 ## <param name="domain">
2495 ##      <summary>
2496 ##      Domain allowed access.
2497 ##      </summary>
2498 ## </param>
2499 #
2500 interface(`userdom_delete_user_home_content_symlinks',`
2501         gen_require(`
2502                 type user_home_t;
2503         ')
2504
2505         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2506 ')
2507
2508 ########################################
2509 ## <summary>
2510 ##      Delete all symbolic links in a user home directory.
2511 ## </summary>
2512 ## <param name="domain">
2513 ##      <summary>
2514 ##      Domain allowed access.
2515 ##      </summary>
2516 ## </param>
2517 #
2518 interface(`userdom_delete_all_user_home_content_symlinks',`
2519         gen_require(`
2520                 attribute user_home_type;
2521         ')
2522
2523         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2524 ')
2525
2526 ########################################
2527 ## <summary>
2528 ##      Create, read, write, and delete named pipes
2529 ##      in a user home subdirectory.
2530 ## </summary>
2531 ## <param name="domain">
2532 ##      <summary>
2533 ##      Domain allowed access.
2534 ##      </summary>
2535 ## </param>
2536 #
2537 interface(`userdom_manage_user_home_content_pipes',`
2538         gen_require(`
2539                 type user_home_dir_t, user_home_t;
2540         ')
2541
2542         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2543         allow $1 user_home_dir_t:dir search_dir_perms;
2544         files_search_home($1)
2545 ')
2546
2547 ########################################
2548 ## <summary>
2549 ##      Create, read, write, and delete named sockets
2550 ##      in a user home subdirectory.
2551 ## </summary>
2552 ## <param name="domain">
2553 ##      <summary>
2554 ##      Domain allowed access.
2555 ##      </summary>
2556 ## </param>
2557 #
2558 interface(`userdom_manage_user_home_content_sockets',`
2559         gen_require(`
2560                 type user_home_dir_t, user_home_t;
2561         ')
2562
2563         allow $1 user_home_dir_t:dir search_dir_perms;
2564         manage_sock_files_pattern($1, user_home_t, user_home_t)
2565         files_search_home($1)
2566 ')
2567
2568 ########################################
2569 ## <summary>
2570 ##      Create objects in a user home directory
2571 ##      with an automatic type transition to
2572 ##      a specified private type.
2573 ## </summary>
2574 ## <param name="domain">
2575 ##      <summary>
2576 ##      Domain allowed access.
2577 ##      </summary>
2578 ## </param>
2579 ## <param name="private_type">
2580 ##      <summary>
2581 ##      The type of the object to create.
2582 ##      </summary>
2583 ## </param>
2584 ## <param name="object_class">
2585 ##      <summary>
2586 ##      The class of the object to be created.
2587 ##      </summary>
2588 ## </param>
2589 #
2590 interface(`userdom_user_home_dir_filetrans',`
2591         gen_require(`
2592                 type user_home_dir_t;
2593         ')
2594
2595         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2596         files_search_home($1)
2597 ')
2598
2599 ########################################
2600 ## <summary>
2601 ##      Create objects in a user home directory
2602 ##      with an automatic type transition to
2603 ##      a specified private type.
2604 ## </summary>
2605 ## <param name="domain">
2606 ##      <summary>
2607 ##      Domain allowed access.
2608 ##      </summary>
2609 ## </param>
2610 ## <param name="private_type">
2611 ##      <summary>
2612 ##      The type of the object to create.
2613 ##      </summary>
2614 ## </param>
2615 ## <param name="object_class">
2616 ##      <summary>
2617 ##      The class of the object to be created.
2618 ##      </summary>
2619 ## </param>
2620 #
2621 interface(`userdom_user_home_content_filetrans',`
2622         gen_require(`
2623                 type user_home_dir_t, user_home_t;
2624         ')
2625
2626         filetrans_pattern($1, user_home_t, $2, $3, $4)
2627         allow $1 user_home_dir_t:dir search_dir_perms;
2628         files_search_home($1)
2629 ')
2630
2631 ########################################
2632 ## <summary>
2633 ##      Create objects in a user home directory
2634 ##      with an automatic type transition to
2635 ##      the user home file type.
2636 ## </summary>
2637 ## <param name="domain">
2638 ##      <summary>
2639 ##      Domain allowed access.
2640 ##      </summary>
2641 ## </param>
2642 ## <param name="object_class">
2643 ##      <summary>
2644 ##      The class of the object to be created.
2645 ##      </summary>
2646 ## </param>
2647 #
2648 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2649         gen_require(`
2650                 type user_home_dir_t, user_home_t;
2651         ')
2652
2653         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2654         files_search_home($1)
2655 ')
2656
2657 ########################################
2658 ## <summary>
2659 ##      Write to user temporary named sockets.
2660 ## </summary>
2661 ## <param name="domain">
2662 ##      <summary>
2663 ##      Domain allowed access.
2664 ##      </summary>
2665 ## </param>
2666 #
2667 interface(`userdom_write_user_tmp_sockets',`
2668         gen_require(`
2669                 type user_tmp_t;
2670         ')
2671
2672         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2673         files_search_tmp($1)
2674 ')
2675
2676 ########################################
2677 ## <summary>
2678 ##      List user temporary directories.
2679 ## </summary>
2680 ## <param name="domain">
2681 ##      <summary>
2682 ##      Domain allowed access.
2683 ##      </summary>
2684 ## </param>
2685 #
2686 interface(`userdom_list_user_tmp',`
2687         gen_require(`
2688                 type user_tmp_t;
2689         ')
2690
2691         allow $1 user_tmp_t:dir list_dir_perms;
2692         files_search_tmp($1)
2693 ')
2694
2695 ########################################
2696 ## <summary>
2697 ##      Do not audit attempts to list user
2698 ##      temporary directories.
2699 ## </summary>
2700 ## <param name="domain">
2701 ##      <summary>
2702 ##      Domain to not audit.
2703 ##      </summary>
2704 ## </param>
2705 #
2706 interface(`userdom_dontaudit_list_user_tmp',`
2707         gen_require(`
2708                 type user_tmp_t;
2709         ')
2710
2711         dontaudit $1 user_tmp_t:dir list_dir_perms;
2712 ')
2713
2714 ########################################
2715 ## <summary>
2716 ##      Do not audit attempts to manage users
2717 ##      temporary directories.
2718 ## </summary>
2719 ## <param name="domain">
2720 ##      <summary>
2721 ##      Domain to not audit.
2722 ##      </summary>
2723 ## </param>
2724 #
2725 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2726         gen_require(`
2727                 type user_tmp_t;
2728         ')
2729
2730         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2731 ')
2732
2733 ########################################
2734 ## <summary>
2735 ##      Read user temporary files.
2736 ## </summary>
2737 ## <param name="domain">
2738 ##      <summary>
2739 ##      Domain allowed access.
2740 ##      </summary>
2741 ## </param>
2742 #
2743 interface(`userdom_read_user_tmp_files',`
2744         gen_require(`
2745                 type user_tmp_t;
2746         ')
2747
2748         read_files_pattern($1, user_tmp_t, user_tmp_t)
2749         allow $1 user_tmp_t:dir list_dir_perms;
2750         files_search_tmp($1)
2751 ')
2752
2753 ########################################
2754 ## <summary>
2755 ##      Do not audit attempts to read users
2756 ##      temporary files.
2757 ## </summary>
2758 ## <param name="domain">
2759 ##      <summary>
2760 ##      Domain to not audit.
2761 ##      </summary>
2762 ## </param>
2763 #
2764 interface(`userdom_dontaudit_read_user_tmp_files',`
2765         gen_require(`
2766                 type user_tmp_t;
2767         ')
2768
2769         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2770 ')
2771
2772 ########################################
2773 ## <summary>
2774 ##      Do not audit attempts to append users
2775 ##      temporary files.
2776 ## </summary>
2777 ## <param name="domain">
2778 ##      <summary>
2779 ##      Domain to not audit.
2780 ##      </summary>
2781 ## </param>
2782 #
2783 interface(`userdom_dontaudit_append_user_tmp_files',`
2784         gen_require(`
2785                 type user_tmp_t;
2786         ')
2787
2788         dontaudit $1 user_tmp_t:file append_file_perms;
2789 ')
2790
2791 ########################################
2792 ## <summary>
2793 ##      Read and write user temporary files.
2794 ## </summary>
2795 ## <param name="domain">
2796 ##      <summary>
2797 ##      Domain allowed access.
2798 ##      </summary>
2799 ## </param>
2800 #
2801 interface(`userdom_rw_user_tmp_files',`
2802         gen_require(`
2803                 type user_tmp_t;
2804         ')
2805
2806         allow $1 user_tmp_t:dir list_dir_perms;
2807         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2808         files_search_tmp($1)
2809 ')
2810
2811 ########################################
2812 ## <summary>
2813 ##      Do not audit attempts to manage users
2814 ##      temporary files.
2815 ## </summary>
2816 ## <param name="domain">
2817 ##      <summary>
2818 ##      Domain to not audit.
2819 ##      </summary>
2820 ## </param>
2821 #
2822 interface(`userdom_dontaudit_manage_user_tmp_files',`
2823         gen_require(`
2824                 type user_tmp_t;
2825         ')
2826
2827         dontaudit $1 user_tmp_t:file manage_file_perms;
2828 ')
2829
2830 ########################################
2831 ## <summary>
2832 ##      Read user temporary symbolic links.
2833 ## </summary>
2834 ## <param name="domain">
2835 ##      <summary>
2836 ##      Domain allowed access.
2837 ##      </summary>
2838 ## </param>
2839 #
2840 interface(`userdom_read_user_tmp_symlinks',`
2841         gen_require(`
2842                 type user_tmp_t;
2843         ')
2844
2845         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2846         allow $1 user_tmp_t:dir list_dir_perms;
2847         files_search_tmp($1)
2848 ')
2849
2850 ########################################
2851 ## <summary>
2852 ##      Create, read, write, and delete user
2853 ##      temporary directories.
2854 ## </summary>
2855 ## <param name="domain">
2856 ##      <summary>
2857 ##      Domain allowed access.
2858 ##      </summary>
2859 ## </param>
2860 #
2861 interface(`userdom_manage_user_tmp_dirs',`
2862         gen_require(`
2863                 type user_tmp_t;
2864         ')
2865
2866         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2867         files_search_tmp($1)
2868 ')
2869
2870 ########################################
2871 ## <summary>
2872 ##      Create, read, write, and delete user
2873 ##      temporary files.
2874 ## </summary>
2875 ## <param name="domain">
2876 ##      <summary>
2877 ##      Domain allowed access.
2878 ##      </summary>
2879 ## </param>
2880 #
2881 interface(`userdom_manage_user_tmp_files',`
2882         gen_require(`
2883                 type user_tmp_t;
2884         ')
2885
2886         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2887         files_search_tmp($1)
2888 ')
2889
2890 ########################################
2891 ## <summary>
2892 ##      Create, read, write, and delete user
2893 ##      temporary symbolic links.
2894 ## </summary>
2895 ## <param name="domain">
2896 ##      <summary>
2897 ##      Domain allowed access.
2898 ##      </summary>
2899 ## </param>
2900 #
2901 interface(`userdom_manage_user_tmp_symlinks',`
2902         gen_require(`
2903                 type user_tmp_t;
2904         ')
2905
2906         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2907         files_search_tmp($1)
2908 ')
2909
2910 ########################################
2911 ## <summary>
2912 ##      Create, read, write, and delete user
2913 ##      temporary named pipes.
2914 ## </summary>
2915 ## <param name="domain">
2916 ##      <summary>
2917 ##      Domain allowed access.
2918 ##      </summary>
2919 ## </param>
2920 #
2921 interface(`userdom_manage_user_tmp_pipes',`
2922         gen_require(`
2923                 type user_tmp_t;
2924         ')
2925
2926         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2927         files_search_tmp($1)
2928 ')
2929
2930 ########################################
2931 ## <summary>
2932 ##      Create, read, write, and delete user
2933 ##      temporary named sockets.
2934 ## </summary>
2935 ## <param name="domain">
2936 ##      <summary>
2937 ##      Domain allowed access.
2938 ##      </summary>
2939 ## </param>
2940 #
2941 interface(`userdom_manage_user_tmp_sockets',`
2942         gen_require(`
2943                 type user_tmp_t;
2944         ')
2945
2946         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2947         files_search_tmp($1)
2948 ')
2949
2950 ########################################
2951 ## <summary>
2952 ##      Create objects in a user temporary directory
2953 ##      with an automatic type transition to
2954 ##      a specified private type.
2955 ## </summary>
2956 ## <param name="domain">
2957 ##      <summary>
2958 ##      Domain allowed access.
2959 ##      </summary>
2960 ## </param>
2961 ## <param name="private_type">
2962 ##      <summary>
2963 ##      The type of the object to create.
2964 ##      </summary>
2965 ## </param>
2966 ## <param name="object_class">
2967 ##      <summary>
2968 ##      The class of the object to be created.
2969 ##      </summary>
2970 ## </param>
2971 #
2972 interface(`userdom_user_tmp_filetrans',`
2973         gen_require(`
2974                 type user_tmp_t;
2975         ')
2976
2977         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2978         files_search_tmp($1)
2979 ')
2980
2981 ########################################
2982 ## <summary>
2983 ##      Create objects in the temporary directory
2984 ##      with an automatic type transition to
2985 ##      the user temporary type.
2986 ## </summary>
2987 ## <param name="domain">
2988 ##      <summary>
2989 ##      Domain allowed access.
2990 ##      </summary>
2991 ## </param>
2992 ## <param name="object_class">
2993 ##      <summary>
2994 ##      The class of the object to be created.
2995 ##      </summary>
2996 ## </param>
2997 #
2998 interface(`userdom_tmp_filetrans_user_tmp',`
2999         gen_require(`
3000                 type user_tmp_t;
3001         ')
3002
3003         files_tmp_filetrans($1, user_tmp_t, $2)
3004 ')
3005
3006 #######################################
3007 ## <summary>
3008 ##  Getattr user tmpfs files.
3009 ## </summary>
3010 ## <param name="domain">
3011 ##  <summary>
3012 ##  Domain allowed access.
3013 ##  </summary>
3014 ## </param>
3015 #
3016 interface(`userdom_getattr_user_tmpfs_files',`
3017     gen_require(`
3018         type user_tmpfs_t;
3019     ')
3020
3021     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3022     fs_search_tmpfs($1)
3023 ')
3024
3025 ########################################
3026 ## <summary>
3027 ##      Read user tmpfs files.
3028 ## </summary>
3029 ## <param name="domain">
3030 ##      <summary>
3031 ##      Domain allowed access.
3032 ##      </summary>
3033 ## </param>
3034 #
3035 interface(`userdom_read_user_tmpfs_files',`
3036         gen_require(`
3037                 type user_tmpfs_t;
3038         ')
3039
3040         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3041         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3042         allow $1 user_tmpfs_t:dir list_dir_perms;
3043         fs_search_tmpfs($1)
3044 ')
3045
3046 ########################################
3047 ## <summary>
3048 ##      Read/Write user tmpfs files.
3049 ## </summary>
3050 ## <param name="domain">
3051 ##      <summary>
3052 ##      Domain allowed access.
3053 ##      </summary>
3054 ## </param>
3055 #
3056 interface(`userdom_rw_user_tmpfs_files',`
3057         gen_require(`
3058                 type user_tmpfs_t;
3059         ')
3060
3061         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3062         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3063         allow $1 user_tmpfs_t:dir list_dir_perms;
3064         fs_search_tmpfs($1)
3065 ')
3066
3067 ########################################
3068 ## <summary>
3069 ##      Read/Write inherited user tmpfs files.
3070 ## </summary>
3071 ## <param name="domain">
3072 ##      <summary>
3073 ##      Domain allowed access.
3074 ##      </summary>
3075 ## </param>
3076 #
3077 interface(`userdom_rw_inherited_user_tmpfs_files',`
3078         gen_require(`
3079                 type user_tmpfs_t;
3080         ')
3081
3082         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3083 ')
3084
3085 ########################################
3086 ## <summary>
3087 ##      Execute user tmpfs files.
3088 ## </summary>
3089 ## <param name="domain">
3090 ##      <summary>
3091 ##      Domain allowed access.
3092 ##      </summary>
3093 ## </param>
3094 #
3095 interface(`userdom_execute_user_tmpfs_files',`
3096         gen_require(`
3097                 type user_tmpfs_t;
3098         ')
3099
3100         allow $1 user_tmpfs_t:file execute;
3101 ')
3102
3103 ########################################
3104 ## <summary>
3105 ##      Get the attributes of a user domain tty.
3106 ## </summary>
3107 ## <param name="domain">
3108 ##      <summary>
3109 ##      Domain allowed access.
3110 ##      </summary>
3111 ## </param>
3112 #
3113 interface(`userdom_getattr_user_ttys',`
3114         gen_require(`
3115                 type user_tty_device_t;
3116         ')
3117
3118         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3119 ')
3120
3121 ########################################
3122 ## <summary>
3123 ##      Do not audit attempts to get the attributes of a user domain tty.
3124 ## </summary>
3125 ## <param name="domain">
3126 ##      <summary>
3127 ##      Domain to not audit.
3128 ##      </summary>
3129 ## </param>
3130 #
3131 interface(`userdom_dontaudit_getattr_user_ttys',`
3132         gen_require(`
3133                 type user_tty_device_t;
3134         ')
3135
3136         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3137 ')
3138
3139 ########################################
3140 ## <summary>
3141 ##      Set the attributes of a user domain tty.
3142 ## </summary>
3143 ## <param name="domain">
3144 ##      <summary>
3145 ##      Domain allowed access.
3146 ##      </summary>
3147 ## </param>
3148 #
3149 interface(`userdom_setattr_user_ttys',`
3150         gen_require(`
3151                 type user_tty_device_t;
3152         ')
3153
3154         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3155 ')
3156
3157 ########################################
3158 ## <summary>
3159 ##      Do not audit attempts to set the attributes of a user domain tty.
3160 ## </summary>
3161 ## <param name="domain">
3162 ##      <summary>
3163 ##      Domain to not audit.
3164 ##      </summary>
3165 ## </param>
3166 #
3167 interface(`userdom_dontaudit_setattr_user_ttys',`
3168         gen_require(`
3169                 type user_tty_device_t;
3170         ')
3171
3172         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3173 ')
3174
3175 ########################################
3176 ## <summary>
3177 ##      Read and write a user domain tty.
3178 ## </summary>
3179 ## <param name="domain">
3180 ##      <summary>
3181 ##      Domain allowed access.
3182 ##      </summary>
3183 ## </param>
3184 #
3185 interface(`userdom_use_user_ttys',`
3186         gen_require(`
3187                 type user_tty_device_t;
3188         ')
3189
3190         allow $1 user_tty_device_t:chr_file rw_term_perms;
3191 ')
3192
3193 ########################################
3194 ## <summary>
3195 ##      Read and write a inherited user domain tty.
3196 ## </summary>
3197 ## <param name="domain">
3198 ##      <summary>
3199 ##      Domain allowed access.
3200 ##      </summary>
3201 ## </param>
3202 #
3203 interface(`userdom_use_inherited_user_ttys',`
3204         gen_require(`
3205                 type user_tty_device_t;
3206         ')
3207
3208         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3209 ')
3210
3211 ########################################
3212 ## <summary>
3213 ##      Read and write a user domain pty.
3214 ## </summary>
3215 ## <param name="domain">
3216 ##      <summary>
3217 ##      Domain allowed access.
3218 ##      </summary>
3219 ## </param>
3220 #
3221 interface(`userdom_use_user_ptys',`
3222         gen_require(`
3223                 type user_devpts_t;
3224         ')
3225
3226         allow $1 user_devpts_t:chr_file rw_term_perms;
3227 ')
3228
3229 ########################################
3230 ## <summary>
3231 ##      Read and write a inherited user domain pty.
3232 ## </summary>
3233 ## <param name="domain">
3234 ##      <summary>
3235 ##      Domain allowed access.
3236 ##      </summary>
3237 ## </param>
3238 #
3239 interface(`userdom_use_inherited_user_ptys',`
3240         gen_require(`
3241                 type user_devpts_t;
3242         ')
3243
3244         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3245 ')
3246
3247 ########################################
3248 ## <summary>
3249 ##      Read and write a inherited user TTYs and PTYs.
3250 ## </summary>
3251 ## <desc>
3252 ##      <p>
3253 ##      Allow the specified domain to read and write inherited user
3254 ##      TTYs and PTYs. This will allow the domain to
3255 ##      interact with the user via the terminal. Typically
3256 ##      all interactive applications will require this
3257 ##      access.
3258 ##      </p>
3259 ## </desc>
3260 ## <param name="domain">
3261 ##      <summary>
3262 ##      Domain allowed access.
3263 ##      </summary>
3264 ## </param>
3265 ## <infoflow type="both" weight="10"/>
3266 #
3267 interface(`userdom_use_inherited_user_terminals',`
3268         gen_require(`
3269                 type user_tty_device_t, user_devpts_t;
3270         ')
3271
3272         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3273         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3274 ')
3275
3276 #######################################
3277 ## <summary>
3278 ##  Allow attempts to read and write
3279 ##  a user domain tty and pty.
3280 ## </summary>
3281 ## <param name="domain">
3282 ##  <summary>
3283 ##  Domain to not audit.
3284 ##  </summary>
3285 ## </param>
3286 #
3287 interface(`userdom_use_user_terminals',`
3288     gen_require(`
3289         type user_tty_device_t, user_devpts_t;
3290     ')
3291
3292     allow $1 user_tty_device_t:chr_file rw_term_perms;
3293     allow $1 user_devpts_t:chr_file rw_term_perms;
3294 ')
3295
3296 ########################################
3297 ## <summary>
3298 ##      Do not audit attempts to read and write
3299 ##      a user domain tty and pty.
3300 ## </summary>
3301 ## <param name="domain">
3302 ##      <summary>
3303 ##      Domain to not audit.
3304 ##      </summary>
3305 ## </param>
3306 #
3307 interface(`userdom_dontaudit_use_user_terminals',`
3308         gen_require(`
3309                 type user_tty_device_t, user_devpts_t;
3310         ')
3311
3312         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3313         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3314 ')
3315
3316
3317 ########################################
3318 ## <summary>
3319 ##      Get attributes of user domain tty and pty.
3320 ## </summary>
3321 ## <param name="domain">
3322 ##      <summary>
3323 ##      Domain allowed access.
3324 ##      </summary>
3325 ## </param>
3326 #
3327 interface(`userdom_getattr_user_terminals',`
3328         gen_require(`
3329                 type user_tty_device_t, user_devpts_t;
3330         ')
3331
3332         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3333 ')
3334
3335 ########################################
3336 ## <summary>
3337 ##      Execute a shell in all user domains.  This
3338 ##      is an explicit transition, requiring the
3339 ##      caller to use setexeccon().
3340 ## </summary>
3341 ## <param name="domain">
3342 ##      <summary>
3343 ##      Domain allowed to transition.
3344 ##      </summary>
3345 ## </param>
3346 #
3347 interface(`userdom_spec_domtrans_all_users',`
3348         gen_require(`
3349                 attribute userdomain;
3350         ')
3351
3352         corecmd_shell_spec_domtrans($1, userdomain)
3353         allow userdomain $1:fd use;
3354         allow userdomain $1:fifo_file rw_file_perms;
3355         allow userdomain $1:process sigchld;
3356 ')
3357
3358 ########################################
3359 ## <summary>
3360 ##      Execute an Xserver session in all unprivileged user domains.  This
3361 ##      is an explicit transition, requiring the
3362 ##      caller to use setexeccon().
3363 ## </summary>
3364 ## <param name="domain">
3365 ##      <summary>
3366 ##      Domain allowed to transition.
3367 ##      </summary>
3368 ## </param>
3369 #
3370 interface(`userdom_xsession_spec_domtrans_all_users',`
3371         gen_require(`
3372                 attribute userdomain;
3373         ')
3374
3375         xserver_xsession_spec_domtrans($1, userdomain)
3376         allow userdomain $1:fd use;
3377         allow userdomain $1:fifo_file rw_file_perms;
3378         allow userdomain $1:process sigchld;
3379 ')
3380
3381 ########################################
3382 ## <summary>
3383 ##      Execute a shell in all unprivileged user domains.  This
3384 ##      is an explicit transition, requiring the
3385 ##      caller to use setexeccon().
3386 ## </summary>
3387 ## <param name="domain">
3388 ##      <summary>
3389 ##      Domain allowed to transition.
3390 ##      </summary>
3391 ## </param>
3392 #
3393 interface(`userdom_spec_domtrans_unpriv_users',`
3394         gen_require(`
3395                 attribute unpriv_userdomain;
3396         ')
3397
3398         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3399         allow unpriv_userdomain $1:fd use;
3400         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3401         allow unpriv_userdomain $1:process sigchld;
3402 ')
3403
3404 #####################################
3405 ## <summary>
3406 ##  Allow domain dyntrans to unpriv userdomain.
3407 ## </summary>
3408 ## <param name="domain">
3409 ##  <summary>
3410 ##  Domain allowed access.
3411 ##  </summary>
3412 ## </param>
3413 #
3414 interface(`userdom_dyntransition_unpriv_users',`
3415     gen_require(`
3416         attribute unpriv_userdomain;
3417     ')
3418
3419     allow $1 unpriv_userdomain:process dyntransition;
3420 ')
3421
3422 ########################################
3423 ## <summary>
3424 ##      Execute an Xserver session in all unprivileged user domains.  This
3425 ##      is an explicit transition, requiring the
3426 ##      caller to use setexeccon().
3427 ## </summary>
3428 ## <param name="domain">
3429 ##      <summary>
3430 ##      Domain allowed to transition.
3431 ##      </summary>
3432 ## </param>
3433 #
3434 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3435         gen_require(`
3436                 attribute unpriv_userdomain;
3437         ')
3438
3439         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3440         allow unpriv_userdomain $1:fd use;
3441         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3442         allow unpriv_userdomain $1:process sigchld;
3443 ')
3444
3445 ########################################
3446 ## <summary>
3447 ##      Manage unpriviledged user SysV sempaphores.
3448 ## </summary>
3449 ## <param name="domain">
3450 ##      <summary>
3451 ##      Domain allowed access.
3452 ##      </summary>
3453 ## </param>
3454 #
3455 interface(`userdom_manage_unpriv_user_semaphores',`
3456         gen_require(`
3457                 attribute unpriv_userdomain;
3458         ')
3459
3460         allow $1 unpriv_userdomain:sem create_sem_perms;
3461 ')
3462
3463 ########################################
3464 ## <summary>
3465 ##      Manage unpriviledged user SysV shared
3466 ##      memory segments.
3467 ## </summary>
3468 ## <param name="domain">
3469 ##      <summary>
3470 ##      Domain allowed access.
3471 ##      </summary>
3472 ## </param>
3473 #
3474 interface(`userdom_manage_unpriv_user_shared_mem',`
3475         gen_require(`
3476                 attribute unpriv_userdomain;
3477         ')
3478
3479         allow $1 unpriv_userdomain:shm create_shm_perms;
3480 ')
3481
3482 ########################################
3483 ## <summary>
3484 ##      Execute bin_t in the unprivileged user domains. This
3485 ##      is an explicit transition, requiring the
3486 ##      caller to use setexeccon().
3487 ## </summary>
3488 ## <param name="domain">
3489 ##      <summary>
3490 ##      Domain allowed to transition.
3491 ##      </summary>
3492 ## </param>
3493 #
3494 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3495         gen_require(`
3496                 attribute unpriv_userdomain;
3497         ')
3498
3499         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3500         allow unpriv_userdomain $1:fd use;
3501         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3502         allow unpriv_userdomain $1:process sigchld;
3503 ')
3504
3505 ########################################
3506 ## <summary>
3507 ##      Execute all entrypoint files in unprivileged user
3508 ##      domains. This is an explicit transition, requiring the
3509 ##      caller to use setexeccon().
3510 ## </summary>
3511 ## <param name="domain">
3512 ##      <summary>
3513 ##      Domain allowed access.
3514 ##      </summary>
3515 ## </param>
3516 #
3517 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3518         gen_require(`
3519                 attribute unpriv_userdomain;
3520         ')
3521
3522         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3523         allow unpriv_userdomain $1:fd use;
3524         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3525         allow unpriv_userdomain $1:process sigchld;
3526 ')
3527
3528 ########################################
3529 ## <summary>
3530 ##      Search users home directories.
3531 ## </summary>
3532 ## <param name="domain">
3533 ##      <summary>
3534 ##      Domain allowed access.
3535 ##      </summary>
3536 ## </param>
3537 #
3538 interface(`userdom_search_user_home_content',`
3539         gen_require(`
3540                 type user_home_dir_t;
3541                 attribute user_home_type;
3542         ')
3543
3544         files_list_home($1)
3545         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3546         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3547 ')
3548
3549 ########################################
3550 ## <summary>
3551 ##      Send general signals to unprivileged user domains.
3552 ## </summary>
3553 ## <param name="domain">
3554 ##      <summary>
3555 ##      Domain allowed access.
3556 ##      </summary>
3557 ## </param>
3558 #
3559 interface(`userdom_signal_unpriv_users',`
3560         gen_require(`
3561                 attribute unpriv_userdomain;
3562         ')
3563
3564         allow $1 unpriv_userdomain:process signal;
3565 ')
3566
3567 ########################################
3568 ## <summary>
3569 ##      Inherit the file descriptors from unprivileged user domains.
3570 ## </summary>
3571 ## <param name="domain">
3572 ##      <summary>
3573 ##      Domain allowed access.
3574 ##      </summary>
3575 ## </param>
3576 #
3577 interface(`userdom_use_unpriv_users_fds',`
3578         gen_require(`
3579                 attribute unpriv_userdomain;
3580         ')
3581
3582         allow $1 unpriv_userdomain:fd use;
3583 ')
3584
3585 ########################################
3586 ## <summary>
3587 ##      Do not audit attempts to inherit the file descriptors
3588 ##      from unprivileged user domains.
3589 ## </summary>
3590 ## <desc>
3591 ##      <p>
3592 ##      Do not audit attempts to inherit the file descriptors
3593 ##      from unprivileged user domains. This will supress
3594 ##      SELinux denial messages when the specified domain is denied
3595 ##      the permission to inherit these file descriptors.
3596 ##      </p>
3597 ## </desc>
3598 ## <param name="domain">
3599 ##      <summary>
3600 ##      Domain to not audit.
3601 ##      </summary>
3602 ## </param>
3603 ## <infoflow type="none"/>
3604 #
3605 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3606         gen_require(`
3607                 attribute unpriv_userdomain;
3608         ')
3609
3610         dontaudit $1 unpriv_userdomain:fd use;
3611 ')
3612
3613 ########################################
3614 ## <summary>
3615 ##      Do not audit attempts to use user ptys.
3616 ## </summary>
3617 ## <param name="domain">
3618 ##      <summary>
3619 ##      Domain to not audit.
3620 ##      </summary>
3621 ## </param>
3622 #
3623 interface(`userdom_dontaudit_use_user_ptys',`
3624         gen_require(`
3625                 type user_devpts_t;
3626         ')
3627
3628         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3629 ')
3630
3631 ########################################
3632 ## <summary>
3633 ##      Relabel files to unprivileged user pty types.
3634 ## </summary>
3635 ## <param name="domain">
3636 ##      <summary>
3637 ##      Domain allowed access.
3638 ##      </summary>
3639 ## </param>
3640 #
3641 interface(`userdom_relabelto_user_ptys',`
3642         gen_require(`
3643                 type user_devpts_t;
3644         ')
3645
3646         allow $1 user_devpts_t:chr_file relabelto;
3647 ')
3648
3649 ########################################
3650 ## <summary>
3651 ##      Do not audit attempts to relabel files from
3652 ##      user pty types.
3653 ## </summary>
3654 ## <param name="domain">
3655 ##      <summary>
3656 ##      Domain to not audit.
3657 ##      </summary>
3658 ## </param>
3659 #
3660 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3661         gen_require(`
3662                 type user_devpts_t;
3663         ')
3664
3665         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3666 ')
3667
3668 ########################################
3669 ## <summary>
3670 ##      Write all users files in /tmp
3671 ## </summary>
3672 ## <param name="domain">
3673 ##      <summary>
3674 ##      Domain allowed access.
3675 ##      </summary>
3676 ## </param>
3677 #
3678 interface(`userdom_write_user_tmp_files',`
3679         gen_require(`
3680                 type user_tmp_t;
3681         ')
3682
3683         write_files_pattern($1, user_tmp_t, user_tmp_t)
3684 ')
3685
3686 ########################################
3687 ## <summary>
3688 ##      Do not audit attempts to write users
3689 ##      temporary files.
3690 ## </summary>
3691 ## <param name="domain">
3692 ##      <summary>
3693 ##      Domain to not audit.
3694 ##      </summary>
3695 ## </param>
3696 #
3697 interface(`userdom_dontaudit_write_user_tmp_files',`
3698         gen_require(`
3699                 type user_tmp_t;
3700         ')
3701
3702         dontaudit $1 user_tmp_t:file write;
3703 ')
3704
3705 ########################################
3706 ## <summary>
3707 ##      Do not audit attempts to read/write users
3708 ##      temporary fifo files.
3709 ## </summary>
3710 ## <param name="domain">
3711 ##      <summary>
3712 ##      Domain to not audit.
3713 ##      </summary>
3714 ## </param>
3715 #
3716 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3717         gen_require(`
3718                 type user_tmp_t;
3719         ')
3720
3721         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3722 ')
3723
3724 ########################################
3725 ## <summary>
3726 ##      Do not audit attempts to use user ttys.
3727 ## </summary>
3728 ## <param name="domain">
3729 ##      <summary>
3730 ##      Domain to not audit.
3731 ##      </summary>
3732 ## </param>
3733 #
3734 interface(`userdom_dontaudit_use_user_ttys',`
3735         gen_require(`
3736                 type user_tty_device_t;
3737         ')
3738
3739         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3740 ')
3741
3742 ########################################
3743 ## <summary>
3744 ##      Read the process state of all user domains.
3745 ## </summary>
3746 ## <param name="domain">
3747 ##      <summary>
3748 ##      Domain allowed access.
3749 ##      </summary>
3750 ## </param>
3751 #
3752 interface(`userdom_read_all_users_state',`
3753         gen_require(`
3754                 attribute userdomain;
3755         ')
3756
3757         read_files_pattern($1, userdomain, userdomain)
3758         read_lnk_files_pattern($1,userdomain,userdomain)
3759         kernel_search_proc($1)
3760 ')
3761
3762 ########################################
3763 ## <summary>
3764 ##      Get the attributes of all user domains.
3765 ## </summary>
3766 ## <param name="domain">
3767 ##      <summary>
3768 ##      Domain allowed access.
3769 ##      </summary>
3770 ## </param>
3771 #
3772 interface(`userdom_getattr_all_users',`
3773         gen_require(`
3774                 attribute userdomain;
3775         ')
3776
3777         allow $1 userdomain:process getattr;
3778 ')
3779
3780 ########################################
3781 ## <summary>
3782 ##      Inherit the file descriptors from all user domains
3783 ## </summary>
3784 ## <param name="domain">
3785 ##      <summary>
3786 ##      Domain allowed access.
3787 ##      </summary>
3788 ## </param>
3789 #
3790 interface(`userdom_use_all_users_fds',`
3791         gen_require(`
3792                 attribute userdomain;
3793         ')
3794
3795         allow $1 userdomain:fd use;
3796 ')
3797
3798 ########################################
3799 ## <summary>
3800 ##      Do not audit attempts to inherit the file
3801 ##      descriptors from any user domains.
3802 ## </summary>
3803 ## <param name="domain">
3804 ##      <summary>
3805 ##      Domain to not audit.
3806 ##      </summary>
3807 ## </param>
3808 #
3809 interface(`userdom_dontaudit_use_all_users_fds',`
3810         gen_require(`
3811                 attribute userdomain;
3812         ')
3813
3814         dontaudit $1 userdomain:fd use;
3815 ')
3816
3817 ########################################
3818 ## <summary>
3819 ##      Send general signals to all user domains.
3820 ## </summary>
3821 ## <param name="domain">
3822 ##      <summary>
3823 ##      Domain allowed access.
3824 ##      </summary>
3825 ## </param>
3826 #
3827 interface(`userdom_signal_all_users',`
3828         gen_require(`
3829                 attribute userdomain;
3830         ')
3831
3832         allow $1 userdomain:process signal;
3833 ')
3834
3835 ########################################
3836 ## <summary>
3837 ##      Send kill signals to all user domains.
3838 ## </summary>
3839 ## <param name="domain">
3840 ##      <summary>
3841 ##      Domain allowed access.
3842 ##      </summary>
3843 ## </param>
3844 #
3845 interface(`userdom_kill_all_users',`
3846         gen_require(`
3847                 attribute userdomain;
3848         ')
3849
3850         allow $1 userdomain:process sigkill;
3851 ')
3852
3853 ########################################
3854 ## <summary>
3855 ##      Send a SIGCHLD signal to all user domains.
3856 ## </summary>
3857 ## <param name="domain">
3858 ##      <summary>
3859 ##      Domain allowed access.
3860 ##      </summary>
3861 ## </param>
3862 #
3863 interface(`userdom_sigchld_all_users',`
3864         gen_require(`
3865                 attribute userdomain;
3866         ')
3867
3868         allow $1 userdomain:process sigchld;
3869 ')
3870
3871 ########################################
3872 ## <summary>
3873 ##      Read keys for all user domains.
3874 ## </summary>
3875 ## <param name="domain">
3876 ##      <summary>
3877 ##      Domain allowed access.
3878 ##      </summary>
3879 ## </param>
3880 #
3881 interface(`userdom_read_all_users_keys',`
3882         gen_require(`
3883                 attribute userdomain;
3884         ')
3885
3886         allow $1 userdomain:key read;
3887 ')
3888
3889 ########################################
3890 ## <summary>
3891 ##      Create keys for all user domains.
3892 ## </summary>
3893 ## <param name="domain">
3894 ##      <summary>
3895 ##      Domain allowed access.
3896 ##      </summary>
3897 ## </param>
3898 #
3899 interface(`userdom_create_all_users_keys',`
3900         gen_require(`
3901                 attribute userdomain;
3902         ')
3903
3904         allow $1 userdomain:key create;
3905 ')
3906
3907 ########################################
3908 ## <summary>
3909 ##      Send a dbus message to all user domains.
3910 ## </summary>
3911 ## <param name="domain">
3912 ##      <summary>
3913 ##      Domain allowed access.
3914 ##      </summary>
3915 ## </param>
3916 #
3917 interface(`userdom_dbus_send_all_users',`
3918         gen_require(`
3919                 attribute userdomain;
3920                 class dbus send_msg;
3921         ')
3922
3923         allow $1 userdomain:dbus send_msg;
3924 ')
3925
3926 ########################################
3927 ## <summary>
3928 ##      Allow apps to set rlimits on userdomain
3929 ## </summary>
3930 ## <param name="domain">
3931 ##      <summary>
3932 ##      Domain allowed access.
3933 ##      </summary>
3934 ## </param>
3935 #
3936 interface(`userdom_set_rlimitnh',`
3937         gen_require(`
3938                 attribute userdomain;
3939         ')
3940
3941         allow $1 userdomain:process rlimitinh;
3942 ')
3943
3944 ########################################
3945 ## <summary>
3946 ##      Define this type as a Allow apps to set rlimits on userdomain
3947 ## </summary>
3948 ## <param name="domain">
3949 ##      <summary>
3950 ##      Domain allowed access.
3951 ##      </summary>
3952 ## </param>
3953 ## <param name="userdomain_prefix">
3954 ##      <summary>
3955 ##      The prefix of the user domain (e.g., user
3956 ##      is the prefix for user_t).
3957 ## </summary>
3958 ## </param>
3959 ## <param name="domain">
3960 ##      <summary>
3961 ##      Domain allowed access.
3962 ##      </summary>
3963 ## </param>
3964 #
3965 template(`userdom_unpriv_usertype',`
3966         gen_require(`
3967                 attribute unpriv_userdomain, userdomain;
3968                 attribute $1_usertype;
3969         ')
3970         typeattribute $2  $1_usertype;
3971         typeattribute $2  unpriv_userdomain;
3972         typeattribute $2  userdomain;
3973
3974         auth_use_nsswitch($2)
3975         ubac_constrained($2)
3976 ')
3977
3978 ########################################
3979 ## <summary>
3980 ##      Connect to users over an unix stream socket.
3981 ## </summary>
3982 ## <param name="domain">
3983 ##      <summary>
3984 ##      Domain allowed access.
3985 ##      </summary>
3986 ## </param>
3987 #
3988 interface(`userdom_stream_connect',`
3989         gen_require(`
3990                 type user_tmp_t;
3991                 attribute userdomain;
3992         ')
3993
3994         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3995 ')
3996
3997 ########################################
3998 ## <summary>
3999 ##      Ptrace user domains.
4000 ## </summary>
4001 ## <param name="domain">
4002 ##      <summary>
4003 ##      Domain allowed access.
4004 ##      </summary>
4005 ## </param>
4006 #
4007 interface(`userdom_ptrace_all_users',`
4008         gen_require(`
4009                 attribute userdomain;
4010         ')
4011
4012         allow $1 userdomain:process ptrace;
4013 ')
4014
4015 ########################################
4016 ## <summary>
4017 ##      dontaudit Search /root
4018 ## </summary>
4019 ## <param name="domain">
4020 ##      <summary>
4021 ##      Domain to not audit.
4022 ##      </summary>
4023 ## </param>
4024 #
4025 interface(`userdom_dontaudit_search_admin_dir',`
4026         gen_require(`
4027                 type admin_home_t;
4028         ')
4029
4030         dontaudit $1 admin_home_t:dir search_dir_perms;
4031 ')
4032
4033 ########################################
4034 ## <summary>
4035 ##      dontaudit list /root
4036 ## </summary>
4037 ## <param name="domain">
4038 ##      <summary>
4039 ##      Domain to not audit.
4040 ##      </summary>
4041 ## </param>
4042 #
4043 interface(`userdom_dontaudit_list_admin_dir',`
4044         gen_require(`
4045                 type admin_home_t;
4046         ')
4047
4048         dontaudit $1 admin_home_t:dir list_dir_perms;
4049 ')
4050
4051 ########################################
4052 ## <summary>
4053 ##      Allow domain to  list /root
4054 ## </summary>
4055 ## <param name="domain">
4056 ##      <summary>
4057 ##      Domain allowed access.
4058 ##      </summary>
4059 ## </param>
4060 #
4061 interface(`userdom_list_admin_dir',`
4062         gen_require(`
4063                 type admin_home_t;
4064         ')
4065
4066         allow $1 admin_home_t:dir list_dir_perms;
4067 ')
4068
4069 ########################################
4070 ## <summary>
4071 ##      Allow Search /root
4072 ## </summary>
4073 ## <param name="domain">
4074 ##      <summary>
4075 ##      Domain allowed access.
4076 ##      </summary>
4077 ## </param>
4078 #
4079 interface(`userdom_search_admin_dir',`
4080         gen_require(`
4081                 type admin_home_t;
4082         ')
4083
4084         allow $1 admin_home_t:dir search_dir_perms;
4085 ')
4086
4087 ########################################
4088 ## <summary>
4089 ##      RW unpriviledged user SysV sempaphores.
4090 ## </summary>
4091 ## <param name="domain">
4092 ##      <summary>
4093 ##      Domain allowed access.
4094 ##      </summary>
4095 ## </param>
4096 #
4097 interface(`userdom_rw_semaphores',`
4098         gen_require(`
4099                 attribute unpriv_userdomain;
4100         ')
4101
4102         allow $1 unpriv_userdomain:sem rw_sem_perms;
4103 ')
4104
4105 ########################################
4106 ## <summary>
4107 ##      Send a message to unpriv users over a unix domain
4108 ##      datagram socket.
4109 ## </summary>
4110 ## <param name="domain">
4111 ##      <summary>
4112 ##      Domain allowed access.
4113 ##      </summary>
4114 ## </param>
4115 #
4116 interface(`userdom_dgram_send',`
4117         gen_require(`
4118                 attribute unpriv_userdomain;
4119         ')
4120
4121         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4122 ')
4123
4124 ######################################
4125 ## <summary>
4126 ##      Send a message to users over a unix domain
4127 ##      datagram socket.
4128 ## </summary>
4129 ## <param name="domain">
4130 ##      <summary>
4131 ##      Domain allowed access.
4132 ##      </summary>
4133 ## </param>
4134 #
4135 interface(`userdom_users_dgram_send',`
4136         gen_require(`
4137                  attribute userdomain;
4138       ')
4139
4140        allow $1 userdomain:unix_dgram_socket sendto;
4141 ')
4142
4143 #######################################
4144 ## <summary>
4145 ##      Allow execmod on files in homedirectory
4146 ## </summary>
4147 ## <param name="domain">
4148 ##      <summary>
4149 ##      Domain allowed access.
4150 ##      </summary>
4151 ## </param>
4152 ## <rolebase/>
4153 #
4154 interface(`userdom_execmod_user_home_files',`
4155         gen_require(`
4156                 type user_home_type;
4157         ')
4158
4159         allow $1 user_home_type:file execmod;
4160 ')
4161
4162 ########################################
4163 ## <summary>
4164 ##      Read admin home files.
4165 ## </summary>
4166 ## <param name="domain">
4167 ##      <summary>
4168 ##      Domain allowed access.
4169 ##      </summary>
4170 ## </param>
4171 ## <rolecap/>
4172 #
4173 interface(`userdom_read_admin_home_files',`
4174         gen_require(`
4175                 type admin_home_t;
4176         ')
4177
4178         read_files_pattern($1, admin_home_t, admin_home_t)
4179 ')
4180
4181 ########################################
4182 ## <summary>
4183 ##      Execute admin home files.
4184 ## </summary>
4185 ## <param name="domain">
4186 ##      <summary>
4187 ##      Domain allowed access.
4188 ##      </summary>
4189 ## </param>
4190 ## <rolecap/>
4191 #
4192 interface(`userdom_exec_admin_home_files',`
4193         gen_require(`
4194                 type admin_home_t;
4195         ')
4196
4197         exec_files_pattern($1, admin_home_t, admin_home_t)
4198 ')
4199
4200 ########################################
4201 ## <summary>
4202 ##      Append files inherited
4203 ##      in the /root directory.
4204 ## </summary>
4205 ## <param name="domain">
4206 ##      <summary>
4207 ##      Domain allowed access.
4208 ##      </summary>
4209 ## </param>
4210 #
4211 interface(`userdom_inherit_append_admin_home_files',`
4212         gen_require(`
4213                 type admin_home_t;
4214         ')
4215
4216         allow $1 admin_home_t:file { getattr append };
4217 ')
4218
4219
4220 #######################################
4221 ## <summary>
4222 ##      Manage all files/directories in the homedir
4223 ## </summary>
4224 ## <param name="userdomain">
4225 ##      <summary>
4226 ##      The user domain
4227 ##      </summary>
4228 ## </param>
4229 ## <rolebase/>
4230 #
4231 interface(`userdom_manage_user_home_content',`
4232         gen_require(`
4233                 type user_home_dir_t, user_home_t;
4234                 attribute user_home_type;
4235         ')
4236
4237         files_list_home($1)
4238         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4239         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4240         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4241         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4242         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4243         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4244
4245 ')
4246
4247
4248 ########################################
4249 ## <summary>
4250 ##      Create objects in a user home directory
4251 ##      with an automatic type transition to
4252 ##      the user home file type.
4253 ## </summary>
4254 ## <param name="domain">
4255 ##      <summary>
4256 ##      Domain allowed access.
4257 ##      </summary>
4258 ## </param>
4259 ## <param name="object_class">
4260 ##      <summary>
4261 ##      The class of the object to be created.
4262 ##      </summary>
4263 ## </param>
4264 #
4265 interface(`userdom_user_home_dir_filetrans_pattern',`
4266         gen_require(`
4267                 type user_home_dir_t, user_home_t;
4268         ')
4269
4270         type_transition $1 user_home_dir_t:$2 user_home_t;
4271 ')
4272
4273 ########################################
4274 ## <summary>
4275 ##      Create objects in the /root directory
4276 ##      with an automatic type transition to
4277 ##      a specified private type.
4278 ## </summary>
4279 ## <param name="domain">
4280 ##      <summary>
4281 ##      Domain allowed access.
4282 ##      </summary>
4283 ## </param>
4284 ## <param name="private_type">
4285 ##      <summary>
4286 ##      The type of the object to create.
4287 ##      </summary>
4288 ## </param>
4289 ## <param name="object_class">
4290 ##      <summary>
4291 ##      The class of the object to be created.
4292 ##      </summary>
4293 ## </param>
4294 #
4295 interface(`userdom_admin_home_dir_filetrans',`
4296         gen_require(`
4297                 type admin_home_t;
4298         ')
4299
4300         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4301 ')
4302
4303 ########################################
4304 ## <summary>
4305 ##      Send signull to unprivileged user domains.
4306 ## </summary>
4307 ## <param name="domain">
4308 ##      <summary>
4309 ##      Domain allowed access.
4310 ##      </summary>
4311 ## </param>
4312 #
4313 interface(`userdom_signull_unpriv_users',`
4314         gen_require(`
4315                 attribute unpriv_userdomain;
4316         ')
4317
4318         allow $1 unpriv_userdomain:process signull;
4319 ')
4320
4321 ########################################
4322 ## <summary>
4323 ##      Write all users files in /tmp
4324 ## </summary>
4325 ## <param name="domain">
4326 ##      <summary>
4327 ##      Domain allowed access.
4328 ##      </summary>
4329 ## </param>
4330 #
4331 interface(`userdom_write_user_tmp_dirs',`
4332         gen_require(`
4333                 type user_tmp_t;
4334         ')
4335
4336         write_files_pattern($1, user_tmp_t, user_tmp_t)
4337 ')
4338
4339 ########################################
4340 ## <summary>
4341 ##      Manage keys for all user domains.
4342 ## </summary>
4343 ## <param name="domain">
4344 ##      <summary>
4345 ##      Domain allowed access.
4346 ##      </summary>
4347 ## </param>
4348 #
4349 interface(`userdom_manage_all_users_keys',`
4350         gen_require(`
4351                 attribute userdomain;
4352         ')
4353
4354         allow $1 userdomain:key manage_key_perms;
4355 ')
4356
4357
4358 ########################################
4359 ## <summary>
4360 ##      Do not audit attempts to read and write
4361 ##      unserdomain stream.
4362 ## </summary>
4363 ## <param name="domain">
4364 ##      <summary>
4365 ##      Domain to not audit.
4366 ##      </summary>
4367 ## </param>
4368 #
4369 interface(`userdom_dontaudit_rw_stream',`
4370         gen_require(`
4371                 attribute userdomain;
4372         ')
4373
4374         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4375 ')
4376
4377 ########################################
4378 ## <summary>
4379 ##      Do not audit attempts to read and write
4380 ##      unserdomain datagram socket.
4381 ## </summary>
4382 ## <param name="domain">
4383 ##      <summary>
4384 ##      Domain to not audit.
4385 ##      </summary>
4386 ## </param>
4387 #
4388 interface(`userdom_dontaudit_rw_dgram_socket',`
4389         gen_require(`
4390                 attribute userdomain;
4391         ')
4392
4393         dontaudit $1 userdomain:unix_dgram_socket { read write };
4394 ')
4395
4396 ########################################
4397 ## <summary>
4398 ##      Append files
4399 ##      in a user home subdirectory.
4400 ## </summary>
4401 ## <param name="domain">
4402 ##      <summary>
4403 ##      Domain allowed access.
4404 ##      </summary>
4405 ## </param>
4406 #
4407 interface(`userdom_append_user_home_content_files',`
4408         gen_require(`
4409                 type user_home_dir_t, user_home_t;
4410         ')
4411
4412         append_files_pattern($1, user_home_t, user_home_t)
4413         allow $1 user_home_dir_t:dir search_dir_perms;
4414         files_search_home($1)
4415 ')
4416
4417 ########################################
4418 ## <summary>
4419 ##      Read files inherited
4420 ##      in a user home subdirectory.
4421 ## </summary>
4422 ## <param name="domain">
4423 ##      <summary>
4424 ##      Domain allowed access.
4425 ##      </summary>
4426 ## </param>
4427 #
4428 interface(`userdom_read_inherited_user_home_content_files',`
4429         gen_require(`
4430                 attribute user_home_type;
4431         ')
4432
4433         allow $1 user_home_type:file { getattr read };
4434 ')
4435
4436 ########################################
4437 ## <summary>
4438 ##      Append files inherited
4439 ##      in a user home subdirectory.
4440 ## </summary>
4441 ## <param name="domain">
4442 ##      <summary>
4443 ##      Domain allowed access.
4444 ##      </summary>
4445 ## </param>
4446 #
4447 interface(`userdom_inherit_append_user_home_content_files',`
4448         gen_require(`
4449                 type user_home_t;
4450         ')
4451
4452         allow $1 user_home_t:file { getattr append };
4453 ')
4454
4455 ########################################
4456 ## <summary>
4457 ##      Append files inherited
4458 ##      in a user tmp files.
4459 ## </summary>
4460 ## <param name="domain">
4461 ##      <summary>
4462 ##      Domain allowed access.
4463 ##      </summary>
4464 ## </param>
4465 #
4466 interface(`userdom_inherit_append_user_tmp_files',`
4467         gen_require(`
4468                 type user_tmp_t;
4469         ')
4470
4471         allow $1 user_tmp_t:file { getattr append };
4472 ')
4473
4474 ######################################
4475 ## <summary>
4476 ##      Read audio files in the users homedir.
4477 ## </summary>
4478 ## <param name="domain">
4479 ##      <summary>
4480 ##      Domain allowed access.
4481 ##      </summary>
4482 ## </param>
4483 ## <rolecap/>
4484 #
4485 interface(`userdom_read_home_audio_files',`
4486         gen_require(`
4487                 type audio_home_t;
4488         ')
4489
4490         userdom_search_user_home_dirs($1)
4491         allow $1 audio_home_t:dir list_dir_perms;
4492         read_files_pattern($1, audio_home_t, audio_home_t)
4493         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4494 ')
4495
4496 ########################################
4497 ## <summary>
4498 ##      Do not audit attempts to write all user home content files.
4499 ## </summary>
4500 ## <param name="domain">
4501 ##      <summary>
4502 ##      Domain to not audit.
4503 ##      </summary>
4504 ## </param>
4505 #
4506 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4507         gen_require(`
4508                 attribute user_home_type;
4509         ')
4510
4511         dontaudit $1 user_home_type:file write_file_perms;
4512 ')
4513
4514 ########################################
4515 ## <summary>
4516 ##      Do not audit attempts to write all user tmp content files.
4517 ## </summary>
4518 ## <param name="domain">
4519 ##      <summary>
4520 ##      Domain to not audit.
4521 ##      </summary>
4522 ## </param>
4523 #
4524 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4525         gen_require(`
4526                 attribute user_tmp_type;
4527         ')
4528
4529         dontaudit $1 user_tmp_type:file write_file_perms;
4530 ')
4531
4532 ########################################
4533 ## <summary>
4534 ##      Manage all user temporary content.
4535 ## </summary>
4536 ## <param name="domain">
4537 ##      <summary>
4538 ##      Domain allowed access.
4539 ##      </summary>
4540 ## </param>
4541 #
4542 interface(`userdom_manage_all_user_tmp_content',`
4543         gen_require(`
4544                 attribute user_tmp_type;
4545         ')
4546
4547         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4548         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4549         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4550         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4551         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4552         files_search_tmp($1)
4553 ')
4554
4555 ########################################
4556 ## <summary>
4557 ##      List all user temporary content.
4558 ## </summary>
4559 ## <param name="domain">
4560 ##      <summary>
4561 ##      Domain allowed access.
4562 ##      </summary>
4563 ## </param>
4564 #
4565 interface(`userdom_list_all_user_tmp_content',`
4566         gen_require(`
4567                 attribute user_tmp_type;
4568         ')
4569
4570         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4571         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4572         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4573         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4574         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4575         files_search_var($1)
4576         files_search_tmp($1)
4577 ')
4578
4579 ########################################
4580 ## <summary>
4581 ##      Manage all user tmpfs content.
4582 ## </summary>
4583 ## <param name="domain">
4584 ##      <summary>
4585 ##      Domain allowed access.
4586 ##      </summary>
4587 ## </param>
4588 #
4589 interface(`userdom_manage_all_user_tmpfs_content',`
4590         gen_require(`
4591                 attribute user_tmpfs_type;
4592         ')
4593
4594         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4595         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4596         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4597         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4598         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4599         fs_search_tmpfs($1)
4600 ')
4601
4602 ########################################
4603 ## <summary>
4604 ##      Delete all user temporary content.
4605 ## </summary>
4606 ## <param name="domain">
4607 ##      <summary>
4608 ##      Domain allowed access.
4609 ##      </summary>
4610 ## </param>
4611 #
4612 interface(`userdom_delete_all_user_tmp_content',`
4613         gen_require(`
4614                 attribute user_tmp_type;
4615         ')
4616
4617         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4618         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4619         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4620         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4621         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4622         # /var/tmp
4623         files_search_var($1)
4624         files_delete_tmp_dir_entry($1)
4625 ')
4626
4627 ########################################
4628 ## <summary>
4629 ##      Read system SSL certificates in the users homedir.
4630 ## </summary>
4631 ## <param name="domain">
4632 ##      <summary>
4633 ##      Domain allowed access.
4634 ##      </summary>
4635 ## </param>
4636 #
4637 interface(`userdom_read_home_certs',`
4638         gen_require(`
4639                 type home_cert_t;
4640         ')
4641
4642         userdom_search_user_home_content($1)
4643         allow $1 home_cert_t:dir list_dir_perms;
4644         read_files_pattern($1, home_cert_t, home_cert_t)
4645         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4646 ')
4647
4648 #######################################
4649 ## <summary>
4650 ##  Dontaudit Write system SSL certificates in the users homedir.
4651 ## </summary>
4652 ## <param name="domain">
4653 ##  <summary>
4654 ##      Domain to not audit.
4655 ##  </summary>
4656 ## </param>
4657 #
4658 interface(`userdom_dontaudit_write_home_certs',`
4659     gen_require(`
4660         type home_cert_t;
4661     ')
4662
4663     dontaudit $1 home_cert_t:file write;
4664 ')
4665
4666 ########################################
4667 ## <summary>
4668 ##      dontaudit Search getatrr /root files
4669 ## </summary>
4670 ## <param name="domain">
4671 ##      <summary>
4672 ##      Domain to not audit.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_dontaudit_getattr_admin_home_files',`
4677         gen_require(`
4678                 type admin_home_t;
4679         ')
4680
4681         dontaudit $1 admin_home_t:file getattr;
4682 ')
4683
4684 ########################################
4685 ## <summary>
4686 ##      dontaudit read /root lnk files
4687 ## </summary>
4688 ## <param name="domain">
4689 ##      <summary>
4690 ##      Domain to not audit.
4691 ##      </summary>
4692 ## </param>
4693 #
4694 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4695         gen_require(`
4696                 type admin_home_t;
4697         ')
4698
4699         dontaudit $1 admin_home_t:lnk_file read;
4700 ')
4701
4702 ########################################
4703 ## <summary>
4704 ##      dontaudit read /root files
4705 ## </summary>
4706 ## <param name="domain">
4707 ##      <summary>
4708 ##      Domain to not audit.
4709 ##      </summary>
4710 ## </param>
4711 #
4712 interface(`userdom_dontaudit_read_admin_home_files',`
4713         gen_require(`
4714                 type admin_home_t;
4715         ')
4716
4717         dontaudit $1 admin_home_t:file read_file_perms;
4718 ')
4719
4720 ########################################
4721 ## <summary>
4722 ##      Create, read, write, and delete user
4723 ##      temporary chr files.
4724 ## </summary>
4725 ## <param name="domain">
4726 ##      <summary>
4727 ##      Domain allowed access.
4728 ##      </summary>
4729 ## </param>
4730 #
4731 interface(`userdom_manage_user_tmp_chr_files',`
4732         gen_require(`
4733                 type user_tmp_t;
4734         ')
4735
4736         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4737         files_search_tmp($1)
4738 ')
4739
4740 ########################################
4741 ## <summary>
4742 ##      Create, read, write, and delete user
4743 ##      temporary blk files.
4744 ## </summary>
4745 ## <param name="domain">
4746 ##      <summary>
4747 ##      Domain allowed access.
4748 ##      </summary>
4749 ## </param>
4750 #
4751 interface(`userdom_manage_user_tmp_blk_files',`
4752         gen_require(`
4753                 type user_tmp_t;
4754         ')
4755
4756         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4757         files_search_tmp($1)
4758 ')
4759
4760 ########################################
4761 ## <summary>
4762 ##      Dontaudit attempt to set attributes on  user temporary directories.
4763 ## </summary>
4764 ## <param name="domain">
4765 ##      <summary>
4766 ##      Domain to not audit.
4767 ##      </summary>
4768 ## </param>
4769 #
4770 interface(`userdom_dontaudit_setattr_user_tmp',`
4771         gen_require(`
4772                 type user_tmp_t;
4773         ')
4774
4775         dontaudit $1 user_tmp_t:dir setattr;
4776 ')
4777
4778 ########################################
4779 ## <summary>
4780 ##      Read all inherited users files in /tmp
4781 ## </summary>
4782 ## <param name="domain">
4783 ##      <summary>
4784 ##      Domain allowed access.
4785 ##      </summary>
4786 ## </param>
4787 #
4788 interface(`userdom_read_inherited_user_tmp_files',`
4789         gen_require(`
4790                 type user_tmp_t;
4791         ')
4792
4793         allow $1 user_tmp_t:file read_inherited_file_perms;
4794 ')
4795
4796 ########################################
4797 ## <summary>
4798 ##      Write all inherited users files in /tmp
4799 ## </summary>
4800 ## <param name="domain">
4801 ##      <summary>
4802 ##      Domain allowed access.
4803 ##      </summary>
4804 ## </param>
4805 #
4806 interface(`userdom_write_inherited_user_tmp_files',`
4807         gen_require(`
4808                 type user_tmp_t;
4809         ')
4810
4811         allow $1 user_tmp_t:file write;
4812 ')
4813
4814 ########################################
4815 ## <summary>
4816 ##      Delete all users files in /tmp
4817 ## </summary>
4818 ## <param name="domain">
4819 ##      <summary>
4820 ##      Domain allowed access.
4821 ##      </summary>
4822 ## </param>
4823 #
4824 interface(`userdom_delete_user_tmp_files',`
4825         gen_require(`
4826                 type user_tmp_t;
4827         ')
4828
4829         allow $1 user_tmp_t:file delete_file_perms;
4830 ')
4831
4832 ########################################
4833 ## <summary>
4834 ##      Delete user tmpfs files.
4835 ## </summary>
4836 ## <param name="domain">
4837 ##      <summary>
4838 ##      Domain allowed access.
4839 ##      </summary>
4840 ## </param>
4841 #
4842 interface(`userdom_delete_user_tmpfs_files',`
4843         gen_require(`
4844                 type user_tmpfs_t;
4845         ')
4846
4847         allow $1 user_tmpfs_t:file delete_file_perms;
4848 ')
4849
4850 ########################################
4851 ## <summary>
4852 ##      Read/Write unpriviledged user SysV shared
4853 ##      memory segments.
4854 ## </summary>
4855 ## <param name="domain">
4856 ##      <summary>
4857 ##      Domain allowed access.
4858 ##      </summary>
4859 ## </param>
4860 #
4861 interface(`userdom_rw_unpriv_user_shared_mem',`
4862         gen_require(`
4863                 attribute unpriv_userdomain;
4864         ')
4865
4866         allow $1 unpriv_userdomain:shm rw_shm_perms;
4867 ')
4868
4869 ########################################
4870 ## <summary>
4871 ##      Do not audit attempts to search user
4872 ##      temporary directories.
4873 ## </summary>
4874 ## <param name="domain">
4875 ##      <summary>
4876 ##      Domain to not audit.
4877 ##      </summary>
4878 ## </param>
4879 #
4880 interface(`userdom_dontaudit_search_user_tmp',`
4881         gen_require(`
4882                 type user_tmp_t;
4883         ')
4884
4885         dontaudit $1 user_tmp_t:dir search_dir_perms;
4886 ')
4887
4888 ########################################
4889 ## <summary>
4890 ##      Execute a file in a user home directory
4891 ##      in the specified domain.
4892 ## </summary>
4893 ## <desc>
4894 ##      <p>
4895 ##      Execute a file in a user home directory
4896 ##      in the specified domain.
4897 ##      </p>
4898 ##      <p>
4899 ##      No interprocess communication (signals, pipes,
4900 ##      etc.) is provided by this interface since
4901 ##      the domains are not owned by this module.
4902 ##      </p>
4903 ## </desc>
4904 ## <param name="domain">
4905 ##      <summary>
4906 ##      Domain allowed access.
4907 ##      </summary>
4908 ## </param>
4909 ## <param name="target_domain">
4910 ##      <summary>
4911 ##      The type of the new process.
4912 ##      </summary>
4913 ## </param>
4914 #
4915 interface(`userdom_domtrans_user_home',`
4916         gen_require(`
4917                 type user_home_t;
4918         ')
4919
4920         read_lnk_files_pattern($1, user_home_t, user_home_t)
4921         domain_transition_pattern($1, user_home_t, $2)
4922         type_transition $1 user_home_t:process $2;
4923 ')
4924
4925 ########################################
4926 ## <summary>
4927 ##      Execute a file in a user tmp directory
4928 ##      in the specified domain.
4929 ## </summary>
4930 ## <desc>
4931 ##      <p>
4932 ##      Execute a file in a user tmp directory
4933 ##      in the specified domain.
4934 ##      </p>
4935 ##      <p>
4936 ##      No interprocess communication (signals, pipes,
4937 ##      etc.) is provided by this interface since
4938 ##      the domains are not owned by this module.
4939 ##      </p>
4940 ## </desc>
4941 ## <param name="domain">
4942 ##      <summary>
4943 ##      Domain allowed access.
4944 ##      </summary>
4945 ## </param>
4946 ## <param name="target_domain">
4947 ##      <summary>
4948 ##      The type of the new process.
4949 ##      </summary>
4950 ## </param>
4951 #
4952 interface(`userdom_domtrans_user_tmp',`
4953         gen_require(`
4954                 type user_tmp_t;
4955         ')
4956
4957         files_search_tmp($1)
4958         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4959         domain_transition_pattern($1, user_tmp_t, $2)
4960         type_transition $1 user_tmp_t:process $2;
4961 ')
4962
4963 ########################################
4964 ## <summary>
4965 ##      Do not audit attempts to read all user home content files.
4966 ## </summary>
4967 ## <param name="domain">
4968 ##      <summary>
4969 ##      Domain to not audit.
4970 ##      </summary>
4971 ## </param>
4972 #
4973 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4974         gen_require(`
4975                 attribute user_home_type;
4976         ')
4977
4978         dontaudit $1 user_home_type:file read_file_perms;
4979 ')
4980
4981 ########################################
4982 ## <summary>
4983 ##      Do not audit attempts to read all user tmp content files.
4984 ## </summary>
4985 ## <param name="domain">
4986 ##      <summary>
4987 ##      Domain to not audit.
4988 ##      </summary>
4989 ## </param>
4990 #
4991 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4992         gen_require(`
4993                 attribute user_tmp_type;
4994         ')
4995
4996         dontaudit $1 user_tmp_type:file read_file_perms;
4997 ')
4998
4999 #######################################
5000 ## <summary>
5001 ## Read and write unpriviledged user SysV sempaphores.
5002 ## </summary>
5003 ## <param name="domain">
5004 ## <summary>
5005 ## Domain allowed access.
5006 ## </summary>
5007 ## </param>
5008 #
5009 interface(`userdom_rw_unpriv_user_semaphores',`
5010    gen_require(`
5011        attribute unpriv_userdomain;
5012    ')
5013
5014    allow $1 unpriv_userdomain:sem rw_sem_perms;
5015 ')