policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 attribute user_tmp_type;
 321                 type user_tmp_t;
 322         ')
 323
 324         role $1 types user_tmp_t;
 325
 326         files_poly_member_tmp($2, user_tmp_t)
 327
 328         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 329         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 330         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 331         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 332         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 333         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 334         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 335         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 336         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 337         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 338         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 339 ')
 340
 341 #######################################
 342 ## <summary>
 343 ##      Dontaudit search of user bin dirs.
 344 ## </summary>
 345 ## <param name="domain">
 346 ##      <summary>
 347 ##      Domain to not audit.
 348 ##      </summary>
 349 ## </param>
 350 #
 351 interface(`userdom_dontaudit_search_user_bin_dirs',`
 352         gen_require(`
 353                 type home_bin_t;
 354         ')
 355
 356         dontaudit $1 home_bin_t:dir search_dir_perms;
 357 ')
 358
 359 #######################################
 360 ## <summary>
 361 ##      Execute user bin files.
 362 ## </summary>
 363 ## <param name="domain">
 364 ##      <summary>
 365 ##      Domain allowed access.
 366 ##      </summary>
 367 ## </param>
 368 #
 369 interface(`userdom_exec_user_bin_files',`
 370         gen_require(`
 371                 attribute user_home_type;
 372                 type home_bin_t, user_home_dir_t;
 373         ')
 374
 375         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 376         files_search_home($1)
 377 ')
 378
 379 #######################################
 380 ## <summary>
 381 ##      The execute access user temporary files.
 382 ## </summary>
 383 ## <param name="domain">
 384 ##      <summary>
 385 ##      Domain allowed access.
 386 ##      </summary>
 387 ## </param>
 388 ## <rolebase/>
 389 #
 390 interface(`userdom_exec_user_tmp_files',`
 391         gen_require(`
 392                 type user_tmp_t;
 393         ')
 394
 395         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 396         dontaudit $1 user_tmp_t:sock_file execute;
 397         files_search_tmp($1)
 398 ')
 399
 400 #######################################
 401 ## <summary>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ## </summary>
 405 ## <desc>
 406 ##      <p>
 407 ##      Role access for the user tmpfs type
 408 ##      that the user has full access.
 409 ##      </p>
 410 ##      <p>
 411 ##      This does not allow execute access.
 412 ##      </p>
 413 ## </desc>
 414 ## <param name="role">
 415 ##      <summary>
 416 ##      Role allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <param name="domain">
 420 ##      <summary>
 421 ##      Domain allowed access.
 422 ##      </summary>
 423 ## </param>
 424 ## <rolecap/>
 425 #
 426 interface(`userdom_manage_tmpfs_role',`
 427         gen_require(`
 428                 attribute user_tmpfs_type;
 429                 type user_tmpfs_t;
 430         ')
 431
 432         role $1 types user_tmpfs_t;
 433
 434         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 435         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 436         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 437         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 438         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 439         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 440         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 441         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445 ')
 446
 447 #######################################
 448 ## <summary>
 449 ##      The interface allowing the user basic
 450 ##      network permissions
 451 ## </summary>
 452 ## <param name="userdomain">
 453 ##      <summary>
 454 ##      The user domain
 455 ##      </summary>
 456 ## </param>
 457 ## <rolebase/>
 458 #
 459 interface(`userdom_basic_networking',`
 460
 461         allow $1 self:tcp_socket create_stream_socket_perms;
 462         allow $1 self:udp_socket create_socket_perms;
 463
 464         corenet_all_recvfrom_unlabeled($1)
 465         corenet_all_recvfrom_netlabel($1)
 466         corenet_tcp_sendrecv_generic_if($1)
 467         corenet_udp_sendrecv_generic_if($1)
 468         corenet_tcp_sendrecv_generic_node($1)
 469         corenet_udp_sendrecv_generic_node($1)
 470         corenet_tcp_sendrecv_all_ports($1)
 471         corenet_udp_sendrecv_all_ports($1)
 472         corenet_tcp_connect_all_ports($1)
 473         corenet_sendrecv_all_client_packets($1)
 474
 475         optional_policy(`
 476                 init_tcp_recvfrom_all_daemons($1)
 477                 init_udp_recvfrom_all_daemons($1)
 478         ')
 479
 480         optional_policy(`
 481                 ipsec_match_default_spd($1)
 482         ')
 483
 484 ')
 485
 486 #######################################
 487 ## <summary>
 488 ##      The template for creating a user xwindows client.  (Deprecated)
 489 ## </summary>
 490 ## <param name="userdomain_prefix">
 491 ##      <summary>
 492 ##      The prefix of the user domain (e.g., user
 493 ##      is the prefix for user_t).
 494 ##      </summary>
 495 ## </param>
 496 ## <rolebase/>
 497 #
 498 template(`userdom_xwindows_client_template',`
 499         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 500         gen_require(`
 501                 type $1_t, user_tmpfs_t;
 502         ')
 503
 504         dev_rw_xserver_misc($1_t)
 505         dev_rw_power_management($1_t)
 506         dev_read_input($1_t)
 507         dev_read_misc($1_t)
 508         dev_write_misc($1_t)
 509         # open office is looking for the following
 510         dev_getattr_agp_dev($1_t)
 511         dev_dontaudit_rw_dri($1_t)
 512         # GNOME checks for usb and other devices:
 513         dev_rw_usbfs($1_t)
 514         dev_rw_generic_usb_dev($1_t)
 515
 516         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 517         xserver_xsession_entry_type($1_t)
 518         xserver_dontaudit_write_log($1_t)
 519         xserver_stream_connect_xdm($1_t)
 520         # certain apps want to read xdm.pid file
 521         xserver_read_xdm_pid($1_t)
 522         # gnome-session creates socket under /tmp/.ICE-unix/
 523         xserver_create_xdm_tmp_sockets($1_t)
 524         # Needed for escd, remove if we get escd policy
 525         xserver_manage_xdm_tmp_files($1_t)
 526 ')
 527
 528 #######################################
 529 ## <summary>
 530 ##      The template for allowing the user to change passwords.
 531 ## </summary>
 532 ## <param name="userdomain_prefix">
 533 ##      <summary>
 534 ##      The prefix of the user domain (e.g., user
 535 ##      is the prefix for user_t).
 536 ##      </summary>
 537 ## </param>
 538 ## <rolebase/>
 539 #
 540 template(`userdom_change_password_template',`
 541         gen_require(`
 542                 type $1_t;
 543                 role $1_r;
 544         ')
 545
 546         optional_policy(`
 547                 usermanage_run_chfn($1_t,$1_r)
 548                 usermanage_run_passwd($1_t,$1_r)
 549         ')
 550 ')
 551
 552 #######################################
 553 ## <summary>
 554 ##      The template containing rules common to unprivileged
 555 ##      users and administrative users.
 556 ## </summary>
 557 ## <desc>
 558 ##      <p>
 559 ##      This template creates a user domain, types, and
 560 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 561 ##      </p>
 562 ## </desc>
 563 ## <param name="userdomain_prefix">
 564 ##      <summary>
 565 ##      The prefix of the user domain (e.g., user
 566 ##      is the prefix for user_t).
 567 ##      </summary>
 568 ## </param>
 569 #
 570 template(`userdom_common_user_template',`
 571         gen_require(`
 572                 attribute unpriv_userdomain;
 573         ')
 574
 575         userdom_basic_networking($1_usertype)
 576
 577         ##############################
 578         #
 579         # User domain Local policy
 580         #
 581
 582         # evolution and gnome-session try to create a netlink socket
 583         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 584         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 585         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 586         allow $1_t self:socket create_socket_perms;
 587
 588         allow $1_usertype unpriv_userdomain:fd use;
 589
 590         kernel_read_system_state($1_usertype)
 591         kernel_read_network_state($1_usertype)
 592         kernel_read_software_raid_state($1_usertype)
 593         kernel_read_net_sysctls($1_usertype)
 594         # Very permissive allowing every domain to see every type:
 595         kernel_get_sysvipc_info($1_usertype)
 596         # Find CDROM devices:
 597         kernel_read_device_sysctls($1_usertype)
 598         kernel_request_load_module($1_usertype)
 599
 600         corenet_udp_bind_generic_node($1_usertype)
 601         corenet_udp_bind_generic_port($1_usertype)
 602
 603         dev_read_rand($1_usertype)
 604         dev_write_sound($1_usertype)
 605         dev_read_sound($1_usertype)
 606         dev_read_sound_mixer($1_usertype)
 607         dev_write_sound_mixer($1_usertype)
 608
 609         files_exec_etc_files($1_usertype)
 610         files_search_locks($1_usertype)
 611         # Check to see if cdrom is mounted
 612         files_search_mnt($1_usertype)
 613         # cjp: perhaps should cut back on file reads:
 614         files_read_var_files($1_usertype)
 615         files_read_var_symlinks($1_usertype)
 616         files_read_generic_spool($1_usertype)
 617         files_read_var_lib_files($1_usertype)
 618         # Stat lost+found.
 619         files_getattr_lost_found_dirs($1_usertype)
 620         files_read_config_files($1_usertype)
 621         fs_read_noxattr_fs_files($1_usertype)
 622         fs_read_noxattr_fs_symlinks($1_usertype)
 623         fs_rw_cgroup_files($1_usertype)
 624
 625         application_getattr_socket($1_usertype)
 626
 627         logging_send_syslog_msg($1_usertype)
 628         logging_send_audit_msgs($1_usertype)
 629         selinux_get_enforce_mode($1_usertype)
 630
 631         # cjp: some of this probably can be removed
 632         selinux_get_fs_mount($1_usertype)
 633         selinux_validate_context($1_usertype)
 634         selinux_compute_access_vector($1_usertype)
 635         selinux_compute_create_context($1_usertype)
 636         selinux_compute_relabel_context($1_usertype)
 637         selinux_compute_user_contexts($1_usertype)
 638
 639         # for eject
 640         storage_getattr_fixed_disk_dev($1_usertype)
 641
 642         auth_read_login_records($1_usertype)
 643         auth_run_pam($1_t,$1_r)
 644         auth_run_utempter($1_t,$1_r)
 645
 646         init_read_utmp($1_usertype)
 647
 648         seutil_read_file_contexts($1_usertype)
 649         seutil_read_default_contexts($1_usertype)
 650         seutil_run_newrole($1_t,$1_r)
 651         seutil_exec_checkpolicy($1_t)
 652         seutil_exec_setfiles($1_usertype)
 653         # for when the network connection is killed
 654         # this is needed when a login role can change
 655         # to this one.
 656         seutil_dontaudit_signal_newrole($1_t)
 657
 658         tunable_policy(`user_direct_mouse',`
 659                 dev_read_mouse($1_usertype)
 660         ')
 661
 662         tunable_policy(`user_ttyfile_stat',`
 663                 term_getattr_all_ttys($1_t)
 664         ')
 665
 666         optional_policy(`
 667                 alsa_read_rw_config($1_usertype)
 668                 alsa_manage_home_files($1_t)
 669                 alsa_relabel_home_files($1_t)
 670         ')
 671
 672         optional_policy(`
 673                 # Allow graphical boot to check battery lifespan
 674                 apm_stream_connect($1_usertype)
 675         ')
 676
 677         optional_policy(`
 678                 canna_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 chrome_role($1_r, $1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 colord_read_lib_files($1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 dbus_system_bus_client($1_usertype)
 691
 692                 allow $1_usertype $1_usertype:dbus  send_msg;
 693
 694                 optional_policy(`
 695                         avahi_dbus_chat($1_usertype)
 696                 ')
 697
 698                 optional_policy(`
 699                         policykit_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         bluetooth_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         consolekit_dbus_chat($1_usertype)
 708                         consolekit_read_log($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         devicekit_dbus_chat($1_usertype)
 713                         devicekit_dbus_chat_power($1_usertype)
 714                         devicekit_dbus_chat_disk($1_usertype)
 715                 ')
 716
 717                 optional_policy(`
 718                         evolution_dbus_chat($1_usertype)
 719                         evolution_alarm_dbus_chat($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 nsplugin_role($1_r, $1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 tunable_policy(`allow_user_mysql_connect',`
 788                         mysql_stream_connect($1_t)
 789                 ')
 790         ')
 791
 792         optional_policy(`
 793                 oident_manage_user_content($1_t)
 794                 oident_relabel_user_content($1_t)
 795         ')
 796
 797         optional_policy(`
 798                 # to allow monitoring of pcmcia status
 799                 pcmcia_read_pid($1_usertype)
 800         ')
 801
 802         optional_policy(`
 803                 pcscd_read_pub_files($1_usertype)
 804                 pcscd_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 tunable_policy(`allow_user_postgresql_connect',`
 809                         postgresql_stream_connect($1_usertype)
 810                         postgresql_tcp_connect($1_usertype)
 811                 ')
 812         ')
 813
 814         optional_policy(`
 815                 resmgr_stream_connect($1_usertype)
 816         ')
 817
 818         optional_policy(`
 819                 rpc_dontaudit_getattr_exports($1_usertype)
 820                 rpc_manage_nfs_rw_content($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 rpcbind_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 samba_stream_connect_winbind($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 sandbox_transition($1_usertype, $1_r)
 833         ')
 834
 835         optional_policy(`
 836                 seunshare_role_template($1, $1_r, $1_t)
 837         ')
 838
 839         optional_policy(`
 840                 slrnpull_search_spool($1_usertype)
 841         ')
 842
 843 ')
 844
 845 #######################################
 846 ## <summary>
 847 ##      The template for creating a login user.
 848 ## </summary>
 849 ## <desc>
 850 ##      <p>
 851 ##      This template creates a user domain, types, and
 852 ##      rules for the user's tty, pty, home directories,
 853 ##      tmp, and tmpfs files.
 854 ##      </p>
 855 ## </desc>
 856 ## <param name="userdomain_prefix">
 857 ##      <summary>
 858 ##      The prefix of the user domain (e.g., user
 859 ##      is the prefix for user_t).
 860 ##      </summary>
 861 ## </param>
 862 #
 863 template(`userdom_login_user_template', `
 864         gen_require(`
 865                 class context contains;
 866         ')
 867
 868         userdom_base_user_template($1)
 869
 870         userdom_manage_home_role($1_r, $1_usertype)
 871
 872         userdom_manage_tmp_role($1_r, $1_usertype)
 873         userdom_manage_tmpfs_role($1_r, $1_usertype)
 874
 875         ifelse(`$1',`unconfined',`',`
 876                 gen_tunable(allow_$1_exec_content, true)
 877
 878                 tunable_policy(`allow_$1_exec_content',`
 879                         userdom_exec_user_tmp_files($1_usertype)
 880                         userdom_exec_user_home_content_files($1_usertype)
 881                 ')
 882                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 883                         fs_exec_nfs_files($1_usertype)
 884                 ')
 885
 886                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 887                         fs_exec_cifs_files($1_usertype)
 888                 ')
 889         ')
 890
 891         userdom_change_password_template($1)
 892
 893         ##############################
 894         #
 895         # User domain Local policy
 896         #
 897
 898         allow $1_t self:capability { setgid chown fowner };
 899         dontaudit $1_t self:capability { sys_nice fsetid };
 900
 901         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 902         dontaudit $1_t self:process setrlimit;
 903         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 904
 905         allow $1_t self:context contains;
 906
 907         kernel_dontaudit_read_system_state($1_usertype)
 908         kernel_dontaudit_list_all_proc($1_usertype)
 909
 910         dev_read_sysfs($1_usertype)
 911         dev_read_urand($1_usertype)
 912
 913         domain_use_interactive_fds($1_usertype)
 914         # Command completion can fire hundreds of denials
 915         domain_dontaudit_exec_all_entry_files($1_usertype)
 916
 917         files_dontaudit_list_default($1_usertype)
 918         files_dontaudit_read_default_files($1_usertype)
 919         # Stat lost+found.
 920         files_getattr_lost_found_dirs($1_usertype)
 921
 922         fs_get_all_fs_quotas($1_usertype)
 923         fs_getattr_all_fs($1_usertype)
 924         fs_search_all($1_usertype)
 925         fs_list_inotifyfs($1_usertype)
 926         fs_rw_anon_inodefs_files($1_usertype)
 927
 928         auth_dontaudit_write_login_records($1_t)
 929         auth_rw_cache($1_t)
 930
 931         # Stop warnings about access to /dev/console
 932         init_dontaudit_use_fds($1_usertype)
 933         init_dontaudit_use_script_fds($1_usertype)
 934
 935         libs_exec_lib_files($1_usertype)
 936
 937         logging_dontaudit_getattr_all_logs($1_usertype)
 938
 939         # for running TeX programs
 940         miscfiles_read_tetex_data($1_usertype)
 941         miscfiles_exec_tetex_data($1_usertype)
 942
 943         seutil_read_config($1_usertype)
 944
 945         optional_policy(`
 946                 cups_read_config($1_usertype)
 947                 cups_stream_connect($1_usertype)
 948                 cups_stream_connect_ptal($1_usertype)
 949         ')
 950
 951         optional_policy(`
 952                 kerberos_use($1_usertype)
 953                 kerberos_filetrans_home_content($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 mta_dontaudit_read_spool_symlinks($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 quota_dontaudit_getattr_db($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 rpm_read_db($1_usertype)
 966                 rpm_dontaudit_manage_db($1_usertype)
 967                 rpm_read_cache($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 oddjob_run_mkhomedir($1_t, $1_r)
 972         ')
 973 ')
 974
 975 #######################################
 976 ## <summary>
 977 ##      The template for creating a unprivileged login user.
 978 ## </summary>
 979 ## <desc>
 980 ##      <p>
 981 ##      This template creates a user domain, types, and
 982 ##      rules for the user's tty, pty, home directories,
 983 ##      tmp, and tmpfs files.
 984 ##      </p>
 985 ## </desc>
 986 ## <param name="userdomain_prefix">
 987 ##      <summary>
 988 ##      The prefix of the user domain (e.g., user
 989 ##      is the prefix for user_t).
 990 ##      </summary>
 991 ## </param>
 992 #
 993 template(`userdom_restricted_user_template',`
 994         gen_require(`
 995                 attribute unpriv_userdomain;
 996         ')
 997
 998         userdom_login_user_template($1)
 999
1000         typeattribute $1_t unpriv_userdomain;
1001         domain_interactive_fd($1_t)
1002
1003         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1004         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1005
1006         ##############################
1007         #
1008         # Local policy
1009         #
1010
1011         optional_policy(`
1012                 loadkeys_run($1_t,$1_r)
1013         ')
1014 ')
1015
1016 #######################################
1017 ## <summary>
1018 ##      The template for creating a unprivileged xwindows login user.
1019 ## </summary>
1020 ## <desc>
1021 ##      <p>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ##      </p>
1024 ##      <p>
1025 ##      This template creates a user domain, types, and
1026 ##      rules for the user's tty, pty, home directories,
1027 ##      tmp, and tmpfs files.
1028 ##      </p>
1029 ## </desc>
1030 ## <param name="userdomain_prefix">
1031 ##      <summary>
1032 ##      The prefix of the user domain (e.g., user
1033 ##      is the prefix for user_t).
1034 ##      </summary>
1035 ## </param>
1036 #
1037 template(`userdom_restricted_xwindows_user_template',`
1038
1039         userdom_restricted_user_template($1)
1040
1041         ##############################
1042         #
1043         # Local policy
1044         #
1045
1046         auth_role($1_r, $1_t)
1047         auth_search_pam_console_data($1_usertype)
1048         auth_dontaudit_read_login_records($1_usertype)
1049
1050         dev_read_sound($1_usertype)
1051         dev_write_sound($1_usertype)
1052         # gnome keyring wants to read this.
1053         dev_dontaudit_read_rand($1_usertype)
1054         # temporarily allow since openoffice requires this
1055         dev_read_rand($1_usertype)
1056
1057         dev_read_video_dev($1_usertype)
1058         dev_write_video_dev($1_usertype)
1059         dev_rw_wireless($1_usertype)
1060
1061         libs_dontaudit_setattr_lib_files($1_usertype)
1062
1063         tunable_policy(`user_rw_noexattrfile',`
1064                 dev_rw_usbfs($1_t)
1065                 dev_rw_generic_usb_dev($1_usertype)
1066
1067                 fs_manage_noxattr_fs_files($1_usertype)
1068                 fs_manage_noxattr_fs_dirs($1_usertype)
1069                 fs_manage_dos_dirs($1_usertype)
1070                 fs_manage_dos_files($1_usertype)
1071                 storage_raw_read_removable_device($1_usertype)
1072                 storage_raw_write_removable_device($1_usertype)
1073         ')
1074
1075         logging_send_syslog_msg($1_usertype)
1076         logging_dontaudit_send_audit_msgs($1_t)
1077
1078         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1079         logging_send_audit_msgs($1_t)
1080         selinux_get_enforce_mode($1_t)
1081         seutil_exec_restorecond($1_t)
1082         seutil_read_file_contexts($1_t)
1083         seutil_read_default_contexts($1_t)
1084
1085         xserver_restricted_role($1_r, $1_t)
1086
1087         optional_policy(`
1088                 alsa_read_rw_config($1_usertype)
1089         ')
1090
1091          # cjp: needed by KDE apps
1092          # bug: #682499
1093          optional_policy(`
1094                 gnome_read_usr_config($1_usertype)
1095                 gnome_role_gkeyringd($1, $1_r, $1_t)
1096                 # cjp: telepathy F15 bugs
1097                 telepathy_dbus_session_role($1_r, $1_t, $1)
1098         ')
1099
1100         optional_policy(`
1101                 dbus_role_template($1, $1_r, $1_usertype)
1102                 dbus_system_bus_client($1_usertype)
1103                 allow $1_usertype $1_usertype:dbus send_msg;
1104
1105                 optional_policy(`
1106                         abrt_dbus_chat($1_usertype)
1107                         abrt_run_helper($1_usertype, $1_r)
1108                 ')
1109
1110                 optional_policy(`
1111                         consolekit_dontaudit_read_log($1_usertype)
1112                         consolekit_dbus_chat($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         cups_dbus_chat($1_usertype)
1117                         cups_dbus_chat_config($1_usertype)
1118                 ')
1119
1120                 optional_policy(`
1121                         devicekit_dbus_chat($1_usertype)
1122                         devicekit_dbus_chat_disk($1_usertype)
1123                         devicekit_dbus_chat_power($1_usertype)
1124                 ')
1125
1126                 optional_policy(`
1127                         fprintd_dbus_chat($1_t)
1128                 ')
1129         ')
1130
1131         optional_policy(`
1132                 openoffice_role_template($1, $1_r, $1_usertype)
1133         ')
1134
1135         optional_policy(`
1136                 policykit_role($1_r, $1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 pulseaudio_role($1_r, $1_usertype)
1141         ')
1142
1143         optional_policy(`
1144                 rtkit_scheduled($1_usertype)
1145         ')
1146
1147         optional_policy(`
1148                 setroubleshoot_dontaudit_stream_connect($1_t)
1149         ')
1150
1151         optional_policy(`
1152                 udev_read_db($1_usertype)
1153         ')
1154
1155         optional_policy(`
1156                 wm_role_template($1, $1_r, $1_t)
1157         ')
1158 ')
1159
1160 #######################################
1161 ## <summary>
1162 ##      The template for creating a unprivileged user roughly
1163 ##      equivalent to a regular linux user.
1164 ## </summary>
1165 ## <desc>
1166 ##      <p>
1167 ##      The template for creating a unprivileged user roughly
1168 ##      equivalent to a regular linux user.
1169 ##      </p>
1170 ##      <p>
1171 ##      This template creates a user domain, types, and
1172 ##      rules for the user's tty, pty, home directories,
1173 ##      tmp, and tmpfs files.
1174 ##      </p>
1175 ## </desc>
1176 ## <param name="userdomain_prefix">
1177 ##      <summary>
1178 ##      The prefix of the user domain (e.g., user
1179 ##      is the prefix for user_t).
1180 ##      </summary>
1181 ## </param>
1182 #
1183 template(`userdom_unpriv_user_template', `
1184
1185         ##############################
1186         #
1187         # Declarations
1188         #
1189
1190         # Inherit rules for ordinary users.
1191         userdom_restricted_xwindows_user_template($1)
1192         userdom_common_user_template($1)
1193
1194         ##############################
1195         #
1196         # Local policy
1197         #
1198
1199         # port access is audited even if dac would not have allowed it, so dontaudit it here
1200 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1201         # Need the following rule to allow users to run vpnc
1202         corenet_tcp_bind_xserver_port($1_t)
1203         corenet_tcp_bind_generic_node($1_usertype)
1204
1205         storage_rw_fuse($1_t)
1206
1207         miscfiles_read_hwdata($1_usertype)
1208
1209         # Allow users to run TCP servers (bind to ports and accept connection from
1210         # the same domain and outside users) disabling this forces FTP passive mode
1211         # and may change other protocols
1212
1213         tunable_policy(`user_share_music',`
1214                 corenet_tcp_bind_daap_port($1_usertype)
1215         ')
1216
1217         tunable_policy(`user_tcp_server',`
1218                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1219         ')
1220
1221         tunable_policy(`user_setrlimit',`
1222                 allow $1_usertype self:process setrlimit;
1223         ')
1224
1225         optional_policy(`
1226                 cdrecord_role($1_r, $1_t)
1227         ')
1228
1229         optional_policy(`
1230                 cron_role($1_r, $1_t)
1231         ')
1232
1233         optional_policy(`
1234                 games_rw_data($1_usertype)
1235         ')
1236
1237         optional_policy(`
1238                 gpg_role($1_r, $1_usertype)
1239         ')
1240
1241         optional_policy(`
1242                 gnomeclock_dbus_chat($1_t)
1243         ')
1244
1245         optional_policy(`
1246                 gpm_stream_connect($1_usertype)
1247         ')
1248
1249         optional_policy(`
1250                 execmem_role_template($1, $1_r, $1_t)
1251         ')
1252
1253         optional_policy(`
1254                 java_role_template($1, $1_r, $1_t)
1255         ')
1256
1257         optional_policy(`
1258                 mono_role_template($1, $1_r, $1_t)
1259         ')
1260
1261         optional_policy(`
1262                 mount_run_fusermount($1_t, $1_r)
1263                 mount_read_pid_files($1_t)
1264         ')
1265
1266         optional_policy(`
1267                 wine_role_template($1, $1_r, $1_t)
1268         ')
1269
1270         optional_policy(`
1271                 postfix_run_postdrop($1_t, $1_r)
1272         ')
1273
1274         # Run pppd in pppd_t by default for user
1275         optional_policy(`
1276                 ppp_run_cond($1_t, $1_r)
1277         ')
1278 ')
1279
1280 #######################################
1281 ## <summary>
1282 ##      The template for creating an administrative user.
1283 ## </summary>
1284 ## <desc>
1285 ##      <p>
1286 ##      This template creates a user domain, types, and
1287 ##      rules for the user's tty, pty, home directories,
1288 ##      tmp, and tmpfs files.
1289 ##      </p>
1290 ##      <p>
1291 ##      The privileges given to administrative users are:
1292 ##      <ul>
1293 ##              <li>Raw disk access</li>
1294 ##              <li>Set all sysctls</li>
1295 ##              <li>All kernel ring buffer controls</li>
1296 ##              <li>Create, read, write, and delete all files but shadow</li>
1297 ##              <li>Manage source and binary format SELinux policy</li>
1298 ##              <li>Run insmod</li>
1299 ##      </ul>
1300 ##      </p>
1301 ## </desc>
1302 ## <param name="userdomain_prefix">
1303 ##      <summary>
1304 ##      The prefix of the user domain (e.g., sysadm
1305 ##      is the prefix for sysadm_t).
1306 ##      </summary>
1307 ## </param>
1308 #
1309 template(`userdom_admin_user_template',`
1310         gen_require(`
1311                 attribute admindomain;
1312                 class passwd { passwd chfn chsh rootok crontab };
1313         ')
1314
1315         ##############################
1316         #
1317         # Declarations
1318         #
1319
1320         # Inherit rules for ordinary users.
1321         userdom_login_user_template($1)
1322         userdom_common_user_template($1)
1323
1324         domain_obj_id_change_exemption($1_t)
1325         role system_r types $1_t;
1326
1327         typeattribute $1_t admindomain;
1328
1329         ifdef(`direct_sysadm_daemon',`
1330                 domain_system_change_exemption($1_t)
1331         ')
1332
1333         ##############################
1334         #
1335         # $1_t local policy
1336         #
1337
1338         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1339         allow $1_t self:capability2 syslog;
1340         allow $1_t self:process { setexec setfscreate };
1341         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1342         allow $1_t self:tun_socket create;
1343         # Set password information for other users.
1344         allow $1_t self:passwd { passwd chfn chsh };
1345         # Skip authentication when pam_rootok is specified.
1346         allow $1_t self:passwd rootok;
1347
1348         # Manipulate other users crontab.
1349         allow $1_t self:passwd crontab;
1350
1351         kernel_read_software_raid_state($1_t)
1352         kernel_getattr_core_if($1_t)
1353         kernel_getattr_message_if($1_t)
1354         kernel_change_ring_buffer_level($1_t)
1355         kernel_clear_ring_buffer($1_t)
1356         kernel_read_ring_buffer($1_t)
1357         kernel_get_sysvipc_info($1_t)
1358         kernel_rw_all_sysctls($1_t)
1359         # signal unlabeled processes:
1360         kernel_kill_unlabeled($1_t)
1361         kernel_signal_unlabeled($1_t)
1362         kernel_sigstop_unlabeled($1_t)
1363         kernel_signull_unlabeled($1_t)
1364         kernel_sigchld_unlabeled($1_t)
1365         kernel_signal($1_t)
1366
1367         corenet_tcp_bind_generic_port($1_t)
1368         # allow setting up tunnels
1369         corenet_rw_tun_tap_dev($1_t)
1370
1371         dev_getattr_generic_blk_files($1_t)
1372         dev_getattr_generic_chr_files($1_t)
1373         # for lsof
1374         dev_getattr_mtrr_dev($1_t)
1375         # Allow MAKEDEV to work
1376         dev_create_all_blk_files($1_t)
1377         dev_create_all_chr_files($1_t)
1378         dev_delete_all_blk_files($1_t)
1379         dev_delete_all_chr_files($1_t)
1380         dev_rename_all_blk_files($1_t)
1381         dev_rename_all_chr_files($1_t)
1382         dev_create_generic_symlinks($1_t)
1383         dev_rw_generic_usb_dev($1_t)
1384         dev_rw_usbfs($1_t)
1385
1386         domain_setpriority_all_domains($1_t)
1387         domain_read_all_domains_state($1_t)
1388         domain_getattr_all_domains($1_t)
1389         domain_getcap_all_domains($1_t)
1390         domain_dontaudit_ptrace_all_domains($1_t)
1391         # signal all domains:
1392         domain_kill_all_domains($1_t)
1393         domain_signal_all_domains($1_t)
1394         domain_signull_all_domains($1_t)
1395         domain_sigstop_all_domains($1_t)
1396         domain_sigstop_all_domains($1_t)
1397         domain_sigchld_all_domains($1_t)
1398         # for lsof
1399         domain_getattr_all_sockets($1_t)
1400         domain_dontaudit_getattr_all_sockets($1_t)
1401
1402         files_exec_usr_src_files($1_t)
1403
1404         fs_getattr_all_fs($1_t)
1405         fs_getattr_all_files($1_t)
1406         fs_list_all($1_t)
1407         fs_set_all_quotas($1_t)
1408         fs_exec_noxattr($1_t)
1409
1410         storage_raw_read_removable_device($1_t)
1411         storage_raw_write_removable_device($1_t)
1412         storage_dontaudit_read_fixed_disk($1_t)
1413
1414         term_use_all_inherited_terms($1_t)
1415         term_use_unallocated_ttys($1_t)
1416
1417         auth_getattr_shadow($1_t)
1418         # Manage almost all files
1419         auth_manage_all_files_except_shadow($1_t)
1420         # Relabel almost all files
1421         auth_relabel_all_files_except_shadow($1_t)
1422
1423         init_telinit($1_t)
1424
1425         logging_send_syslog_msg($1_t)
1426
1427         optional_policy(`
1428                 modutils_domtrans_insmod($1_t)
1429                 modutils_domtrans_depmod($1_t)
1430         ')
1431
1432         # The following rule is temporary until such time that a complete
1433         # policy management infrastructure is in place so that an administrator
1434         # cannot directly manipulate policy files with arbitrary programs.
1435         seutil_manage_src_policy($1_t)
1436         # Violates the goal of limiting write access to checkpolicy.
1437         # But presently necessary for installing the file_contexts file.
1438         seutil_manage_bin_policy($1_t)
1439
1440         userdom_manage_user_home_content_dirs($1_t)
1441         userdom_manage_user_home_content_files($1_t)
1442         userdom_manage_user_home_content_symlinks($1_t)
1443         userdom_manage_user_home_content_pipes($1_t)
1444         userdom_manage_user_home_content_sockets($1_t)
1445         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1446
1447         tunable_policy(`user_rw_noexattrfile',`
1448                 fs_manage_noxattr_fs_files($1_t)
1449                 fs_manage_noxattr_fs_dirs($1_t)
1450         ',`
1451                 fs_read_noxattr_fs_files($1_t)
1452         ')
1453
1454         optional_policy(`
1455                 postgresql_unconfined($1_t)
1456         ')
1457
1458         optional_policy(`
1459                 userhelper_exec($1_t)
1460         ')
1461 ')
1462
1463 ########################################
1464 ## <summary>
1465 ##      Allow user to run as a secadm
1466 ## </summary>
1467 ## <desc>
1468 ##      <p>
1469 ##      Create objects in a user home directory
1470 ##      with an automatic type transition to
1471 ##      a specified private type.
1472 ##      </p>
1473 ##      <p>
1474 ##      This is a templated interface, and should only
1475 ##      be called from a per-userdomain template.
1476 ##      </p>
1477 ## </desc>
1478 ## <param name="domain">
1479 ##      <summary>
1480 ##      Domain allowed access.
1481 ##      </summary>
1482 ## </param>
1483 ## <param name="role">
1484 ##      <summary>
1485 ##      The role  of the object to create.
1486 ##      </summary>
1487 ## </param>
1488 #
1489 template(`userdom_security_admin_template',`
1490         allow $1 self:capability { dac_read_search dac_override };
1491
1492         corecmd_exec_shell($1)
1493
1494         domain_obj_id_change_exemption($1)
1495
1496         dev_relabel_all_dev_nodes($1)
1497
1498         files_create_boot_flag($1)
1499         files_create_default_dir($1)
1500         files_root_filetrans_default($1, dir)
1501
1502         # Necessary for managing /boot/efi
1503         fs_manage_dos_files($1)
1504
1505         mls_process_read_up($1)
1506         mls_file_read_all_levels($1)
1507         mls_file_upgrade($1)
1508         mls_file_downgrade($1)
1509
1510         selinux_set_enforce_mode($1)
1511         selinux_set_all_booleans($1)
1512         selinux_set_parameters($1)
1513         selinux_read_policy($1)
1514
1515         auth_relabel_all_files_except_shadow($1)
1516         auth_relabel_shadow($1)
1517
1518         init_exec($1)
1519
1520         logging_send_syslog_msg($1)
1521         logging_read_audit_log($1)
1522         logging_read_generic_logs($1)
1523         logging_read_audit_config($1)
1524
1525         seutil_manage_bin_policy($1)
1526         seutil_manage_default_contexts($1)
1527         seutil_manage_file_contexts($1)
1528         seutil_manage_module_store($1)
1529         seutil_manage_config($1)
1530         seutil_run_checkpolicy($1,$2)
1531         seutil_run_loadpolicy($1,$2)
1532         seutil_run_semanage($1,$2)
1533         seutil_run_setsebool($1,$2)
1534         seutil_run_setfiles($1, $2)
1535
1536         seutil_manage_bin_policy($1)
1537     seutil_manage_default_contexts($1)
1538     seutil_manage_file_contexts($1)
1539     seutil_manage_module_store($1)
1540     seutil_manage_config($1)
1541
1542         optional_policy(`
1543                 aide_run($1,$2)
1544         ')
1545
1546         optional_policy(`
1547                 consoletype_exec($1)
1548         ')
1549
1550         optional_policy(`
1551                 dmesg_exec($1)
1552         ')
1553
1554         optional_policy(`
1555                 ipsec_run_setkey($1,$2)
1556         ')
1557
1558         optional_policy(`
1559                 netlabel_run_mgmt($1,$2)
1560         ')
1561
1562         optional_policy(`
1563                 samhain_run($1, $2)
1564         ')
1565 ')
1566
1567 ########################################
1568 ## <summary>
1569 ##      Make the specified type usable in a
1570 ##      user home directory.
1571 ## </summary>
1572 ## <param name="type">
1573 ##      <summary>
1574 ##      Type to be used as a file in the
1575 ##      user home directory.
1576 ##      </summary>
1577 ## </param>
1578 #
1579 interface(`userdom_user_home_content',`
1580         gen_require(`
1581                 type user_home_t;
1582                 attribute user_home_type;
1583         ')
1584
1585         allow $1 user_home_t:filesystem associate;
1586         files_type($1)
1587         ubac_constrained($1)
1588
1589         files_poly_member($1)
1590         typeattribute $1  user_home_type;
1591 ')
1592
1593 ########################################
1594 ## <summary>
1595 ##      Make the specified type usable in a
1596 ##      generic temporary directory.
1597 ## </summary>
1598 ## <param name="type">
1599 ##      <summary>
1600 ##      Type to be used as a file in the
1601 ##      generic temporary directory.
1602 ##      </summary>
1603 ## </param>
1604 #
1605 interface(`userdom_user_tmp_content',`
1606         gen_require(`
1607                 attribute user_tmp_type;
1608         ')
1609
1610         typeattribute $1 user_tmp_type;
1611
1612         files_tmp_file($1)
1613         ubac_constrained($1)
1614 ')
1615
1616 ########################################
1617 ## <summary>
1618 ##      Make the specified type usable in a
1619 ##      generic tmpfs_t directory.
1620 ## </summary>
1621 ## <param name="type">
1622 ##      <summary>
1623 ##      Type to be used as a file in the
1624 ##      generic temporary directory.
1625 ##      </summary>
1626 ## </param>
1627 #
1628 interface(`userdom_user_tmpfs_content',`
1629         gen_require(`
1630                 attribute user_tmpfs_type;
1631         ')
1632
1633         typeattribute $1 user_tmpfs_type;
1634
1635         files_tmpfs_file($1)
1636         ubac_constrained($1)
1637 ')
1638
1639 ########################################
1640 ## <summary>
1641 ##      Allow domain to attach to TUN devices created by administrative users.
1642 ## </summary>
1643 ## <param name="domain">
1644 ##      <summary>
1645 ##      Domain allowed access.
1646 ##      </summary>
1647 ## </param>
1648 #
1649 interface(`userdom_attach_admin_tun_iface',`
1650         gen_require(`
1651                 attribute admindomain;
1652         ')
1653
1654         allow $1 admindomain:tun_socket relabelfrom;
1655         allow $1 self:tun_socket relabelto;
1656 ')
1657
1658 ########################################
1659 ## <summary>
1660 ##      Set the attributes of a user pty.
1661 ## </summary>
1662 ## <param name="domain">
1663 ##      <summary>
1664 ##      Domain allowed access.
1665 ##      </summary>
1666 ## </param>
1667 #
1668 interface(`userdom_setattr_user_ptys',`
1669         gen_require(`
1670                 type user_devpts_t;
1671         ')
1672
1673         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1674 ')
1675
1676 ########################################
1677 ## <summary>
1678 ##      Create a user pty.
1679 ## </summary>
1680 ## <param name="domain">
1681 ##      <summary>
1682 ##      Domain allowed access.
1683 ##      </summary>
1684 ## </param>
1685 #
1686 interface(`userdom_create_user_pty',`
1687         gen_require(`
1688                 type user_devpts_t;
1689         ')
1690
1691         term_create_pty($1, user_devpts_t)
1692 ')
1693
1694 ########################################
1695 ## <summary>
1696 ##      Get the attributes of user home directories.
1697 ## </summary>
1698 ## <param name="domain">
1699 ##      <summary>
1700 ##      Domain allowed access.
1701 ##      </summary>
1702 ## </param>
1703 #
1704 interface(`userdom_getattr_user_home_dirs',`
1705         gen_require(`
1706                 type user_home_dir_t;
1707         ')
1708
1709         allow $1 user_home_dir_t:dir getattr_dir_perms;
1710         files_search_home($1)
1711 ')
1712
1713 ########################################
1714 ## <summary>
1715 ##      Do not audit attempts to get the attributes of user home directories.
1716 ## </summary>
1717 ## <param name="domain">
1718 ##      <summary>
1719 ##      Domain to not audit.
1720 ##      </summary>
1721 ## </param>
1722 #
1723 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1724         gen_require(`
1725                 type user_home_dir_t;
1726         ')
1727
1728         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1729 ')
1730
1731 ########################################
1732 ## <summary>
1733 ##      Search user home directories.
1734 ## </summary>
1735 ## <param name="domain">
1736 ##      <summary>
1737 ##      Domain allowed access.
1738 ##      </summary>
1739 ## </param>
1740 #
1741 interface(`userdom_search_user_home_dirs',`
1742         gen_require(`
1743                 type user_home_dir_t;
1744         ')
1745
1746         allow $1 user_home_dir_t:dir search_dir_perms;
1747         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1748         files_search_home($1)
1749 ')
1750
1751 ########################################
1752 ## <summary>
1753 ##      Do not audit attempts to search user home directories.
1754 ## </summary>
1755 ## <desc>
1756 ##      <p>
1757 ##      Do not audit attempts to search user home directories.
1758 ##      This will supress SELinux denial messages when the specified
1759 ##      domain is denied the permission to search these directories.
1760 ##      </p>
1761 ## </desc>
1762 ## <param name="domain">
1763 ##      <summary>
1764 ##      Domain to not audit.
1765 ##      </summary>
1766 ## </param>
1767 ## <infoflow type="none"/>
1768 #
1769 interface(`userdom_dontaudit_search_user_home_dirs',`
1770         gen_require(`
1771                 type user_home_dir_t;
1772         ')
1773
1774         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1775 ')
1776
1777 ########################################
1778 ## <summary>
1779 ##      List user home directories.
1780 ## </summary>
1781 ## <param name="domain">
1782 ##      <summary>
1783 ##      Domain allowed access.
1784 ##      </summary>
1785 ## </param>
1786 #
1787 interface(`userdom_list_user_home_dirs',`
1788         gen_require(`
1789                 type user_home_dir_t;
1790         ')
1791
1792         allow $1 user_home_dir_t:dir list_dir_perms;
1793         files_search_home($1)
1794
1795         tunable_policy(`use_nfs_home_dirs',`
1796                 fs_list_nfs($1)
1797         ')
1798
1799         tunable_policy(`use_samba_home_dirs',`
1800                 fs_list_cifs($1)
1801         ')
1802 ')
1803
1804 ########################################
1805 ## <summary>
1806 ##      Do not audit attempts to list user home subdirectories.
1807 ## </summary>
1808 ## <param name="domain">
1809 ##      <summary>
1810 ##      Domain to not audit.
1811 ##      </summary>
1812 ## </param>
1813 #
1814 interface(`userdom_dontaudit_list_user_home_dirs',`
1815         gen_require(`
1816                 type user_home_dir_t;
1817                 type user_home_t;
1818         ')
1819
1820         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1821         dontaudit $1 user_home_t:dir list_dir_perms;
1822 ')
1823
1824 ########################################
1825 ## <summary>
1826 ##      Create user home directories.
1827 ## </summary>
1828 ## <param name="domain">
1829 ##      <summary>
1830 ##      Domain allowed access.
1831 ##      </summary>
1832 ## </param>
1833 #
1834 interface(`userdom_create_user_home_dirs',`
1835         gen_require(`
1836                 type user_home_dir_t;
1837         ')
1838
1839         allow $1 user_home_dir_t:dir create_dir_perms;
1840 ')
1841
1842 ########################################
1843 ## <summary>
1844 ##      Create user home directories.
1845 ## </summary>
1846 ## <param name="domain">
1847 ##      <summary>
1848 ##      Domain allowed access.
1849 ##      </summary>
1850 ## </param>
1851 #
1852 interface(`userdom_manage_user_home_dirs',`
1853         gen_require(`
1854                 type user_home_dir_t;
1855         ')
1856
1857         allow $1 user_home_dir_t:dir manage_dir_perms;
1858 ')
1859
1860 ########################################
1861 ## <summary>
1862 ##      Relabel to user home directories.
1863 ## </summary>
1864 ## <param name="domain">
1865 ##      <summary>
1866 ##      Domain allowed access.
1867 ##      </summary>
1868 ## </param>
1869 #
1870 interface(`userdom_relabelto_user_home_dirs',`
1871         gen_require(`
1872                 type user_home_dir_t;
1873         ')
1874
1875         allow $1 user_home_dir_t:dir relabelto;
1876 ')
1877
1878
1879 ########################################
1880 ## <summary>
1881 ##      Relabel to user home files.
1882 ## </summary>
1883 ## <param name="domain">
1884 ##      <summary>
1885 ##      Domain allowed access.
1886 ##      </summary>
1887 ## </param>
1888 #
1889 interface(`userdom_relabelto_user_home_files',`
1890         gen_require(`
1891                 type user_home_t;
1892         ')
1893
1894         allow $1 user_home_t:file relabelto;
1895 ')
1896 ########################################
1897 ## <summary>
1898 ##      Relabel user home files.
1899 ## </summary>
1900 ## <param name="domain">
1901 ##      <summary>
1902 ##      Domain allowed access.
1903 ##      </summary>
1904 ## </param>
1905 #
1906 interface(`userdom_relabel_user_home_files',`
1907         gen_require(`
1908                 type user_home_t;
1909         ')
1910
1911         allow $1 user_home_t:file relabel_file_perms;
1912 ')
1913
1914 ########################################
1915 ## <summary>
1916 ##      Create directories in the home dir root with
1917 ##      the user home directory type.
1918 ## </summary>
1919 ## <param name="domain">
1920 ##      <summary>
1921 ##      Domain allowed access.
1922 ##      </summary>
1923 ## </param>
1924 #
1925 interface(`userdom_home_filetrans_user_home_dir',`
1926         gen_require(`
1927                 type user_home_dir_t;
1928         ')
1929
1930         files_home_filetrans($1, user_home_dir_t, dir)
1931 ')
1932
1933 ########################################
1934 ## <summary>
1935 ##      Do a domain transition to the specified
1936 ##      domain when executing a program in the
1937 ##      user home directory.
1938 ## </summary>
1939 ## <desc>
1940 ##      <p>
1941 ##      Do a domain transition to the specified
1942 ##      domain when executing a program in the
1943 ##      user home directory.
1944 ##      </p>
1945 ##      <p>
1946 ##      No interprocess communication (signals, pipes,
1947 ##      etc.) is provided by this interface since
1948 ##      the domains are not owned by this module.
1949 ##      </p>
1950 ## </desc>
1951 ## <param name="source_domain">
1952 ##      <summary>
1953 ##      Domain allowed to transition.
1954 ##      </summary>
1955 ## </param>
1956 ## <param name="target_domain">
1957 ##      <summary>
1958 ##      Domain to transition to.
1959 ##      </summary>
1960 ## </param>
1961 #
1962 interface(`userdom_user_home_domtrans',`
1963         gen_require(`
1964                 type user_home_dir_t, user_home_t;
1965         ')
1966
1967         domain_auto_trans($1, user_home_t, $2)
1968         allow $1 user_home_dir_t:dir search_dir_perms;
1969         files_search_home($1)
1970 ')
1971
1972 ########################################
1973 ## <summary>
1974 ##      Do not audit attempts to search user home content directories.
1975 ## </summary>
1976 ## <param name="domain">
1977 ##      <summary>
1978 ##      Domain to not audit.
1979 ##      </summary>
1980 ## </param>
1981 #
1982 interface(`userdom_dontaudit_search_user_home_content',`
1983         gen_require(`
1984                 type user_home_t;
1985         ')
1986
1987         dontaudit $1 user_home_t:dir search_dir_perms;
1988         fs_dontaudit_list_nfs($1)
1989         fs_dontaudit_list_cifs($1)
1990 ')
1991
1992 ########################################
1993 ## <summary>
1994 ##      List contents of users home directory.
1995 ## </summary>
1996 ## <param name="domain">
1997 ##      <summary>
1998 ##      Domain allowed access.
1999 ##      </summary>
2000 ## </param>
2001 #
2002 interface(`userdom_list_user_home_content',`
2003         gen_require(`
2004                 type user_home_dir_t;
2005                 attribute user_home_type;
2006         ')
2007
2008         files_list_home($1)
2009         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2010 ')
2011
2012 ########################################
2013 ## <summary>
2014 ##      Create, read, write, and delete directories
2015 ##      in a user home subdirectory.
2016 ## </summary>
2017 ## <param name="domain">
2018 ##      <summary>
2019 ##      Domain allowed access.
2020 ##      </summary>
2021 ## </param>
2022 #
2023 interface(`userdom_manage_user_home_content_dirs',`
2024         gen_require(`
2025                 type user_home_dir_t, user_home_t;
2026         ')
2027
2028         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2029         files_search_home($1)
2030 ')
2031
2032 ########################################
2033 ## <summary>
2034 ##      Delete directories in a user home subdirectory.
2035 ## </summary>
2036 ## <param name="domain">
2037 ##      <summary>
2038 ##      Domain allowed access.
2039 ##      </summary>
2040 ## </param>
2041 #
2042 interface(`userdom_delete_user_home_content_dirs',`
2043         gen_require(`
2044                 type user_home_t;
2045         ')
2046
2047         allow $1 user_home_t:dir delete_dir_perms;
2048 ')
2049
2050 ########################################
2051 ## <summary>
2052 ##      Set the attributes of user home files.
2053 ## </summary>
2054 ## <param name="domain">
2055 ##      <summary>
2056 ##      Domain allowed access.
2057 ##      </summary>
2058 ## </param>
2059 ## <rolecap/>
2060 #
2061 interface(`userdom_setattr_user_home_content_files',`
2062         gen_require(`
2063                 type user_home_t;
2064         ')
2065
2066         allow $1 user_home_t:file setattr;
2067 ')
2068
2069 ########################################
2070 ## <summary>
2071 ##      Do not audit attempts to set the
2072 ##      attributes of user home files.
2073 ## </summary>
2074 ## <param name="domain">
2075 ##      <summary>
2076 ##      Domain to not audit.
2077 ##      </summary>
2078 ## </param>
2079 #
2080 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2081         gen_require(`
2082                 type user_home_t;
2083         ')
2084
2085         dontaudit $1 user_home_t:file setattr_file_perms;
2086 ')
2087
2088 ########################################
2089 ## <summary>
2090 ##      Mmap user home files.
2091 ## </summary>
2092 ## <param name="domain">
2093 ##      <summary>
2094 ##      Domain allowed access.
2095 ##      </summary>
2096 ## </param>
2097 #
2098 interface(`userdom_mmap_user_home_content_files',`
2099         gen_require(`
2100                 type user_home_dir_t, user_home_t;
2101         ')
2102
2103         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2104         files_search_home($1)
2105 ')
2106
2107 ########################################
2108 ## <summary>
2109 ##      Read user home files.
2110 ## </summary>
2111 ## <param name="domain">
2112 ##      <summary>
2113 ##      Domain allowed access.
2114 ##      </summary>
2115 ## </param>
2116 #
2117 interface(`userdom_read_user_home_content_files',`
2118         gen_require(`
2119                 type user_home_dir_t, user_home_t;
2120         ')
2121
2122         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2123         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2124         files_search_home($1)
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Do not audit attempts to getattr user home files.
2130 ## </summary>
2131 ## <param name="domain">
2132 ##      <summary>
2133 ##      Domain to not audit.
2134 ##      </summary>
2135 ## </param>
2136 #
2137 interface(`userdom_dontaudit_getattr_user_home_content',`
2138         gen_require(`
2139                 attribute user_home_type;
2140         ')
2141
2142         dontaudit $1 user_home_type:dir getattr;
2143         dontaudit $1 user_home_type:file getattr;
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Do not audit attempts to read user home files.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain to not audit.
2153 ##      </summary>
2154 ## </param>
2155 #
2156 interface(`userdom_dontaudit_read_user_home_content_files',`
2157         gen_require(`
2158                 attribute user_home_type;
2159                 type user_home_dir_t;
2160         ')
2161
2162         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2163         dontaudit $1 user_home_type:dir list_dir_perms;
2164         dontaudit $1 user_home_type:file read_file_perms;
2165         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2166 ')
2167
2168 ########################################
2169 ## <summary>
2170 ##      Do not audit attempts to append user home files.
2171 ## </summary>
2172 ## <param name="domain">
2173 ##      <summary>
2174 ##      Domain to not audit.
2175 ##      </summary>
2176 ## </param>
2177 #
2178 interface(`userdom_dontaudit_append_user_home_content_files',`
2179         gen_require(`
2180                 type user_home_t;
2181         ')
2182
2183         dontaudit $1 user_home_t:file append_file_perms;
2184 ')
2185
2186 ########################################
2187 ## <summary>
2188 ##      Do not audit attempts to write user home files.
2189 ## </summary>
2190 ## <param name="domain">
2191 ##      <summary>
2192 ##      Domain to not audit.
2193 ##      </summary>
2194 ## </param>
2195 #
2196 interface(`userdom_dontaudit_write_user_home_content_files',`
2197         gen_require(`
2198                 type user_home_t;
2199         ')
2200
2201         dontaudit $1 user_home_t:file write_file_perms;
2202 ')
2203
2204 ########################################
2205 ## <summary>
2206 ##      Delete files in a user home subdirectory.
2207 ## </summary>
2208 ## <param name="domain">
2209 ##      <summary>
2210 ##      Domain allowed access.
2211 ##      </summary>
2212 ## </param>
2213 #
2214 interface(`userdom_delete_user_home_content_files',`
2215         gen_require(`
2216                 type user_home_t;
2217         ')
2218
2219         allow $1 user_home_t:file delete_file_perms;
2220 ')
2221
2222 ########################################
2223 ## <summary>
2224 ##      Delete sock files in a user home subdirectory.
2225 ## </summary>
2226 ## <param name="domain">
2227 ##      <summary>
2228 ##      Domain allowed access.
2229 ##      </summary>
2230 ## </param>
2231 #
2232 interface(`userdom_delete_user_home_content_sock_files',`
2233         gen_require(`
2234                 type user_home_t;
2235         ')
2236
2237         allow $1 user_home_t:sock_file delete_file_perms;
2238 ')
2239
2240 ########################################
2241 ## <summary>
2242 ##      Do not audit attempts to write user home files.
2243 ## </summary>
2244 ## <param name="domain">
2245 ##      <summary>
2246 ##      Domain to not audit.
2247 ##      </summary>
2248 ## </param>
2249 #
2250 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2251         gen_require(`
2252                 type user_home_t;
2253         ')
2254
2255         dontaudit $1 user_home_t:file relabel_file_perms;
2256 ')
2257
2258 ########################################
2259 ## <summary>
2260 ##      Read user home subdirectory symbolic links.
2261 ## </summary>
2262 ## <param name="domain">
2263 ##      <summary>
2264 ##      Domain allowed access.
2265 ##      </summary>
2266 ## </param>
2267 #
2268 interface(`userdom_read_user_home_content_symlinks',`
2269         gen_require(`
2270                 type user_home_dir_t, user_home_t;
2271         ')
2272
2273         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2274 ')
2275
2276 ########################################
2277 ## <summary>
2278 ##      Execute user home files.
2279 ## </summary>
2280 ## <param name="domain">
2281 ##      <summary>
2282 ##      Domain allowed access.
2283 ##      </summary>
2284 ## </param>
2285 ## <rolecap/>
2286 #
2287 interface(`userdom_exec_user_home_content_files',`
2288         gen_require(`
2289                 type user_home_dir_t;
2290                 attribute user_home_type;
2291         ')
2292
2293         files_search_home($1)
2294         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2295         dontaudit $1 user_home_type:sock_file execute;
2296         ')
2297
2298 ########################################
2299 ## <summary>
2300 ##      Do not audit attempts to execute user home files.
2301 ## </summary>
2302 ## <param name="domain">
2303 ##      <summary>
2304 ##      Domain to not audit.
2305 ##      </summary>
2306 ## </param>
2307 #
2308 interface(`userdom_dontaudit_exec_user_home_content_files',`
2309         gen_require(`
2310                 type user_home_t;
2311         ')
2312
2313         dontaudit $1 user_home_t:file exec_file_perms;
2314 ')
2315
2316 ########################################
2317 ## <summary>
2318 ##      Create, read, write, and delete files
2319 ##      in a user home subdirectory.
2320 ## </summary>
2321 ## <param name="domain">
2322 ##      <summary>
2323 ##      Domain allowed access.
2324 ##      </summary>
2325 ## </param>
2326 #
2327 interface(`userdom_manage_user_home_content_files',`
2328         gen_require(`
2329                 type user_home_dir_t, user_home_t;
2330         ')
2331
2332         manage_files_pattern($1, user_home_t, user_home_t)
2333         allow $1 user_home_dir_t:dir search_dir_perms;
2334         files_search_home($1)
2335 ')
2336
2337 ########################################
2338 ## <summary>
2339 ##      Do not audit attempts to create, read, write, and delete directories
2340 ##      in a user home subdirectory.
2341 ## </summary>
2342 ## <param name="domain">
2343 ##      <summary>
2344 ##      Domain to not audit.
2345 ##      </summary>
2346 ## </param>
2347 #
2348 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2349         gen_require(`
2350                 type user_home_dir_t, user_home_t;
2351         ')
2352
2353         dontaudit $1 user_home_t:dir manage_dir_perms;
2354 ')
2355
2356 ########################################
2357 ## <summary>
2358 ##      Create, read, write, and delete symbolic links
2359 ##      in a user home subdirectory.
2360 ## </summary>
2361 ## <param name="domain">
2362 ##      <summary>
2363 ##      Domain allowed access.
2364 ##      </summary>
2365 ## </param>
2366 #
2367 interface(`userdom_manage_user_home_content_symlinks',`
2368         gen_require(`
2369                 type user_home_dir_t, user_home_t;
2370         ')
2371
2372         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2373         allow $1 user_home_dir_t:dir search_dir_perms;
2374         files_search_home($1)
2375 ')
2376
2377 ########################################
2378 ## <summary>
2379 ##      Delete symbolic links in a user home directory.
2380 ## </summary>
2381 ## <param name="domain">
2382 ##      <summary>
2383 ##      Domain allowed access.
2384 ##      </summary>
2385 ## </param>
2386 #
2387 interface(`userdom_delete_user_home_content_symlinks',`
2388         gen_require(`
2389                 type user_home_t;
2390         ')
2391
2392         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2393 ')
2394
2395 ########################################
2396 ## <summary>
2397 ##      Create, read, write, and delete named pipes
2398 ##      in a user home subdirectory.
2399 ## </summary>
2400 ## <param name="domain">
2401 ##      <summary>
2402 ##      Domain allowed access.
2403 ##      </summary>
2404 ## </param>
2405 #
2406 interface(`userdom_manage_user_home_content_pipes',`
2407         gen_require(`
2408                 type user_home_dir_t, user_home_t;
2409         ')
2410
2411         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2412         allow $1 user_home_dir_t:dir search_dir_perms;
2413         files_search_home($1)
2414 ')
2415
2416 ########################################
2417 ## <summary>
2418 ##      Create, read, write, and delete named sockets
2419 ##      in a user home subdirectory.
2420 ## </summary>
2421 ## <param name="domain">
2422 ##      <summary>
2423 ##      Domain allowed access.
2424 ##      </summary>
2425 ## </param>
2426 #
2427 interface(`userdom_manage_user_home_content_sockets',`
2428         gen_require(`
2429                 type user_home_dir_t, user_home_t;
2430         ')
2431
2432         allow $1 user_home_dir_t:dir search_dir_perms;
2433         manage_sock_files_pattern($1, user_home_t, user_home_t)
2434         files_search_home($1)
2435 ')
2436
2437 ########################################
2438 ## <summary>
2439 ##      Create objects in a user home directory
2440 ##      with an automatic type transition to
2441 ##      a specified private type.
2442 ## </summary>
2443 ## <param name="domain">
2444 ##      <summary>
2445 ##      Domain allowed access.
2446 ##      </summary>
2447 ## </param>
2448 ## <param name="private_type">
2449 ##      <summary>
2450 ##      The type of the object to create.
2451 ##      </summary>
2452 ## </param>
2453 ## <param name="object_class">
2454 ##      <summary>
2455 ##      The class of the object to be created.
2456 ##      </summary>
2457 ## </param>
2458 #
2459 interface(`userdom_user_home_dir_filetrans',`
2460         gen_require(`
2461                 type user_home_dir_t;
2462         ')
2463
2464         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2465         files_search_home($1)
2466 ')
2467
2468 ########################################
2469 ## <summary>
2470 ##      Create objects in a user home directory
2471 ##      with an automatic type transition to
2472 ##      a specified private type.
2473 ## </summary>
2474 ## <param name="domain">
2475 ##      <summary>
2476 ##      Domain allowed access.
2477 ##      </summary>
2478 ## </param>
2479 ## <param name="private_type">
2480 ##      <summary>
2481 ##      The type of the object to create.
2482 ##      </summary>
2483 ## </param>
2484 ## <param name="object_class">
2485 ##      <summary>
2486 ##      The class of the object to be created.
2487 ##      </summary>
2488 ## </param>
2489 #
2490 interface(`userdom_user_home_content_filetrans',`
2491         gen_require(`
2492                 type user_home_dir_t, user_home_t;
2493         ')
2494
2495         filetrans_pattern($1, user_home_t, $2, $3)
2496         allow $1 user_home_dir_t:dir search_dir_perms;
2497         files_search_home($1)
2498 ')
2499
2500 ########################################
2501 ## <summary>
2502 ##      Create objects in a user home directory
2503 ##      with an automatic type transition to
2504 ##      the user home file type.
2505 ## </summary>
2506 ## <param name="domain">
2507 ##      <summary>
2508 ##      Domain allowed access.
2509 ##      </summary>
2510 ## </param>
2511 ## <param name="object_class">
2512 ##      <summary>
2513 ##      The class of the object to be created.
2514 ##      </summary>
2515 ## </param>
2516 #
2517 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2518         gen_require(`
2519                 type user_home_dir_t, user_home_t;
2520         ')
2521
2522         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2523         files_search_home($1)
2524 ')
2525
2526 ########################################
2527 ## <summary>
2528 ##      Write to user temporary named sockets.
2529 ## </summary>
2530 ## <param name="domain">
2531 ##      <summary>
2532 ##      Domain allowed access.
2533 ##      </summary>
2534 ## </param>
2535 #
2536 interface(`userdom_write_user_tmp_sockets',`
2537         gen_require(`
2538                 type user_tmp_t;
2539         ')
2540
2541         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2542         files_search_tmp($1)
2543 ')
2544
2545 ########################################
2546 ## <summary>
2547 ##      List user temporary directories.
2548 ## </summary>
2549 ## <param name="domain">
2550 ##      <summary>
2551 ##      Domain allowed access.
2552 ##      </summary>
2553 ## </param>
2554 #
2555 interface(`userdom_list_user_tmp',`
2556         gen_require(`
2557                 type user_tmp_t;
2558         ')
2559
2560         allow $1 user_tmp_t:dir list_dir_perms;
2561         files_search_tmp($1)
2562 ')
2563
2564 ########################################
2565 ## <summary>
2566 ##      Do not audit attempts to list user
2567 ##      temporary directories.
2568 ## </summary>
2569 ## <param name="domain">
2570 ##      <summary>
2571 ##      Domain to not audit.
2572 ##      </summary>
2573 ## </param>
2574 #
2575 interface(`userdom_dontaudit_list_user_tmp',`
2576         gen_require(`
2577                 type user_tmp_t;
2578         ')
2579
2580         dontaudit $1 user_tmp_t:dir list_dir_perms;
2581 ')
2582
2583 ########################################
2584 ## <summary>
2585 ##      Do not audit attempts to manage users
2586 ##      temporary directories.
2587 ## </summary>
2588 ## <param name="domain">
2589 ##      <summary>
2590 ##      Domain to not audit.
2591 ##      </summary>
2592 ## </param>
2593 #
2594 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2595         gen_require(`
2596                 type user_tmp_t;
2597         ')
2598
2599         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2600 ')
2601
2602 ########################################
2603 ## <summary>
2604 ##      Read user temporary files.
2605 ## </summary>
2606 ## <param name="domain">
2607 ##      <summary>
2608 ##      Domain allowed access.
2609 ##      </summary>
2610 ## </param>
2611 #
2612 interface(`userdom_read_user_tmp_files',`
2613         gen_require(`
2614                 type user_tmp_t;
2615         ')
2616
2617         read_files_pattern($1, user_tmp_t, user_tmp_t)
2618         allow $1 user_tmp_t:dir list_dir_perms;
2619         files_search_tmp($1)
2620 ')
2621
2622 ########################################
2623 ## <summary>
2624 ##      Do not audit attempts to read users
2625 ##      temporary files.
2626 ## </summary>
2627 ## <param name="domain">
2628 ##      <summary>
2629 ##      Domain to not audit.
2630 ##      </summary>
2631 ## </param>
2632 #
2633 interface(`userdom_dontaudit_read_user_tmp_files',`
2634         gen_require(`
2635                 type user_tmp_t;
2636         ')
2637
2638         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2639 ')
2640
2641 ########################################
2642 ## <summary>
2643 ##      Do not audit attempts to append users
2644 ##      temporary files.
2645 ## </summary>
2646 ## <param name="domain">
2647 ##      <summary>
2648 ##      Domain to not audit.
2649 ##      </summary>
2650 ## </param>
2651 #
2652 interface(`userdom_dontaudit_append_user_tmp_files',`
2653         gen_require(`
2654                 type user_tmp_t;
2655         ')
2656
2657         dontaudit $1 user_tmp_t:file append_file_perms;
2658 ')
2659
2660 ########################################
2661 ## <summary>
2662 ##      Read and write user temporary files.
2663 ## </summary>
2664 ## <param name="domain">
2665 ##      <summary>
2666 ##      Domain allowed access.
2667 ##      </summary>
2668 ## </param>
2669 #
2670 interface(`userdom_rw_user_tmp_files',`
2671         gen_require(`
2672                 type user_tmp_t;
2673         ')
2674
2675         allow $1 user_tmp_t:dir list_dir_perms;
2676         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2677         files_search_tmp($1)
2678 ')
2679
2680 ########################################
2681 ## <summary>
2682 ##      Do not audit attempts to manage users
2683 ##      temporary files.
2684 ## </summary>
2685 ## <param name="domain">
2686 ##      <summary>
2687 ##      Domain to not audit.
2688 ##      </summary>
2689 ## </param>
2690 #
2691 interface(`userdom_dontaudit_manage_user_tmp_files',`
2692         gen_require(`
2693                 type user_tmp_t;
2694         ')
2695
2696         dontaudit $1 user_tmp_t:file manage_file_perms;
2697 ')
2698
2699 ########################################
2700 ## <summary>
2701 ##      Read user temporary symbolic links.
2702 ## </summary>
2703 ## <param name="domain">
2704 ##      <summary>
2705 ##      Domain allowed access.
2706 ##      </summary>
2707 ## </param>
2708 #
2709 interface(`userdom_read_user_tmp_symlinks',`
2710         gen_require(`
2711                 type user_tmp_t;
2712         ')
2713
2714         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2715         allow $1 user_tmp_t:dir list_dir_perms;
2716         files_search_tmp($1)
2717 ')
2718
2719 ########################################
2720 ## <summary>
2721 ##      Create, read, write, and delete user
2722 ##      temporary directories.
2723 ## </summary>
2724 ## <param name="domain">
2725 ##      <summary>
2726 ##      Domain allowed access.
2727 ##      </summary>
2728 ## </param>
2729 #
2730 interface(`userdom_manage_user_tmp_dirs',`
2731         gen_require(`
2732                 type user_tmp_t;
2733         ')
2734
2735         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2736         files_search_tmp($1)
2737 ')
2738
2739 ########################################
2740 ## <summary>
2741 ##      Create, read, write, and delete user
2742 ##      temporary files.
2743 ## </summary>
2744 ## <param name="domain">
2745 ##      <summary>
2746 ##      Domain allowed access.
2747 ##      </summary>
2748 ## </param>
2749 #
2750 interface(`userdom_manage_user_tmp_files',`
2751         gen_require(`
2752                 type user_tmp_t;
2753         ')
2754
2755         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2756         files_search_tmp($1)
2757 ')
2758
2759 ########################################
2760 ## <summary>
2761 ##      Create, read, write, and delete user
2762 ##      temporary symbolic links.
2763 ## </summary>
2764 ## <param name="domain">
2765 ##      <summary>
2766 ##      Domain allowed access.
2767 ##      </summary>
2768 ## </param>
2769 #
2770 interface(`userdom_manage_user_tmp_symlinks',`
2771         gen_require(`
2772                 type user_tmp_t;
2773         ')
2774
2775         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2776         files_search_tmp($1)
2777 ')
2778
2779 ########################################
2780 ## <summary>
2781 ##      Create, read, write, and delete user
2782 ##      temporary named pipes.
2783 ## </summary>
2784 ## <param name="domain">
2785 ##      <summary>
2786 ##      Domain allowed access.
2787 ##      </summary>
2788 ## </param>
2789 #
2790 interface(`userdom_manage_user_tmp_pipes',`
2791         gen_require(`
2792                 type user_tmp_t;
2793         ')
2794
2795         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2796         files_search_tmp($1)
2797 ')
2798
2799 ########################################
2800 ## <summary>
2801 ##      Create, read, write, and delete user
2802 ##      temporary named sockets.
2803 ## </summary>
2804 ## <param name="domain">
2805 ##      <summary>
2806 ##      Domain allowed access.
2807 ##      </summary>
2808 ## </param>
2809 #
2810 interface(`userdom_manage_user_tmp_sockets',`
2811         gen_require(`
2812                 type user_tmp_t;
2813         ')
2814
2815         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2816         files_search_tmp($1)
2817 ')
2818
2819 ########################################
2820 ## <summary>
2821 ##      Create objects in a user temporary directory
2822 ##      with an automatic type transition to
2823 ##      a specified private type.
2824 ## </summary>
2825 ## <param name="domain">
2826 ##      <summary>
2827 ##      Domain allowed access.
2828 ##      </summary>
2829 ## </param>
2830 ## <param name="private_type">
2831 ##      <summary>
2832 ##      The type of the object to create.
2833 ##      </summary>
2834 ## </param>
2835 ## <param name="object_class">
2836 ##      <summary>
2837 ##      The class of the object to be created.
2838 ##      </summary>
2839 ## </param>
2840 #
2841 interface(`userdom_user_tmp_filetrans',`
2842         gen_require(`
2843                 type user_tmp_t;
2844         ')
2845
2846         filetrans_pattern($1, user_tmp_t, $2, $3)
2847         files_search_tmp($1)
2848 ')
2849
2850 ########################################
2851 ## <summary>
2852 ##      Create objects in the temporary directory
2853 ##      with an automatic type transition to
2854 ##      the user temporary type.
2855 ## </summary>
2856 ## <param name="domain">
2857 ##      <summary>
2858 ##      Domain allowed access.
2859 ##      </summary>
2860 ## </param>
2861 ## <param name="object_class">
2862 ##      <summary>
2863 ##      The class of the object to be created.
2864 ##      </summary>
2865 ## </param>
2866 #
2867 interface(`userdom_tmp_filetrans_user_tmp',`
2868         gen_require(`
2869                 type user_tmp_t;
2870         ')
2871
2872         files_tmp_filetrans($1, user_tmp_t, $2)
2873 ')
2874
2875 ########################################
2876 ## <summary>
2877 ##      Read user tmpfs files.
2878 ## </summary>
2879 ## <param name="domain">
2880 ##      <summary>
2881 ##      Domain allowed access.
2882 ##      </summary>
2883 ## </param>
2884 #
2885 interface(`userdom_read_user_tmpfs_files',`
2886         gen_require(`
2887                 type user_tmpfs_t;
2888         ')
2889
2890         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2891         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2892         allow $1 user_tmpfs_t:dir list_dir_perms;
2893         fs_search_tmpfs($1)
2894 ')
2895
2896 ########################################
2897 ## <summary>
2898 ##      Read/Write user tmpfs files.
2899 ## </summary>
2900 ## <param name="domain">
2901 ##      <summary>
2902 ##      Domain allowed access.
2903 ##      </summary>
2904 ## </param>
2905 #
2906 interface(`userdom_rw_user_tmpfs_files',`
2907         gen_require(`
2908                 type user_tmpfs_t;
2909         ')
2910
2911         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2912         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2913         allow $1 user_tmpfs_t:dir list_dir_perms;
2914         fs_search_tmpfs($1)
2915 ')
2916
2917 ########################################
2918 ## <summary>
2919 ##      Get the attributes of a user domain tty.
2920 ## </summary>
2921 ## <param name="domain">
2922 ##      <summary>
2923 ##      Domain allowed access.
2924 ##      </summary>
2925 ## </param>
2926 #
2927 interface(`userdom_getattr_user_ttys',`
2928         gen_require(`
2929                 type user_tty_device_t;
2930         ')
2931
2932         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2933 ')
2934
2935 ########################################
2936 ## <summary>
2937 ##      Do not audit attempts to get the attributes of a user domain tty.
2938 ## </summary>
2939 ## <param name="domain">
2940 ##      <summary>
2941 ##      Domain to not audit.
2942 ##      </summary>
2943 ## </param>
2944 #
2945 interface(`userdom_dontaudit_getattr_user_ttys',`
2946         gen_require(`
2947                 type user_tty_device_t;
2948         ')
2949
2950         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2951 ')
2952
2953 ########################################
2954 ## <summary>
2955 ##      Set the attributes of a user domain tty.
2956 ## </summary>
2957 ## <param name="domain">
2958 ##      <summary>
2959 ##      Domain allowed access.
2960 ##      </summary>
2961 ## </param>
2962 #
2963 interface(`userdom_setattr_user_ttys',`
2964         gen_require(`
2965                 type user_tty_device_t;
2966         ')
2967
2968         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2969 ')
2970
2971 ########################################
2972 ## <summary>
2973 ##      Do not audit attempts to set the attributes of a user domain tty.
2974 ## </summary>
2975 ## <param name="domain">
2976 ##      <summary>
2977 ##      Domain to not audit.
2978 ##      </summary>
2979 ## </param>
2980 #
2981 interface(`userdom_dontaudit_setattr_user_ttys',`
2982         gen_require(`
2983                 type user_tty_device_t;
2984         ')
2985
2986         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2987 ')
2988
2989 ########################################
2990 ## <summary>
2991 ##      Read and write a user domain tty.
2992 ## </summary>
2993 ## <param name="domain">
2994 ##      <summary>
2995 ##      Domain allowed access.
2996 ##      </summary>
2997 ## </param>
2998 #
2999 interface(`userdom_use_user_ttys',`
3000         gen_require(`
3001                 type user_tty_device_t;
3002         ')
3003
3004         allow $1 user_tty_device_t:chr_file rw_term_perms;
3005 ')
3006
3007 ########################################
3008 ## <summary>
3009 ##      Read and write a inherited user domain tty.
3010 ## </summary>
3011 ## <param name="domain">
3012 ##      <summary>
3013 ##      Domain allowed access.
3014 ##      </summary>
3015 ## </param>
3016 #
3017 interface(`userdom_use_inherited_user_ttys',`
3018         gen_require(`
3019                 type user_tty_device_t;
3020         ')
3021
3022         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3023 ')
3024
3025 ########################################
3026 ## <summary>
3027 ##      Read and write a user domain pty.
3028 ## </summary>
3029 ## <param name="domain">
3030 ##      <summary>
3031 ##      Domain allowed access.
3032 ##      </summary>
3033 ## </param>
3034 #
3035 interface(`userdom_use_user_ptys',`
3036         gen_require(`
3037                 type user_devpts_t;
3038         ')
3039
3040         allow $1 user_devpts_t:chr_file rw_term_perms;
3041 ')
3042
3043 ########################################
3044 ## <summary>
3045 ##      Read and write a inherited user domain pty.
3046 ## </summary>
3047 ## <param name="domain">
3048 ##      <summary>
3049 ##      Domain allowed access.
3050 ##      </summary>
3051 ## </param>
3052 #
3053 interface(`userdom_use_inherited_user_ptys',`
3054         gen_require(`
3055                 type user_devpts_t;
3056         ')
3057
3058         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3059 ')
3060
3061 ########################################
3062 ## <summary>
3063 ##      Read and write a inherited user TTYs and PTYs.
3064 ## </summary>
3065 ## <desc>
3066 ##      <p>
3067 ##      Allow the specified domain to read and write inherited user
3068 ##      TTYs and PTYs. This will allow the domain to
3069 ##      interact with the user via the terminal. Typically
3070 ##      all interactive applications will require this
3071 ##      access.
3072 ##      </p>
3073 ## </desc>
3074 ## <param name="domain">
3075 ##      <summary>
3076 ##      Domain allowed access.
3077 ##      </summary>
3078 ## </param>
3079 ## <infoflow type="both" weight="10"/>
3080 #
3081 interface(`userdom_use_inherited_user_terminals',`
3082         gen_require(`
3083                 type user_tty_device_t, user_devpts_t;
3084         ')
3085
3086         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3087         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3088 ')
3089
3090 #######################################
3091 ## <summary>
3092 ##  Allow attempts to read and write
3093 ##  a user domain tty and pty.
3094 ## </summary>
3095 ## <param name="domain">
3096 ##  <summary>
3097 ##  Domain to not audit.
3098 ##  </summary>
3099 ## </param>
3100 #
3101 interface(`userdom_use_user_terminals',`
3102     gen_require(`
3103         type user_tty_device_t, user_devpts_t;
3104     ')
3105
3106     allow $1 user_tty_device_t:chr_file rw_term_perms;
3107     allow $1 user_devpts_t:chr_file rw_term_perms;
3108 ')
3109
3110 ########################################
3111 ## <summary>
3112 ##      Do not audit attempts to read and write
3113 ##      a user domain tty and pty.
3114 ## </summary>
3115 ## <param name="domain">
3116 ##      <summary>
3117 ##      Domain to not audit.
3118 ##      </summary>
3119 ## </param>
3120 #
3121 interface(`userdom_dontaudit_use_user_terminals',`
3122         gen_require(`
3123                 type user_tty_device_t, user_devpts_t;
3124         ')
3125
3126         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3127         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3128 ')
3129
3130
3131 ########################################
3132 ## <summary>
3133 ##      Get attributes of user domain tty and pty.
3134 ## </summary>
3135 ## <param name="domain">
3136 ##      <summary>
3137 ##      Domain allowed access.
3138 ##      </summary>
3139 ## </param>
3140 #
3141 interface(`userdom_getattr_user_terminals',`
3142         gen_require(`
3143                 type user_tty_device_t, user_devpts_t;
3144         ')
3145
3146         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3147 ')
3148
3149 ########################################
3150 ## <summary>
3151 ##      Execute a shell in all user domains.  This
3152 ##      is an explicit transition, requiring the
3153 ##      caller to use setexeccon().
3154 ## </summary>
3155 ## <param name="domain">
3156 ##      <summary>
3157 ##      Domain allowed to transition.
3158 ##      </summary>
3159 ## </param>
3160 #
3161 interface(`userdom_spec_domtrans_all_users',`
3162         gen_require(`
3163                 attribute userdomain;
3164         ')
3165
3166         corecmd_shell_spec_domtrans($1, userdomain)
3167         allow userdomain $1:fd use;
3168         allow userdomain $1:fifo_file rw_file_perms;
3169         allow userdomain $1:process sigchld;
3170 ')
3171
3172 ########################################
3173 ## <summary>
3174 ##      Execute an Xserver session in all unprivileged user domains.  This
3175 ##      is an explicit transition, requiring the
3176 ##      caller to use setexeccon().
3177 ## </summary>
3178 ## <param name="domain">
3179 ##      <summary>
3180 ##      Domain allowed to transition.
3181 ##      </summary>
3182 ## </param>
3183 #
3184 interface(`userdom_xsession_spec_domtrans_all_users',`
3185         gen_require(`
3186                 attribute userdomain;
3187         ')
3188
3189         xserver_xsession_spec_domtrans($1, userdomain)
3190         allow userdomain $1:fd use;
3191         allow userdomain $1:fifo_file rw_file_perms;
3192         allow userdomain $1:process sigchld;
3193 ')
3194
3195 ########################################
3196 ## <summary>
3197 ##      Execute a shell in all unprivileged user domains.  This
3198 ##      is an explicit transition, requiring the
3199 ##      caller to use setexeccon().
3200 ## </summary>
3201 ## <param name="domain">
3202 ##      <summary>
3203 ##      Domain allowed to transition.
3204 ##      </summary>
3205 ## </param>
3206 #
3207 interface(`userdom_spec_domtrans_unpriv_users',`
3208         gen_require(`
3209                 attribute unpriv_userdomain;
3210         ')
3211
3212         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3213         allow unpriv_userdomain $1:fd use;
3214         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3215         allow unpriv_userdomain $1:process sigchld;
3216 ')
3217
3218 ########################################
3219 ## <summary>
3220 ##      Execute an Xserver session in all unprivileged user domains.  This
3221 ##      is an explicit transition, requiring the
3222 ##      caller to use setexeccon().
3223 ## </summary>
3224 ## <param name="domain">
3225 ##      <summary>
3226 ##      Domain allowed to transition.
3227 ##      </summary>
3228 ## </param>
3229 #
3230 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3231         gen_require(`
3232                 attribute unpriv_userdomain;
3233         ')
3234
3235         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3236         allow unpriv_userdomain $1:fd use;
3237         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3238         allow unpriv_userdomain $1:process sigchld;
3239 ')
3240
3241 ########################################
3242 ## <summary>
3243 ##      Manage unpriviledged user SysV sempaphores.
3244 ## </summary>
3245 ## <param name="domain">
3246 ##      <summary>
3247 ##      Domain allowed access.
3248 ##      </summary>
3249 ## </param>
3250 #
3251 interface(`userdom_manage_unpriv_user_semaphores',`
3252         gen_require(`
3253                 attribute unpriv_userdomain;
3254         ')
3255
3256         allow $1 unpriv_userdomain:sem create_sem_perms;
3257 ')
3258
3259 ########################################
3260 ## <summary>
3261 ##      Manage unpriviledged user SysV shared
3262 ##      memory segments.
3263 ## </summary>
3264 ## <param name="domain">
3265 ##      <summary>
3266 ##      Domain allowed access.
3267 ##      </summary>
3268 ## </param>
3269 #
3270 interface(`userdom_manage_unpriv_user_shared_mem',`
3271         gen_require(`
3272                 attribute unpriv_userdomain;
3273         ')
3274
3275         allow $1 unpriv_userdomain:shm create_shm_perms;
3276 ')
3277
3278 ########################################
3279 ## <summary>
3280 ##      Execute bin_t in the unprivileged user domains. This
3281 ##      is an explicit transition, requiring the
3282 ##      caller to use setexeccon().
3283 ## </summary>
3284 ## <param name="domain">
3285 ##      <summary>
3286 ##      Domain allowed to transition.
3287 ##      </summary>
3288 ## </param>
3289 #
3290 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3291         gen_require(`
3292                 attribute unpriv_userdomain;
3293         ')
3294
3295         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3296         allow unpriv_userdomain $1:fd use;
3297         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3298         allow unpriv_userdomain $1:process sigchld;
3299 ')
3300
3301 ########################################
3302 ## <summary>
3303 ##      Execute all entrypoint files in unprivileged user
3304 ##      domains. This is an explicit transition, requiring the
3305 ##      caller to use setexeccon().
3306 ## </summary>
3307 ## <param name="domain">
3308 ##      <summary>
3309 ##      Domain allowed access.
3310 ##      </summary>
3311 ## </param>
3312 #
3313 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3314         gen_require(`
3315                 attribute unpriv_userdomain;
3316         ')
3317
3318         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3319         allow unpriv_userdomain $1:fd use;
3320         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3321         allow unpriv_userdomain $1:process sigchld;
3322 ')
3323
3324 ########################################
3325 ## <summary>
3326 ##      Search users home directories.
3327 ## </summary>
3328 ## <param name="domain">
3329 ##      <summary>
3330 ##      Domain allowed access.
3331 ##      </summary>
3332 ## </param>
3333 #
3334 interface(`userdom_search_user_home_content',`
3335         gen_require(`
3336                 type user_home_dir_t;
3337                 attribute user_home_type;
3338         ')
3339
3340         files_list_home($1)
3341         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3342         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3343 ')
3344
3345 ########################################
3346 ## <summary>
3347 ##      Send general signals to unprivileged user domains.
3348 ## </summary>
3349 ## <param name="domain">
3350 ##      <summary>
3351 ##      Domain allowed access.
3352 ##      </summary>
3353 ## </param>
3354 #
3355 interface(`userdom_signal_unpriv_users',`
3356         gen_require(`
3357                 attribute unpriv_userdomain;
3358         ')
3359
3360         allow $1 unpriv_userdomain:process signal;
3361 ')
3362
3363 ########################################
3364 ## <summary>
3365 ##      Inherit the file descriptors from unprivileged user domains.
3366 ## </summary>
3367 ## <param name="domain">
3368 ##      <summary>
3369 ##      Domain allowed access.
3370 ##      </summary>
3371 ## </param>
3372 #
3373 interface(`userdom_use_unpriv_users_fds',`
3374         gen_require(`
3375                 attribute unpriv_userdomain;
3376         ')
3377
3378         allow $1 unpriv_userdomain:fd use;
3379 ')
3380
3381 ########################################
3382 ## <summary>
3383 ##      Do not audit attempts to inherit the file descriptors
3384 ##      from unprivileged user domains.
3385 ## </summary>
3386 ## <desc>
3387 ##      <p>
3388 ##      Do not audit attempts to inherit the file descriptors
3389 ##      from unprivileged user domains. This will supress
3390 ##      SELinux denial messages when the specified domain is denied
3391 ##      the permission to inherit these file descriptors.
3392 ##      </p>
3393 ## </desc>
3394 ## <param name="domain">
3395 ##      <summary>
3396 ##      Domain to not audit.
3397 ##      </summary>
3398 ## </param>
3399 ## <infoflow type="none"/>
3400 #
3401 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3402         gen_require(`
3403                 attribute unpriv_userdomain;
3404         ')
3405
3406         dontaudit $1 unpriv_userdomain:fd use;
3407 ')
3408
3409 ########################################
3410 ## <summary>
3411 ##      Do not audit attempts to use user ptys.
3412 ## </summary>
3413 ## <param name="domain">
3414 ##      <summary>
3415 ##      Domain to not audit.
3416 ##      </summary>
3417 ## </param>
3418 #
3419 interface(`userdom_dontaudit_use_user_ptys',`
3420         gen_require(`
3421                 type user_devpts_t;
3422         ')
3423
3424         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3425 ')
3426
3427 ########################################
3428 ## <summary>
3429 ##      Relabel files to unprivileged user pty types.
3430 ## </summary>
3431 ## <param name="domain">
3432 ##      <summary>
3433 ##      Domain allowed access.
3434 ##      </summary>
3435 ## </param>
3436 #
3437 interface(`userdom_relabelto_user_ptys',`
3438         gen_require(`
3439                 type user_devpts_t;
3440         ')
3441
3442         allow $1 user_devpts_t:chr_file relabelto;
3443 ')
3444
3445 ########################################
3446 ## <summary>
3447 ##      Do not audit attempts to relabel files from
3448 ##      user pty types.
3449 ## </summary>
3450 ## <param name="domain">
3451 ##      <summary>
3452 ##      Domain to not audit.
3453 ##      </summary>
3454 ## </param>
3455 #
3456 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3457         gen_require(`
3458                 type user_devpts_t;
3459         ')
3460
3461         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3462 ')
3463
3464 ########################################
3465 ## <summary>
3466 ##      Write all users files in /tmp
3467 ## </summary>
3468 ## <param name="domain">
3469 ##      <summary>
3470 ##      Domain allowed access.
3471 ##      </summary>
3472 ## </param>
3473 #
3474 interface(`userdom_write_user_tmp_files',`
3475         gen_require(`
3476                 type user_tmp_t;
3477         ')
3478
3479         write_files_pattern($1, user_tmp_t, user_tmp_t)
3480 ')
3481
3482 ########################################
3483 ## <summary>
3484 ##      Do not audit attempts to write users
3485 ##      temporary files.
3486 ## </summary>
3487 ## <param name="domain">
3488 ##      <summary>
3489 ##      Domain to not audit.
3490 ##      </summary>
3491 ## </param>
3492 #
3493 interface(`userdom_dontaudit_write_user_tmp_files',`
3494         gen_require(`
3495                 type user_tmp_t;
3496         ')
3497
3498         dontaudit $1 user_tmp_t:file write;
3499 ')
3500
3501 ########################################
3502 ## <summary>
3503 ##      Do not audit attempts to read/write users
3504 ##      temporary fifo files.
3505 ## </summary>
3506 ## <param name="domain">
3507 ##      <summary>
3508 ##      Domain to not audit.
3509 ##      </summary>
3510 ## </param>
3511 #
3512 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3513         gen_require(`
3514                 type user_tmp_t;
3515         ')
3516
3517         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3518 ')
3519
3520 ########################################
3521 ## <summary>
3522 ##      Do not audit attempts to use user ttys.
3523 ## </summary>
3524 ## <param name="domain">
3525 ##      <summary>
3526 ##      Domain to not audit.
3527 ##      </summary>
3528 ## </param>
3529 #
3530 interface(`userdom_dontaudit_use_user_ttys',`
3531         gen_require(`
3532                 type user_tty_device_t;
3533         ')
3534
3535         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3536 ')
3537
3538 ########################################
3539 ## <summary>
3540 ##      Read the process state of all user domains.
3541 ## </summary>
3542 ## <param name="domain">
3543 ##      <summary>
3544 ##      Domain allowed access.
3545 ##      </summary>
3546 ## </param>
3547 #
3548 interface(`userdom_read_all_users_state',`
3549         gen_require(`
3550                 attribute userdomain;
3551         ')
3552
3553         read_files_pattern($1, userdomain, userdomain)
3554         read_lnk_files_pattern($1,userdomain,userdomain)
3555         kernel_search_proc($1)
3556 ')
3557
3558 ########################################
3559 ## <summary>
3560 ##      Get the attributes of all user domains.
3561 ## </summary>
3562 ## <param name="domain">
3563 ##      <summary>
3564 ##      Domain allowed access.
3565 ##      </summary>
3566 ## </param>
3567 #
3568 interface(`userdom_getattr_all_users',`
3569         gen_require(`
3570                 attribute userdomain;
3571         ')
3572
3573         allow $1 userdomain:process getattr;
3574 ')
3575
3576 ########################################
3577 ## <summary>
3578 ##      Inherit the file descriptors from all user domains
3579 ## </summary>
3580 ## <param name="domain">
3581 ##      <summary>
3582 ##      Domain allowed access.
3583 ##      </summary>
3584 ## </param>
3585 #
3586 interface(`userdom_use_all_users_fds',`
3587         gen_require(`
3588                 attribute userdomain;
3589         ')
3590
3591         allow $1 userdomain:fd use;
3592 ')
3593
3594 ########################################
3595 ## <summary>
3596 ##      Do not audit attempts to inherit the file
3597 ##      descriptors from any user domains.
3598 ## </summary>
3599 ## <param name="domain">
3600 ##      <summary>
3601 ##      Domain to not audit.
3602 ##      </summary>
3603 ## </param>
3604 #
3605 interface(`userdom_dontaudit_use_all_users_fds',`
3606         gen_require(`
3607                 attribute userdomain;
3608         ')
3609
3610         dontaudit $1 userdomain:fd use;
3611 ')
3612
3613 ########################################
3614 ## <summary>
3615 ##      Send general signals to all user domains.
3616 ## </summary>
3617 ## <param name="domain">
3618 ##      <summary>
3619 ##      Domain allowed access.
3620 ##      </summary>
3621 ## </param>
3622 #
3623 interface(`userdom_signal_all_users',`
3624         gen_require(`
3625                 attribute userdomain;
3626         ')
3627
3628         allow $1 userdomain:process signal;
3629 ')
3630
3631 ########################################
3632 ## <summary>
3633 ##      Send kill signals to all user domains.
3634 ## </summary>
3635 ## <param name="domain">
3636 ##      <summary>
3637 ##      Domain allowed access.
3638 ##      </summary>
3639 ## </param>
3640 #
3641 interface(`userdom_kill_all_users',`
3642         gen_require(`
3643                 attribute userdomain;
3644         ')
3645
3646         allow $1 userdomain:process sigkill;
3647 ')
3648
3649 ########################################
3650 ## <summary>
3651 ##      Send a SIGCHLD signal to all user domains.
3652 ## </summary>
3653 ## <param name="domain">
3654 ##      <summary>
3655 ##      Domain allowed access.
3656 ##      </summary>
3657 ## </param>
3658 #
3659 interface(`userdom_sigchld_all_users',`
3660         gen_require(`
3661                 attribute userdomain;
3662         ')
3663
3664         allow $1 userdomain:process sigchld;
3665 ')
3666
3667 ########################################
3668 ## <summary>
3669 ##      Create keys for all user domains.
3670 ## </summary>
3671 ## <param name="domain">
3672 ##      <summary>
3673 ##      Domain allowed access.
3674 ##      </summary>
3675 ## </param>
3676 #
3677 interface(`userdom_create_all_users_keys',`
3678         gen_require(`
3679                 attribute userdomain;
3680         ')
3681
3682         allow $1 userdomain:key create;
3683 ')
3684
3685 ########################################
3686 ## <summary>
3687 ##      Send a dbus message to all user domains.
3688 ## </summary>
3689 ## <param name="domain">
3690 ##      <summary>
3691 ##      Domain allowed access.
3692 ##      </summary>
3693 ## </param>
3694 #
3695 interface(`userdom_dbus_send_all_users',`
3696         gen_require(`
3697                 attribute userdomain;
3698                 class dbus send_msg;
3699         ')
3700
3701         allow $1 userdomain:dbus send_msg;
3702 ')
3703
3704 ########################################
3705 ## <summary>
3706 ##      Allow apps to set rlimits on userdomain
3707 ## </summary>
3708 ## <param name="domain">
3709 ##      <summary>
3710 ##      Domain allowed access.
3711 ##      </summary>
3712 ## </param>
3713 #
3714 interface(`userdom_set_rlimitnh',`
3715         gen_require(`
3716                 attribute userdomain;
3717         ')
3718
3719         allow $1 userdomain:process rlimitinh;
3720 ')
3721
3722 ########################################
3723 ## <summary>
3724 ##      Define this type as a Allow apps to set rlimits on userdomain
3725 ## </summary>
3726 ## <param name="domain">
3727 ##      <summary>
3728 ##      Domain allowed access.
3729 ##      </summary>
3730 ## </param>
3731 ## <param name="userdomain_prefix">
3732 ##      <summary>
3733 ##      The prefix of the user domain (e.g., user
3734 ##      is the prefix for user_t).
3735 ## </summary>
3736 ## </param>
3737 ## <param name="domain">
3738 ##      <summary>
3739 ##      Domain allowed access.
3740 ##      </summary>
3741 ## </param>
3742 #
3743 template(`userdom_unpriv_usertype',`
3744         gen_require(`
3745                 attribute unpriv_userdomain, userdomain;
3746                 attribute $1_usertype;
3747         ')
3748         typeattribute $2  $1_usertype;
3749         typeattribute $2  unpriv_userdomain;
3750         typeattribute $2  userdomain;
3751
3752         ubac_constrained($2)
3753 ')
3754
3755 ########################################
3756 ## <summary>
3757 ##      Connect to users over an unix stream socket.
3758 ## </summary>
3759 ## <param name="domain">
3760 ##      <summary>
3761 ##      Domain allowed access.
3762 ##      </summary>
3763 ## </param>
3764 #
3765 interface(`userdom_stream_connect',`
3766         gen_require(`
3767                 type user_tmp_t;
3768                 attribute userdomain;
3769         ')
3770
3771         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3772 ')
3773
3774 ########################################
3775 ## <summary>
3776 ##      Ptrace user domains.
3777 ## </summary>
3778 ## <param name="domain">
3779 ##      <summary>
3780 ##      Domain allowed access.
3781 ##      </summary>
3782 ## </param>
3783 #
3784 interface(`userdom_ptrace_all_users',`
3785         gen_require(`
3786                 attribute userdomain;
3787         ')
3788
3789         allow $1 userdomain:process ptrace;
3790 ')
3791
3792 ########################################
3793 ## <summary>
3794 ##      dontaudit Search /root
3795 ## </summary>
3796 ## <param name="domain">
3797 ##      <summary>
3798 ##      Domain to not audit.
3799 ##      </summary>
3800 ## </param>
3801 #
3802 interface(`userdom_dontaudit_search_admin_dir',`
3803         gen_require(`
3804                 type admin_home_t;
3805         ')
3806
3807         dontaudit $1 admin_home_t:dir search_dir_perms;
3808 ')
3809
3810 ########################################
3811 ## <summary>
3812 ##      dontaudit list /root
3813 ## </summary>
3814 ## <param name="domain">
3815 ##      <summary>
3816 ##      Domain to not audit.
3817 ##      </summary>
3818 ## </param>
3819 #
3820 interface(`userdom_dontaudit_list_admin_dir',`
3821         gen_require(`
3822                 type admin_home_t;
3823         ')
3824
3825         dontaudit $1 admin_home_t:dir list_dir_perms;
3826 ')
3827
3828 ########################################
3829 ## <summary>
3830 ##      Allow domain to  list /root
3831 ## </summary>
3832 ## <param name="domain">
3833 ##      <summary>
3834 ##      Domain allowed access.
3835 ##      </summary>
3836 ## </param>
3837 #
3838 interface(`userdom_list_admin_dir',`
3839         gen_require(`
3840                 type admin_home_t;
3841         ')
3842
3843         allow $1 admin_home_t:dir list_dir_perms;
3844 ')
3845
3846 ########################################
3847 ## <summary>
3848 ##      Allow Search /root
3849 ## </summary>
3850 ## <param name="domain">
3851 ##      <summary>
3852 ##      Domain allowed access.
3853 ##      </summary>
3854 ## </param>
3855 #
3856 interface(`userdom_search_admin_dir',`
3857         gen_require(`
3858                 type admin_home_t;
3859         ')
3860
3861         allow $1 admin_home_t:dir search_dir_perms;
3862 ')
3863
3864 ########################################
3865 ## <summary>
3866 ##      RW unpriviledged user SysV sempaphores.
3867 ## </summary>
3868 ## <param name="domain">
3869 ##      <summary>
3870 ##      Domain allowed access.
3871 ##      </summary>
3872 ## </param>
3873 #
3874 interface(`userdom_rw_semaphores',`
3875         gen_require(`
3876                 attribute unpriv_userdomain;
3877         ')
3878
3879         allow $1 unpriv_userdomain:sem rw_sem_perms;
3880 ')
3881
3882 ########################################
3883 ## <summary>
3884 ##      Send a message to unpriv users over a unix domain
3885 ##      datagram socket.
3886 ## </summary>
3887 ## <param name="domain">
3888 ##      <summary>
3889 ##      Domain allowed access.
3890 ##      </summary>
3891 ## </param>
3892 #
3893 interface(`userdom_dgram_send',`
3894         gen_require(`
3895                 attribute unpriv_userdomain;
3896         ')
3897
3898         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3899 ')
3900
3901 ######################################
3902 ## <summary>
3903 ##      Send a message to users over a unix domain
3904 ##      datagram socket.
3905 ## </summary>
3906 ## <param name="domain">
3907 ##      <summary>
3908 ##      Domain allowed access.
3909 ##      </summary>
3910 ## </param>
3911 #
3912 interface(`userdom_users_dgram_send',`
3913         gen_require(`
3914                  attribute userdomain;
3915       ')
3916
3917        allow $1 userdomain:unix_dgram_socket sendto;
3918 ')
3919
3920 #######################################
3921 ## <summary>
3922 ##      Allow execmod on files in homedirectory
3923 ## </summary>
3924 ## <param name="domain">
3925 ##      <summary>
3926 ##      Domain allowed access.
3927 ##      </summary>
3928 ## </param>
3929 ## <rolebase/>
3930 #
3931 interface(`userdom_execmod_user_home_files',`
3932         gen_require(`
3933                 type user_home_type;
3934         ')
3935
3936         allow $1 user_home_type:file execmod;
3937 ')
3938
3939 ########################################
3940 ## <summary>
3941 ##      Read admin home files.
3942 ## </summary>
3943 ## <param name="domain">
3944 ##      <summary>
3945 ##      Domain allowed access.
3946 ##      </summary>
3947 ## </param>
3948 ## <rolecap/>
3949 #
3950 interface(`userdom_read_admin_home_files',`
3951         gen_require(`
3952                 type admin_home_t;
3953         ')
3954
3955         read_files_pattern($1, admin_home_t, admin_home_t)
3956 ')
3957
3958 ########################################
3959 ## <summary>
3960 ##      Execute admin home files.
3961 ## </summary>
3962 ## <param name="domain">
3963 ##      <summary>
3964 ##      Domain allowed access.
3965 ##      </summary>
3966 ## </param>
3967 ## <rolecap/>
3968 #
3969 interface(`userdom_exec_admin_home_files',`
3970         gen_require(`
3971                 type admin_home_t;
3972         ')
3973
3974         exec_files_pattern($1, admin_home_t, admin_home_t)
3975 ')
3976
3977 ########################################
3978 ## <summary>
3979 ##      Append files inherited
3980 ##      in the /root directory.
3981 ## </summary>
3982 ## <param name="domain">
3983 ##      <summary>
3984 ##      Domain allowed access.
3985 ##      </summary>
3986 ## </param>
3987 #
3988 interface(`userdom_inherit_append_admin_home_files',`
3989         gen_require(`
3990                 type admin_home_t;
3991         ')
3992
3993         allow $1 admin_home_t:file { getattr append };
3994 ')
3995
3996
3997 #######################################
3998 ## <summary>
3999 ##      Manage all files/directories in the homedir
4000 ## </summary>
4001 ## <param name="userdomain">
4002 ##      <summary>
4003 ##      The user domain
4004 ##      </summary>
4005 ## </param>
4006 ## <rolebase/>
4007 #
4008 interface(`userdom_manage_user_home_content',`
4009         gen_require(`
4010                 type user_home_dir_t, user_home_t;
4011                 attribute user_home_type;
4012         ')
4013
4014         files_list_home($1)
4015         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4016         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4017         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4018         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4019         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4020         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4021
4022 ')
4023
4024
4025 ########################################
4026 ## <summary>
4027 ##      Create objects in a user home directory
4028 ##      with an automatic type transition to
4029 ##      the user home file type.
4030 ## </summary>
4031 ## <param name="domain">
4032 ##      <summary>
4033 ##      Domain allowed access.
4034 ##      </summary>
4035 ## </param>
4036 ## <param name="object_class">
4037 ##      <summary>
4038 ##      The class of the object to be created.
4039 ##      </summary>
4040 ## </param>
4041 #
4042 interface(`userdom_user_home_dir_filetrans_pattern',`
4043         gen_require(`
4044                 type user_home_dir_t, user_home_t;
4045         ')
4046
4047         type_transition $1 user_home_dir_t:$2 user_home_t;
4048 ')
4049
4050 ########################################
4051 ## <summary>
4052 ##      Create objects in the /root directory
4053 ##      with an automatic type transition to
4054 ##      a specified private type.
4055 ## </summary>
4056 ## <param name="domain">
4057 ##      <summary>
4058 ##      Domain allowed access.
4059 ##      </summary>
4060 ## </param>
4061 ## <param name="private_type">
4062 ##      <summary>
4063 ##      The type of the object to create.
4064 ##      </summary>
4065 ## </param>
4066 ## <param name="object_class">
4067 ##      <summary>
4068 ##      The class of the object to be created.
4069 ##      </summary>
4070 ## </param>
4071 #
4072 interface(`userdom_admin_home_dir_filetrans',`
4073         gen_require(`
4074                 type admin_home_t;
4075         ')
4076
4077         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4078 ')
4079
4080 ########################################
4081 ## <summary>
4082 ##      Send signull to unprivileged user domains.
4083 ## </summary>
4084 ## <param name="domain">
4085 ##      <summary>
4086 ##      Domain allowed access.
4087 ##      </summary>
4088 ## </param>
4089 #
4090 interface(`userdom_signull_unpriv_users',`
4091         gen_require(`
4092                 attribute unpriv_userdomain;
4093         ')
4094
4095         allow $1 unpriv_userdomain:process signull;
4096 ')
4097
4098 ########################################
4099 ## <summary>
4100 ##      Write all users files in /tmp
4101 ## </summary>
4102 ## <param name="domain">
4103 ##      <summary>
4104 ##      Domain allowed access.
4105 ##      </summary>
4106 ## </param>
4107 #
4108 interface(`userdom_write_user_tmp_dirs',`
4109         gen_require(`
4110                 type user_tmp_t;
4111         ')
4112
4113         write_files_pattern($1, user_tmp_t, user_tmp_t)
4114 ')
4115
4116 ########################################
4117 ## <summary>
4118 ##      Manage keys for all user domains.
4119 ## </summary>
4120 ## <param name="domain">
4121 ##      <summary>
4122 ##      Domain allowed access.
4123 ##      </summary>
4124 ## </param>
4125 #
4126 interface(`userdom_manage_all_users_keys',`
4127         gen_require(`
4128                 attribute userdomain;
4129         ')
4130
4131         allow $1 userdomain:key manage_key_perms;
4132 ')
4133
4134
4135 ########################################
4136 ## <summary>
4137 ##      Do not audit attempts to read and write
4138 ##      unserdomain stream.
4139 ## </summary>
4140 ## <param name="domain">
4141 ##      <summary>
4142 ##      Domain to not audit.
4143 ##      </summary>
4144 ## </param>
4145 #
4146 interface(`userdom_dontaudit_rw_stream',`
4147         gen_require(`
4148                 attribute userdomain;
4149         ')
4150
4151         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4152 ')
4153
4154 ########################################
4155 ## <summary>
4156 ##      Do not audit attempts to read and write
4157 ##      unserdomain datagram socket.
4158 ## </summary>
4159 ## <param name="domain">
4160 ##      <summary>
4161 ##      Domain to not audit.
4162 ##      </summary>
4163 ## </param>
4164 #
4165 interface(`userdom_dontaudit_rw_dgram_socket',`
4166         gen_require(`
4167                 attribute userdomain;
4168         ')
4169
4170         dontaudit $1 userdomain:unix_dgram_socket { read write };
4171 ')
4172
4173 ########################################
4174 ## <summary>
4175 ##      Append files
4176 ##      in a user home subdirectory.
4177 ## </summary>
4178 ## <param name="domain">
4179 ##      <summary>
4180 ##      Domain allowed access.
4181 ##      </summary>
4182 ## </param>
4183 #
4184 interface(`userdom_append_user_home_content_files',`
4185         gen_require(`
4186                 type user_home_dir_t, user_home_t;
4187         ')
4188
4189         append_files_pattern($1, user_home_t, user_home_t)
4190         allow $1 user_home_dir_t:dir search_dir_perms;
4191         files_search_home($1)
4192 ')
4193
4194 ########################################
4195 ## <summary>
4196 ##      Read files inherited
4197 ##      in a user home subdirectory.
4198 ## </summary>
4199 ## <param name="domain">
4200 ##      <summary>
4201 ##      Domain allowed access.
4202 ##      </summary>
4203 ## </param>
4204 #
4205 interface(`userdom_read_inherited_user_home_content_files',`
4206         gen_require(`
4207                 attribute user_home_type;
4208         ')
4209
4210         allow $1 user_home_type:file { getattr read };
4211 ')
4212
4213 ########################################
4214 ## <summary>
4215 ##      Append files inherited
4216 ##      in a user home subdirectory.
4217 ## </summary>
4218 ## <param name="domain">
4219 ##      <summary>
4220 ##      Domain allowed access.
4221 ##      </summary>
4222 ## </param>
4223 #
4224 interface(`userdom_inherit_append_user_home_content_files',`
4225         gen_require(`
4226                 type user_home_t;
4227         ')
4228
4229         allow $1 user_home_t:file { getattr append };
4230 ')
4231
4232 ########################################
4233 ## <summary>
4234 ##      Append files inherited
4235 ##      in a user tmp files.
4236 ## </summary>
4237 ## <param name="domain">
4238 ##      <summary>
4239 ##      Domain allowed access.
4240 ##      </summary>
4241 ## </param>
4242 #
4243 interface(`userdom_inherit_append_user_tmp_files',`
4244         gen_require(`
4245                 type user_tmp_t;
4246         ')
4247
4248         allow $1 user_tmp_t:file { getattr append };
4249 ')
4250
4251 ######################################
4252 ## <summary>
4253 ##      Read audio files in the users homedir.
4254 ## </summary>
4255 ## <param name="domain">
4256 ##      <summary>
4257 ##      Domain allowed access.
4258 ##      </summary>
4259 ## </param>
4260 ## <rolecap/>
4261 #
4262 interface(`userdom_read_home_audio_files',`
4263         gen_require(`
4264                 type audio_home_t;
4265         ')
4266
4267         userdom_search_user_home_dirs($1)
4268         allow $1 audio_home_t:dir list_dir_perms;
4269         read_files_pattern($1, audio_home_t, audio_home_t)
4270         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4271 ')
4272
4273 ########################################
4274 ## <summary>
4275 ##      Do not audit attempts to write all user home content files.
4276 ## </summary>
4277 ## <param name="domain">
4278 ##      <summary>
4279 ##      Domain to not audit.
4280 ##      </summary>
4281 ## </param>
4282 #
4283 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4284         gen_require(`
4285                 attribute user_home_type;
4286         ')
4287
4288         dontaudit $1 user_home_type:file write_file_perms;
4289 ')
4290
4291 ########################################
4292 ## <summary>
4293 ##      Do not audit attempts to write all user tmp content files.
4294 ## </summary>
4295 ## <param name="domain">
4296 ##      <summary>
4297 ##      Domain to not audit.
4298 ##      </summary>
4299 ## </param>
4300 #
4301 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4302         gen_require(`
4303                 attribute user_tmp_type;
4304         ')
4305
4306         dontaudit $1 user_tmp_type:file write_file_perms;
4307 ')
4308
4309 ########################################
4310 ## <summary>
4311 ##      Manage all user temporary content.
4312 ## </summary>
4313 ## <param name="domain">
4314 ##      <summary>
4315 ##      Domain allowed access.
4316 ##      </summary>
4317 ## </param>
4318 #
4319 interface(`userdom_manage_all_user_tmp_content',`
4320         gen_require(`
4321                 attribute user_tmp_type;
4322         ')
4323
4324         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4325         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4326         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4327         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4328         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4329         files_search_tmp($1)
4330 ')
4331
4332 ########################################
4333 ## <summary>
4334 ##      List all user temporary content.
4335 ## </summary>
4336 ## <param name="domain">
4337 ##      <summary>
4338 ##      Domain allowed access.
4339 ##      </summary>
4340 ## </param>
4341 #
4342 interface(`userdom_list_all_user_tmp_content',`
4343         gen_require(`
4344                 attribute user_tmp_type;
4345         ')
4346
4347         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4348         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4349         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4350         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4351         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4352         files_search_var($1)
4353         files_search_tmp($1)
4354 ')
4355
4356 ########################################
4357 ## <summary>
4358 ##      Manage all user tmpfs content.
4359 ## </summary>
4360 ## <param name="domain">
4361 ##      <summary>
4362 ##      Domain allowed access.
4363 ##      </summary>
4364 ## </param>
4365 #
4366 interface(`userdom_manage_all_user_tmpfs_content',`
4367         gen_require(`
4368                 attribute user_tmpfs_type;
4369         ')
4370
4371         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4372         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4373         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4374         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4375         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4376         fs_search_tmpfs($1)
4377 ')
4378
4379 ########################################
4380 ## <summary>
4381 ##      Delete all user temporary content.
4382 ## </summary>
4383 ## <param name="domain">
4384 ##      <summary>
4385 ##      Domain allowed access.
4386 ##      </summary>
4387 ## </param>
4388 #
4389 interface(`userdom_delete_all_user_tmp_content',`
4390         gen_require(`
4391                 attribute user_tmp_type;
4392         ')
4393
4394         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4395         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4396         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4397         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4398         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4399         # /var/tmp
4400         files_search_var($1)
4401         files_delete_tmp_dir_entry($1)
4402 ')
4403
4404 ########################################
4405 ## <summary>
4406 ##      Read system SSL certificates in the users homedir.
4407 ## </summary>
4408 ## <param name="domain">
4409 ##      <summary>
4410 ##      Domain allowed access.
4411 ##      </summary>
4412 ## </param>
4413 #
4414 interface(`userdom_read_home_certs',`
4415         gen_require(`
4416                 type home_cert_t;
4417         ')
4418
4419         userdom_search_user_home_content($1)
4420         allow $1 home_cert_t:dir list_dir_perms;
4421         read_files_pattern($1, home_cert_t, home_cert_t)
4422         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4423 ')
4424
4425 #######################################
4426 ## <summary>
4427 ##  Dontaudit Write system SSL certificates in the users homedir.
4428 ## </summary>
4429 ## <param name="domain">
4430 ##  <summary>
4431 ##      Domain to not audit.
4432 ##  </summary>
4433 ## </param>
4434 #
4435 interface(`userdom_dontaudit_write_home_certs',`
4436     gen_require(`
4437         type home_cert_t;
4438     ')
4439
4440     dontaudit $1 home_cert_t:file write;
4441 ')
4442
4443 ########################################
4444 ## <summary>
4445 ##      dontaudit Search getatrr /root files
4446 ## </summary>
4447 ## <param name="domain">
4448 ##      <summary>
4449 ##      Domain to not audit.
4450 ##      </summary>
4451 ## </param>
4452 #
4453 interface(`userdom_dontaudit_getattr_admin_home_files',`
4454         gen_require(`
4455                 type admin_home_t;
4456         ')
4457
4458         dontaudit $1 admin_home_t:file getattr;
4459 ')
4460
4461 ########################################
4462 ## <summary>
4463 ##      dontaudit read /root lnk files
4464 ## </summary>
4465 ## <param name="domain">
4466 ##      <summary>
4467 ##      Domain to not audit.
4468 ##      </summary>
4469 ## </param>
4470 #
4471 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4472         gen_require(`
4473                 type admin_home_t;
4474         ')
4475
4476         dontaudit $1 admin_home_t:lnk_file read;
4477 ')
4478
4479 ########################################
4480 ## <summary>
4481 ##      dontaudit read /root files
4482 ## </summary>
4483 ## <param name="domain">
4484 ##      <summary>
4485 ##      Domain to not audit.
4486 ##      </summary>
4487 ## </param>
4488 #
4489 interface(`userdom_dontaudit_read_admin_home_files',`
4490         gen_require(`
4491                 type admin_home_t;
4492         ')
4493
4494         dontaudit $1 admin_home_t:file read_file_perms;
4495 ')
4496
4497 ########################################
4498 ## <summary>
4499 ##      Create, read, write, and delete user
4500 ##      temporary chr files.
4501 ## </summary>
4502 ## <param name="domain">
4503 ##      <summary>
4504 ##      Domain allowed access.
4505 ##      </summary>
4506 ## </param>
4507 #
4508 interface(`userdom_manage_user_tmp_chr_files',`
4509         gen_require(`
4510                 type user_tmp_t;
4511         ')
4512
4513         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4514         files_search_tmp($1)
4515 ')
4516
4517 ########################################
4518 ## <summary>
4519 ##      Create, read, write, and delete user
4520 ##      temporary blk files.
4521 ## </summary>
4522 ## <param name="domain">
4523 ##      <summary>
4524 ##      Domain allowed access.
4525 ##      </summary>
4526 ## </param>
4527 #
4528 interface(`userdom_manage_user_tmp_blk_files',`
4529         gen_require(`
4530                 type user_tmp_t;
4531         ')
4532
4533         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4534         files_search_tmp($1)
4535 ')
4536
4537 ########################################
4538 ## <summary>
4539 ##      Dontaudit attempt to set attributes on  user temporary directories.
4540 ## </summary>
4541 ## <param name="domain">
4542 ##      <summary>
4543 ##      Domain to not audit.
4544 ##      </summary>
4545 ## </param>
4546 #
4547 interface(`userdom_dontaudit_setattr_user_tmp',`
4548         gen_require(`
4549                 type user_tmp_t;
4550         ')
4551
4552         dontaudit $1 user_tmp_t:dir setattr;
4553 ')
4554
4555 ########################################
4556 ## <summary>
4557 ##      Write all inherited users files in /tmp
4558 ## </summary>
4559 ## <param name="domain">
4560 ##      <summary>
4561 ##      Domain allowed access.
4562 ##      </summary>
4563 ## </param>
4564 #
4565 interface(`userdom_write_inherited_user_tmp_files',`
4566         gen_require(`
4567                 type user_tmp_t;
4568         ')
4569
4570         allow $1 user_tmp_t:file write;
4571 ')
4572
4573 ########################################
4574 ## <summary>
4575 ##      Delete all users files in /tmp
4576 ## </summary>
4577 ## <param name="domain">
4578 ##      <summary>
4579 ##      Domain allowed access.
4580 ##      </summary>
4581 ## </param>
4582 #
4583 interface(`userdom_delete_user_tmp_files',`
4584         gen_require(`
4585                 type user_tmp_t;
4586         ')
4587
4588         allow $1 user_tmp_t:file delete_file_perms;
4589 ')
4590
4591 ########################################
4592 ## <summary>
4593 ##      Delete user tmpfs files.
4594 ## </summary>
4595 ## <param name="domain">
4596 ##      <summary>
4597 ##      Domain allowed access.
4598 ##      </summary>
4599 ## </param>
4600 #
4601 interface(`userdom_delete_user_tmpfs_files',`
4602         gen_require(`
4603                 type user_tmpfs_t;
4604         ')
4605
4606         allow $1 user_tmpfs_t:file delete_file_perms;
4607 ')
4608
4609 ########################################
4610 ## <summary>
4611 ##      Read/Write unpriviledged user SysV shared
4612 ##      memory segments.
4613 ## </summary>
4614 ## <param name="domain">
4615 ##      <summary>
4616 ##      Domain allowed access.
4617 ##      </summary>
4618 ## </param>
4619 #
4620 interface(`userdom_rw_unpriv_user_shared_mem',`
4621         gen_require(`
4622                 attribute unpriv_userdomain;
4623         ')
4624
4625         allow $1 unpriv_userdomain:shm rw_shm_perms;
4626 ')
4627
4628 ########################################
4629 ## <summary>
4630 ##      Do not audit attempts to search user
4631 ##      temporary directories.
4632 ## </summary>
4633 ## <param name="domain">
4634 ##      <summary>
4635 ##      Domain to not audit.
4636 ##      </summary>
4637 ## </param>
4638 #
4639 interface(`userdom_dontaudit_search_user_tmp',`
4640         gen_require(`
4641                 type user_tmp_t;
4642         ')
4643
4644         dontaudit $1 user_tmp_t:dir search_dir_perms;
4645 ')
4646
4647 ########################################
4648 ## <summary>
4649 ##      Execute a file in a user home directory
4650 ##      in the specified domain.
4651 ## </summary>
4652 ## <desc>
4653 ##      <p>
4654 ##      Execute a file in a user home directory
4655 ##      in the specified domain.
4656 ##      </p>
4657 ##      <p>
4658 ##      No interprocess communication (signals, pipes,
4659 ##      etc.) is provided by this interface since
4660 ##      the domains are not owned by this module.
4661 ##      </p>
4662 ## </desc>
4663 ## <param name="domain">
4664 ##      <summary>
4665 ##      Domain allowed access.
4666 ##      </summary>
4667 ## </param>
4668 ## <param name="target_domain">
4669 ##      <summary>
4670 ##      The type of the new process.
4671 ##      </summary>
4672 ## </param>
4673 #
4674 interface(`userdom_domtrans_user_home',`
4675         gen_require(`
4676                 type user_home_t;
4677         ')
4678
4679         read_lnk_files_pattern($1, user_home_t, user_home_t)
4680         domain_transition_pattern($1, user_home_t, $2)
4681         type_transition $1 user_home_t:process $2;
4682 ')
4683
4684 ########################################
4685 ## <summary>
4686 ##      Execute a file in a user tmp directory
4687 ##      in the specified domain.
4688 ## </summary>
4689 ## <desc>
4690 ##      <p>
4691 ##      Execute a file in a user tmp directory
4692 ##      in the specified domain.
4693 ##      </p>
4694 ##      <p>
4695 ##      No interprocess communication (signals, pipes,
4696 ##      etc.) is provided by this interface since
4697 ##      the domains are not owned by this module.
4698 ##      </p>
4699 ## </desc>
4700 ## <param name="domain">
4701 ##      <summary>
4702 ##      Domain allowed access.
4703 ##      </summary>
4704 ## </param>
4705 ## <param name="target_domain">
4706 ##      <summary>
4707 ##      The type of the new process.
4708 ##      </summary>
4709 ## </param>
4710 #
4711 interface(`userdom_domtrans_user_tmp',`
4712         gen_require(`
4713                 type user_tmp_t;
4714         ')
4715
4716         files_search_tmp($1)
4717         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4718         domain_transition_pattern($1, user_tmp_t, $2)
4719         type_transition $1 user_tmp_t:process $2;
4720 ')
4721
4722 ########################################
4723 ## <summary>
4724 ##      Do not audit attempts to read all user home content files.
4725 ## </summary>
4726 ## <param name="domain">
4727 ##      <summary>
4728 ##      Domain to not audit.
4729 ##      </summary>
4730 ## </param>
4731 #
4732 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4733         gen_require(`
4734                 attribute user_home_type;
4735         ')
4736
4737         dontaudit $1 user_home_type:file read_file_perms;
4738 ')
4739
4740 ########################################
4741 ## <summary>
4742 ##      Do not audit attempts to read all user tmp content files.
4743 ## </summary>
4744 ## <param name="domain">
4745 ##      <summary>
4746 ##      Domain to not audit.
4747 ##      </summary>
4748 ## </param>
4749 #
4750 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4751         gen_require(`
4752                 attribute user_tmp_type;
4753         ')
4754
4755         dontaudit $1 user_tmp_type:file read_file_perms;
4756 ')
4757