policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 tunable_policy(`allow_user_mysql_connect',`
 793                         mysql_stream_connect($1_t)
 794                 ')
 795         ')
 796
 797         optional_policy(`
 798                 oident_manage_user_content($1_t)
 799                 oident_relabel_user_content($1_t)
 800         ')
 801
 802         optional_policy(`
 803                 # to allow monitoring of pcmcia status
 804                 pcmcia_read_pid($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 pcscd_read_pub_files($1_usertype)
 809                 pcscd_stream_connect($1_usertype)
 810         ')
 811
 812         optional_policy(`
 813                 tunable_policy(`allow_user_postgresql_connect',`
 814                         postgresql_stream_connect($1_usertype)
 815                         postgresql_tcp_connect($1_usertype)
 816                 ')
 817         ')
 818
 819         optional_policy(`
 820                 resmgr_stream_connect($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 rpc_dontaudit_getattr_exports($1_usertype)
 825                 rpc_manage_nfs_rw_content($1_usertype)
 826         ')
 827
 828         optional_policy(`
 829                 rpcbind_stream_connect($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 samba_stream_connect_winbind($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 sandbox_transition($1_usertype, $1_r)
 838         ')
 839
 840         optional_policy(`
 841                 seunshare_role_template($1, $1_r, $1_t)
 842         ')
 843
 844         optional_policy(`
 845                 slrnpull_search_spool($1_usertype)
 846         ')
 847
 848         optional_policy(`
 849                 thumb_role($1_r, $1_usertype)
 850         ')
 851 ')
 852
 853 #######################################
 854 ## <summary>
 855 ##      The template for creating a login user.
 856 ## </summary>
 857 ## <desc>
 858 ##      <p>
 859 ##      This template creates a user domain, types, and
 860 ##      rules for the user's tty, pty, home directories,
 861 ##      tmp, and tmpfs files.
 862 ##      </p>
 863 ## </desc>
 864 ## <param name="userdomain_prefix">
 865 ##      <summary>
 866 ##      The prefix of the user domain (e.g., user
 867 ##      is the prefix for user_t).
 868 ##      </summary>
 869 ## </param>
 870 #
 871 template(`userdom_login_user_template', `
 872         gen_require(`
 873                 class context contains;
 874         ')
 875
 876         userdom_base_user_template($1)
 877
 878         userdom_manage_home_role($1_r, $1_usertype)
 879
 880         userdom_manage_tmp_role($1_r, $1_usertype)
 881         userdom_manage_tmpfs_role($1_r, $1_usertype)
 882
 883         ifelse(`$1',`unconfined',`',`
 884                 gen_tunable(allow_$1_exec_content, true)
 885
 886                 tunable_policy(`allow_$1_exec_content',`
 887                         userdom_exec_user_tmp_files($1_usertype)
 888                         userdom_exec_user_home_content_files($1_usertype)
 889                 ')
 890                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 891                         fs_exec_nfs_files($1_usertype)
 892                 ')
 893
 894                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 895                         fs_exec_cifs_files($1_usertype)
 896                 ')
 897         ')
 898
 899         userdom_change_password_template($1)
 900
 901         ##############################
 902         #
 903         # User domain Local policy
 904         #
 905
 906         allow $1_t self:capability { setgid chown fowner };
 907         dontaudit $1_t self:capability { sys_nice fsetid };
 908
 909         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 910         dontaudit $1_t self:process setrlimit;
 911         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 912
 913         allow $1_t self:context contains;
 914
 915         kernel_dontaudit_read_system_state($1_usertype)
 916         kernel_dontaudit_list_all_proc($1_usertype)
 917
 918         dev_read_sysfs($1_usertype)
 919         dev_read_urand($1_usertype)
 920
 921         domain_use_interactive_fds($1_usertype)
 922         # Command completion can fire hundreds of denials
 923         domain_dontaudit_exec_all_entry_files($1_usertype)
 924
 925         files_dontaudit_list_default($1_usertype)
 926         files_dontaudit_read_default_files($1_usertype)
 927         # Stat lost+found.
 928         files_getattr_lost_found_dirs($1_usertype)
 929
 930         fs_get_all_fs_quotas($1_usertype)
 931         fs_getattr_all_fs($1_usertype)
 932         fs_search_all($1_usertype)
 933         fs_list_inotifyfs($1_usertype)
 934         fs_rw_anon_inodefs_files($1_usertype)
 935
 936         auth_dontaudit_write_login_records($1_t)
 937         auth_rw_cache($1_t)
 938
 939         application_exec_all($1_t)
 940         # The library functions always try to open read-write first,
 941         # then fall back to read-only if it fails.
 942         init_dontaudit_rw_utmp($1_t)
 943
 944         # Stop warnings about access to /dev/console
 945         init_dontaudit_use_fds($1_usertype)
 946         init_dontaudit_use_script_fds($1_usertype)
 947
 948         libs_exec_lib_files($1_usertype)
 949
 950         logging_dontaudit_getattr_all_logs($1_usertype)
 951
 952         # for running TeX programs
 953         miscfiles_read_tetex_data($1_usertype)
 954         miscfiles_exec_tetex_data($1_usertype)
 955
 956         seutil_read_config($1_usertype)
 957
 958         optional_policy(`
 959                 cups_read_config($1_usertype)
 960                 cups_stream_connect($1_usertype)
 961                 cups_stream_connect_ptal($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 kerberos_use($1_usertype)
 966                 kerberos_filetrans_home_content($1_usertype)
 967         ')
 968
 969         optional_policy(`
 970                 mta_dontaudit_read_spool_symlinks($1_usertype)
 971         ')
 972
 973         optional_policy(`
 974                 quota_dontaudit_getattr_db($1_usertype)
 975         ')
 976
 977         optional_policy(`
 978                 rpm_read_db($1_usertype)
 979                 rpm_dontaudit_manage_db($1_usertype)
 980                 rpm_read_cache($1_usertype)
 981         ')
 982
 983         optional_policy(`
 984                 oddjob_run_mkhomedir($1_t, $1_r)
 985         ')
 986 ')
 987
 988 #######################################
 989 ## <summary>
 990 ##      The template for creating a unprivileged login user.
 991 ## </summary>
 992 ## <desc>
 993 ##      <p>
 994 ##      This template creates a user domain, types, and
 995 ##      rules for the user's tty, pty, home directories,
 996 ##      tmp, and tmpfs files.
 997 ##      </p>
 998 ## </desc>
 999 ## <param name="userdomain_prefix">
1000 ##      <summary>
1001 ##      The prefix of the user domain (e.g., user
1002 ##      is the prefix for user_t).
1003 ##      </summary>
1004 ## </param>
1005 #
1006 template(`userdom_restricted_user_template',`
1007         gen_require(`
1008                 attribute unpriv_userdomain;
1009         ')
1010
1011         userdom_login_user_template($1)
1012
1013         typeattribute $1_t unpriv_userdomain;
1014         domain_interactive_fd($1_t)
1015
1016         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1017         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1018
1019         ##############################
1020         #
1021         # Local policy
1022         #
1023
1024         optional_policy(`
1025                 loadkeys_run($1_t, $1_r)
1026         ')
1027 ')
1028
1029 #######################################
1030 ## <summary>
1031 ##      The template for creating a unprivileged xwindows login user.
1032 ## </summary>
1033 ## <desc>
1034 ##      <p>
1035 ##      The template for creating a unprivileged xwindows login user.
1036 ##      </p>
1037 ##      <p>
1038 ##      This template creates a user domain, types, and
1039 ##      rules for the user's tty, pty, home directories,
1040 ##      tmp, and tmpfs files.
1041 ##      </p>
1042 ## </desc>
1043 ## <param name="userdomain_prefix">
1044 ##      <summary>
1045 ##      The prefix of the user domain (e.g., user
1046 ##      is the prefix for user_t).
1047 ##      </summary>
1048 ## </param>
1049 #
1050 template(`userdom_restricted_xwindows_user_template',`
1051
1052         userdom_restricted_user_template($1)
1053
1054         ##############################
1055         #
1056         # Local policy
1057         #
1058
1059         auth_role($1_r, $1_t)
1060         auth_search_pam_console_data($1_usertype)
1061         auth_dontaudit_read_login_records($1_usertype)
1062
1063         dev_read_sound($1_usertype)
1064         dev_write_sound($1_usertype)
1065         # gnome keyring wants to read this.
1066         dev_dontaudit_read_rand($1_usertype)
1067         # temporarily allow since openoffice requires this
1068         dev_read_rand($1_usertype)
1069
1070         dev_read_video_dev($1_usertype)
1071         dev_write_video_dev($1_usertype)
1072         dev_rw_wireless($1_usertype)
1073
1074         libs_dontaudit_setattr_lib_files($1_usertype)
1075
1076         tunable_policy(`user_rw_noexattrfile',`
1077                 dev_rw_usbfs($1_t)
1078                 dev_rw_generic_usb_dev($1_usertype)
1079
1080                 fs_manage_noxattr_fs_files($1_usertype)
1081                 fs_manage_noxattr_fs_dirs($1_usertype)
1082                 fs_manage_dos_dirs($1_usertype)
1083                 fs_manage_dos_files($1_usertype)
1084                 storage_raw_read_removable_device($1_usertype)
1085                 storage_raw_write_removable_device($1_usertype)
1086         ')
1087
1088         logging_send_syslog_msg($1_usertype)
1089         logging_dontaudit_send_audit_msgs($1_t)
1090
1091         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1092         logging_send_audit_msgs($1_t)
1093         selinux_get_enforce_mode($1_t)
1094         seutil_exec_restorecond($1_t)
1095         seutil_read_file_contexts($1_t)
1096         seutil_read_default_contexts($1_t)
1097
1098         xserver_restricted_role($1_r, $1_t)
1099
1100         optional_policy(`
1101                 alsa_read_rw_config($1_usertype)
1102         ')
1103
1104          # cjp: needed by KDE apps
1105          # bug: #682499
1106          optional_policy(`
1107                 gnome_read_usr_config($1_usertype)
1108                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1109                 # cjp: telepathy F15 bugs
1110                 telepathy_role($1_r, $1_t, $1)
1111         ')
1112
1113         optional_policy(`
1114                 dbus_role_template($1, $1_r, $1_usertype)
1115                 dbus_system_bus_client($1_usertype)
1116                 allow $1_usertype $1_usertype:dbus send_msg;
1117
1118                 optional_policy(`
1119                         abrt_dbus_chat($1_usertype)
1120                         abrt_run_helper($1_usertype, $1_r)
1121                 ')
1122
1123                 optional_policy(`
1124                         consolekit_dontaudit_read_log($1_usertype)
1125                         consolekit_dbus_chat($1_usertype)
1126                 ')
1127
1128                 optional_policy(`
1129                         cups_dbus_chat($1_usertype)
1130                         cups_dbus_chat_config($1_usertype)
1131                 ')
1132
1133                 optional_policy(`
1134                         devicekit_dbus_chat($1_usertype)
1135                         devicekit_dbus_chat_disk($1_usertype)
1136                         devicekit_dbus_chat_power($1_usertype)
1137                 ')
1138
1139                 optional_policy(`
1140                         fprintd_dbus_chat($1_t)
1141                 ')
1142         ')
1143
1144         optional_policy(`
1145                 policykit_role($1_r, $1_usertype)
1146         ')
1147
1148         optional_policy(`
1149                 pulseaudio_role($1_r, $1_usertype)
1150                 pulseaudio_filetrans_admin_home_content($1_usertype)
1151                 pulseaudio_filetrans_home_content($1_usertype)
1152         ')
1153
1154         optional_policy(`
1155                 rtkit_scheduled($1_usertype)
1156         ')
1157
1158         optional_policy(`
1159                 setroubleshoot_dontaudit_stream_connect($1_t)
1160         ')
1161
1162         optional_policy(`
1163                 udev_read_db($1_usertype)
1164         ')
1165
1166         optional_policy(`
1167                 wm_role_template($1, $1_r, $1_t)
1168         ')
1169 ')
1170
1171 #######################################
1172 ## <summary>
1173 ##      The template for creating a unprivileged user roughly
1174 ##      equivalent to a regular linux user.
1175 ## </summary>
1176 ## <desc>
1177 ##      <p>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ##      </p>
1181 ##      <p>
1182 ##      This template creates a user domain, types, and
1183 ##      rules for the user's tty, pty, home directories,
1184 ##      tmp, and tmpfs files.
1185 ##      </p>
1186 ## </desc>
1187 ## <param name="userdomain_prefix">
1188 ##      <summary>
1189 ##      The prefix of the user domain (e.g., user
1190 ##      is the prefix for user_t).
1191 ##      </summary>
1192 ## </param>
1193 #
1194 template(`userdom_unpriv_user_template', `
1195
1196         ##############################
1197         #
1198         # Declarations
1199         #
1200
1201         # Inherit rules for ordinary users.
1202         userdom_restricted_xwindows_user_template($1)
1203         userdom_common_user_template($1)
1204
1205         ##############################
1206         #
1207         # Local policy
1208         #
1209
1210         # port access is audited even if dac would not have allowed it, so dontaudit it here
1211 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1212         # Need the following rule to allow users to run vpnc
1213         corenet_tcp_bind_xserver_port($1_t)
1214         corenet_tcp_bind_generic_node($1_usertype)
1215
1216         storage_rw_fuse($1_t)
1217
1218         files_exec_usr_files($1_t)
1219    # cjp: why?
1220         files_read_kernel_symbol_table($1_t)
1221
1222         ifndef(`enable_mls',`
1223                 fs_exec_noxattr($1_t)
1224
1225                 tunable_policy(`user_rw_noexattrfile',`
1226                         fs_manage_noxattr_fs_files($1_t)
1227                         fs_manage_noxattr_fs_dirs($1_t)
1228                         # Write floppies
1229                         storage_raw_read_removable_device($1_t)
1230                         storage_raw_write_removable_device($1_t)
1231                 ',`
1232                         storage_raw_read_removable_device($1_t)
1233                 ')
1234         ')
1235
1236         miscfiles_read_hwdata($1_usertype)
1237
1238         # Allow users to run TCP servers (bind to ports and accept connection from
1239         # the same domain and outside users) disabling this forces FTP passive mode
1240         # and may change other protocols
1241
1242         tunable_policy(`user_share_music',`
1243                 corenet_tcp_bind_daap_port($1_usertype)
1244         ')
1245
1246         tunable_policy(`user_tcp_server',`
1247                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1248         ')
1249
1250         tunable_policy(`user_setrlimit',`
1251                 allow $1_usertype self:process setrlimit;
1252         ')
1253
1254         optional_policy(`
1255                 cdrecord_role($1_r, $1_t)
1256         ')
1257
1258         optional_policy(`
1259                 cron_role($1_r, $1_t)
1260         ')
1261
1262         optional_policy(`
1263                 games_rw_data($1_usertype)
1264         ')
1265
1266         optional_policy(`
1267                 gpg_role($1_r, $1_usertype)
1268         ')
1269
1270         optional_policy(`
1271                 gnomeclock_dbus_chat($1_t)
1272         ')
1273
1274         optional_policy(`
1275                 gpm_stream_connect($1_usertype)
1276         ')
1277
1278         optional_policy(`
1279                 mount_run_fusermount($1_t, $1_r)
1280                 mount_read_pid_files($1_t)
1281         ')
1282
1283         optional_policy(`
1284                 wine_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 postfix_run_postdrop($1_t, $1_r)
1289                 postfix_search_spool($1_t)
1290         ')
1291
1292         # Run pppd in pppd_t by default for user
1293         optional_policy(`
1294                 ppp_run_cond($1_t, $1_r)
1295         ')
1296
1297         optional_policy(`
1298                 vdagent_getattr_log($1_t)
1299                 vdagent_getattr_exec($1_t)
1300                 vdagent_stream_connect($1_t)
1301         ')
1302 ')
1303
1304 #######################################
1305 ## <summary>
1306 ##      The template for creating an administrative user.
1307 ## </summary>
1308 ## <desc>
1309 ##      <p>
1310 ##      This template creates a user domain, types, and
1311 ##      rules for the user's tty, pty, home directories,
1312 ##      tmp, and tmpfs files.
1313 ##      </p>
1314 ##      <p>
1315 ##      The privileges given to administrative users are:
1316 ##      <ul>
1317 ##              <li>Raw disk access</li>
1318 ##              <li>Set all sysctls</li>
1319 ##              <li>All kernel ring buffer controls</li>
1320 ##              <li>Create, read, write, and delete all files but shadow</li>
1321 ##              <li>Manage source and binary format SELinux policy</li>
1322 ##              <li>Run insmod</li>
1323 ##      </ul>
1324 ##      </p>
1325 ## </desc>
1326 ## <param name="userdomain_prefix">
1327 ##      <summary>
1328 ##      The prefix of the user domain (e.g., sysadm
1329 ##      is the prefix for sysadm_t).
1330 ##      </summary>
1331 ## </param>
1332 #
1333 template(`userdom_admin_user_template',`
1334         gen_require(`
1335                 attribute admindomain;
1336                 class passwd { passwd chfn chsh rootok crontab };
1337         ')
1338
1339         ##############################
1340         #
1341         # Declarations
1342         #
1343
1344         # Inherit rules for ordinary users.
1345         userdom_login_user_template($1)
1346         userdom_common_user_template($1)
1347
1348         domain_obj_id_change_exemption($1_t)
1349         role system_r types $1_t;
1350
1351         typeattribute $1_t admindomain;
1352
1353         ifdef(`direct_sysadm_daemon',`
1354                 domain_system_change_exemption($1_t)
1355         ')
1356
1357         ##############################
1358         #
1359         # $1_t local policy
1360         #
1361
1362         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1363         tunable_policy(`deny_ptrace',`',`
1364                 allow $1_t self:capability sys_ptrace;
1365         ')
1366         allow $1_t self:capability2 syslog;
1367         allow $1_t self:process { setexec setfscreate };
1368         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1369         allow $1_t self:tun_socket create;
1370         # Set password information for other users.
1371         allow $1_t self:passwd { passwd chfn chsh };
1372         # Skip authentication when pam_rootok is specified.
1373         allow $1_t self:passwd rootok;
1374
1375         # Manipulate other users crontab.
1376         allow $1_t self:passwd crontab;
1377
1378         kernel_read_software_raid_state($1_t)
1379         kernel_getattr_core_if($1_t)
1380         kernel_getattr_message_if($1_t)
1381         kernel_change_ring_buffer_level($1_t)
1382         kernel_clear_ring_buffer($1_t)
1383         kernel_read_ring_buffer($1_t)
1384         kernel_get_sysvipc_info($1_t)
1385         kernel_rw_all_sysctls($1_t)
1386         # signal unlabeled processes:
1387         kernel_kill_unlabeled($1_t)
1388         kernel_signal_unlabeled($1_t)
1389         kernel_sigstop_unlabeled($1_t)
1390         kernel_signull_unlabeled($1_t)
1391         kernel_sigchld_unlabeled($1_t)
1392         kernel_signal($1_t)
1393
1394         corenet_tcp_bind_generic_port($1_t)
1395         # allow setting up tunnels
1396         corenet_rw_tun_tap_dev($1_t)
1397
1398         dev_getattr_generic_blk_files($1_t)
1399         dev_getattr_generic_chr_files($1_t)
1400         # for lsof
1401         dev_getattr_mtrr_dev($1_t)
1402         # Allow MAKEDEV to work
1403         dev_create_all_blk_files($1_t)
1404         dev_create_all_chr_files($1_t)
1405         dev_delete_all_blk_files($1_t)
1406         dev_delete_all_chr_files($1_t)
1407         dev_rename_all_blk_files($1_t)
1408         dev_rename_all_chr_files($1_t)
1409         dev_create_generic_symlinks($1_t)
1410         dev_rw_generic_usb_dev($1_t)
1411         dev_rw_usbfs($1_t)
1412
1413         domain_setpriority_all_domains($1_t)
1414         domain_read_all_domains_state($1_t)
1415         domain_getattr_all_domains($1_t)
1416         domain_getcap_all_domains($1_t)
1417         domain_dontaudit_ptrace_all_domains($1_t)
1418         # signal all domains:
1419         domain_kill_all_domains($1_t)
1420         domain_signal_all_domains($1_t)
1421         domain_signull_all_domains($1_t)
1422         domain_sigstop_all_domains($1_t)
1423         domain_sigstop_all_domains($1_t)
1424         domain_sigchld_all_domains($1_t)
1425         # for lsof
1426         domain_getattr_all_sockets($1_t)
1427         domain_dontaudit_getattr_all_sockets($1_t)
1428
1429         files_exec_usr_src_files($1_t)
1430
1431         fs_getattr_all_fs($1_t)
1432         fs_getattr_all_files($1_t)
1433         fs_list_all($1_t)
1434         fs_set_all_quotas($1_t)
1435         fs_exec_noxattr($1_t)
1436
1437         storage_raw_read_removable_device($1_t)
1438         storage_raw_write_removable_device($1_t)
1439         storage_dontaudit_read_fixed_disk($1_t)
1440
1441         term_use_all_inherited_terms($1_t)
1442         term_use_unallocated_ttys($1_t)
1443
1444         auth_getattr_shadow($1_t)
1445         # Manage almost all files
1446         files_manage_non_security_dirs($1_t)
1447         files_manage_non_security_files($1_t)
1448         # Relabel almost all files
1449         files_relabel_non_security_files($1_t)
1450
1451         init_telinit($1_t)
1452
1453         logging_send_syslog_msg($1_t)
1454
1455         optional_policy(`
1456                 modutils_domtrans_insmod($1_t)
1457                 modutils_domtrans_depmod($1_t)
1458         ')
1459
1460         # The following rule is temporary until such time that a complete
1461         # policy management infrastructure is in place so that an administrator
1462         # cannot directly manipulate policy files with arbitrary programs.
1463         seutil_manage_src_policy($1_t)
1464         # Violates the goal of limiting write access to checkpolicy.
1465         # But presently necessary for installing the file_contexts file.
1466         seutil_manage_bin_policy($1_t)
1467
1468         systemd_config_all_services($1_t)
1469
1470         userdom_manage_user_home_content_dirs($1_t)
1471         userdom_manage_user_home_content_files($1_t)
1472         userdom_manage_user_home_content_symlinks($1_t)
1473         userdom_manage_user_home_content_pipes($1_t)
1474         userdom_manage_user_home_content_sockets($1_t)
1475         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1476
1477         tunable_policy(`user_rw_noexattrfile',`
1478                 fs_manage_noxattr_fs_files($1_t)
1479                 fs_manage_noxattr_fs_dirs($1_t)
1480         ',`
1481                 fs_read_noxattr_fs_files($1_t)
1482         ')
1483
1484         optional_policy(`
1485                 postgresql_unconfined($1_t)
1486         ')
1487
1488         optional_policy(`
1489                 userhelper_exec($1_t)
1490         ')
1491 ')
1492
1493 ########################################
1494 ## <summary>
1495 ##      Allow user to run as a secadm
1496 ## </summary>
1497 ## <desc>
1498 ##      <p>
1499 ##      Create objects in a user home directory
1500 ##      with an automatic type transition to
1501 ##      a specified private type.
1502 ##      </p>
1503 ##      <p>
1504 ##      This is a templated interface, and should only
1505 ##      be called from a per-userdomain template.
1506 ##      </p>
1507 ## </desc>
1508 ## <param name="domain">
1509 ##      <summary>
1510 ##      Domain allowed access.
1511 ##      </summary>
1512 ## </param>
1513 ## <param name="role">
1514 ##      <summary>
1515 ##      The role  of the object to create.
1516 ##      </summary>
1517 ## </param>
1518 #
1519 template(`userdom_security_admin_template',`
1520         allow $1 self:capability { dac_read_search dac_override };
1521
1522         corecmd_exec_shell($1)
1523
1524         domain_obj_id_change_exemption($1)
1525
1526         dev_relabel_all_dev_nodes($1)
1527
1528         files_create_boot_flag($1)
1529         files_create_default_dir($1)
1530         files_root_filetrans_default($1, dir)
1531
1532         # Necessary for managing /boot/efi
1533         fs_manage_dos_files($1)
1534
1535         mls_process_read_up($1)
1536         mls_file_read_all_levels($1)
1537         mls_file_upgrade($1)
1538         mls_file_downgrade($1)
1539
1540         selinux_set_enforce_mode($1)
1541         selinux_set_all_booleans($1)
1542         selinux_set_parameters($1)
1543         selinux_read_policy($1)
1544
1545         files_relabel_all_files($1)
1546         auth_relabel_shadow($1)
1547
1548         init_exec($1)
1549
1550         logging_send_syslog_msg($1)
1551         logging_read_audit_log($1)
1552         logging_read_generic_logs($1)
1553         logging_read_audit_config($1)
1554
1555         seutil_manage_bin_policy($1)
1556         seutil_manage_default_contexts($1)
1557         seutil_manage_file_contexts($1)
1558         seutil_manage_module_store($1)
1559         seutil_manage_config($1)
1560         seutil_run_checkpolicy($1,$2)
1561         seutil_run_loadpolicy($1,$2)
1562         seutil_run_semanage($1,$2)
1563         seutil_run_setsebool($1,$2)
1564         seutil_run_setfiles($1, $2)
1565
1566         seutil_manage_bin_policy($1)
1567     seutil_manage_default_contexts($1)
1568     seutil_manage_file_contexts($1)
1569     seutil_manage_module_store($1)
1570     seutil_manage_config($1)
1571
1572         optional_policy(`
1573                 aide_run($1,$2)
1574         ')
1575
1576         optional_policy(`
1577                 consoletype_exec($1)
1578         ')
1579
1580         optional_policy(`
1581                 dmesg_exec($1)
1582         ')
1583
1584         optional_policy(`
1585                 ipsec_run_setkey($1,$2)
1586         ')
1587
1588         optional_policy(`
1589                 netlabel_run_mgmt($1,$2)
1590         ')
1591
1592         optional_policy(`
1593                 samhain_run($1, $2)
1594         ')
1595 ')
1596
1597 ########################################
1598 ## <summary>
1599 ##      Make the specified type usable in a
1600 ##      user home directory.
1601 ## </summary>
1602 ## <param name="type">
1603 ##      <summary>
1604 ##      Type to be used as a file in the
1605 ##      user home directory.
1606 ##      </summary>
1607 ## </param>
1608 #
1609 interface(`userdom_user_home_content',`
1610         gen_require(`
1611                 type user_home_t;
1612                 attribute user_home_type;
1613         ')
1614
1615         allow $1 user_home_t:filesystem associate;
1616         files_type($1)
1617         ubac_constrained($1)
1618
1619         files_poly_member($1)
1620         typeattribute $1  user_home_type;
1621 ')
1622
1623 ########################################
1624 ## <summary>
1625 ##      Make the specified type usable in a
1626 ##      generic temporary directory.
1627 ## </summary>
1628 ## <param name="type">
1629 ##      <summary>
1630 ##      Type to be used as a file in the
1631 ##      generic temporary directory.
1632 ##      </summary>
1633 ## </param>
1634 #
1635 interface(`userdom_user_tmp_content',`
1636         gen_require(`
1637                 attribute user_tmp_type;
1638         ')
1639
1640         typeattribute $1 user_tmp_type;
1641
1642         files_tmp_file($1)
1643         ubac_constrained($1)
1644 ')
1645
1646 ########################################
1647 ## <summary>
1648 ##      Make the specified type usable in a
1649 ##      generic tmpfs_t directory.
1650 ## </summary>
1651 ## <param name="type">
1652 ##      <summary>
1653 ##      Type to be used as a file in the
1654 ##      generic temporary directory.
1655 ##      </summary>
1656 ## </param>
1657 #
1658 interface(`userdom_user_tmpfs_content',`
1659         gen_require(`
1660                 attribute user_tmpfs_type;
1661         ')
1662
1663         typeattribute $1 user_tmpfs_type;
1664
1665         files_tmpfs_file($1)
1666         ubac_constrained($1)
1667 ')
1668
1669 ########################################
1670 ## <summary>
1671 ##      Allow domain to attach to TUN devices created by administrative users.
1672 ## </summary>
1673 ## <param name="domain">
1674 ##      <summary>
1675 ##      Domain allowed access.
1676 ##      </summary>
1677 ## </param>
1678 #
1679 interface(`userdom_attach_admin_tun_iface',`
1680         gen_require(`
1681                 attribute admindomain;
1682         ')
1683
1684         allow $1 admindomain:tun_socket relabelfrom;
1685         allow $1 self:tun_socket relabelto;
1686 ')
1687
1688 ########################################
1689 ## <summary>
1690 ##      Set the attributes of a user pty.
1691 ## </summary>
1692 ## <param name="domain">
1693 ##      <summary>
1694 ##      Domain allowed access.
1695 ##      </summary>
1696 ## </param>
1697 #
1698 interface(`userdom_setattr_user_ptys',`
1699         gen_require(`
1700                 type user_devpts_t;
1701         ')
1702
1703         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1704 ')
1705
1706 ########################################
1707 ## <summary>
1708 ##      Create a user pty.
1709 ## </summary>
1710 ## <param name="domain">
1711 ##      <summary>
1712 ##      Domain allowed access.
1713 ##      </summary>
1714 ## </param>
1715 #
1716 interface(`userdom_create_user_pty',`
1717         gen_require(`
1718                 type user_devpts_t;
1719         ')
1720
1721         term_create_pty($1, user_devpts_t)
1722 ')
1723
1724 ########################################
1725 ## <summary>
1726 ##      Get the attributes of user home directories.
1727 ## </summary>
1728 ## <param name="domain">
1729 ##      <summary>
1730 ##      Domain allowed access.
1731 ##      </summary>
1732 ## </param>
1733 #
1734 interface(`userdom_getattr_user_home_dirs',`
1735         gen_require(`
1736                 type user_home_dir_t;
1737         ')
1738
1739         allow $1 user_home_dir_t:dir getattr_dir_perms;
1740         files_search_home($1)
1741 ')
1742
1743 ########################################
1744 ## <summary>
1745 ##      Do not audit attempts to get the attributes of user home directories.
1746 ## </summary>
1747 ## <param name="domain">
1748 ##      <summary>
1749 ##      Domain to not audit.
1750 ##      </summary>
1751 ## </param>
1752 #
1753 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1754         gen_require(`
1755                 type user_home_dir_t;
1756         ')
1757
1758         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1759 ')
1760
1761 ########################################
1762 ## <summary>
1763 ##      Search user home directories.
1764 ## </summary>
1765 ## <param name="domain">
1766 ##      <summary>
1767 ##      Domain allowed access.
1768 ##      </summary>
1769 ## </param>
1770 #
1771 interface(`userdom_search_user_home_dirs',`
1772         gen_require(`
1773                 type user_home_dir_t;
1774         ')
1775
1776         allow $1 user_home_dir_t:dir search_dir_perms;
1777         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1778         files_search_home($1)
1779 ')
1780
1781 ########################################
1782 ## <summary>
1783 ##      Do not audit attempts to search user home directories.
1784 ## </summary>
1785 ## <desc>
1786 ##      <p>
1787 ##      Do not audit attempts to search user home directories.
1788 ##      This will supress SELinux denial messages when the specified
1789 ##      domain is denied the permission to search these directories.
1790 ##      </p>
1791 ## </desc>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain to not audit.
1795 ##      </summary>
1796 ## </param>
1797 ## <infoflow type="none"/>
1798 #
1799 interface(`userdom_dontaudit_search_user_home_dirs',`
1800         gen_require(`
1801                 type user_home_dir_t;
1802         ')
1803
1804         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1805 ')
1806
1807 ########################################
1808 ## <summary>
1809 ##      List user home directories.
1810 ## </summary>
1811 ## <param name="domain">
1812 ##      <summary>
1813 ##      Domain allowed access.
1814 ##      </summary>
1815 ## </param>
1816 #
1817 interface(`userdom_list_user_home_dirs',`
1818         gen_require(`
1819                 type user_home_dir_t;
1820         ')
1821
1822         allow $1 user_home_dir_t:dir list_dir_perms;
1823         files_search_home($1)
1824
1825         tunable_policy(`use_nfs_home_dirs',`
1826                 fs_list_nfs($1)
1827         ')
1828
1829         tunable_policy(`use_samba_home_dirs',`
1830                 fs_list_cifs($1)
1831         ')
1832 ')
1833
1834 ########################################
1835 ## <summary>
1836 ##      Do not audit attempts to list user home subdirectories.
1837 ## </summary>
1838 ## <param name="domain">
1839 ##      <summary>
1840 ##      Domain to not audit.
1841 ##      </summary>
1842 ## </param>
1843 #
1844 interface(`userdom_dontaudit_list_user_home_dirs',`
1845         gen_require(`
1846                 type user_home_dir_t;
1847                 type user_home_t;
1848         ')
1849
1850         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1851         dontaudit $1 user_home_t:dir list_dir_perms;
1852 ')
1853
1854 ########################################
1855 ## <summary>
1856 ##      Create user home directories.
1857 ## </summary>
1858 ## <param name="domain">
1859 ##      <summary>
1860 ##      Domain allowed access.
1861 ##      </summary>
1862 ## </param>
1863 #
1864 interface(`userdom_create_user_home_dirs',`
1865         gen_require(`
1866                 type user_home_dir_t;
1867         ')
1868
1869         allow $1 user_home_dir_t:dir create_dir_perms;
1870 ')
1871
1872 ########################################
1873 ## <summary>
1874 ##      Create user home directories.
1875 ## </summary>
1876 ## <param name="domain">
1877 ##      <summary>
1878 ##      Domain allowed access.
1879 ##      </summary>
1880 ## </param>
1881 #
1882 interface(`userdom_manage_user_home_dirs',`
1883         gen_require(`
1884                 type user_home_dir_t;
1885         ')
1886
1887         allow $1 user_home_dir_t:dir manage_dir_perms;
1888 ')
1889
1890 ########################################
1891 ## <summary>
1892 ##      Relabel to user home directories.
1893 ## </summary>
1894 ## <param name="domain">
1895 ##      <summary>
1896 ##      Domain allowed access.
1897 ##      </summary>
1898 ## </param>
1899 #
1900 interface(`userdom_relabelto_user_home_dirs',`
1901         gen_require(`
1902                 type user_home_dir_t;
1903         ')
1904
1905         allow $1 user_home_dir_t:dir relabelto;
1906 ')
1907
1908
1909 ########################################
1910 ## <summary>
1911 ##      Relabel to user home files.
1912 ## </summary>
1913 ## <param name="domain">
1914 ##      <summary>
1915 ##      Domain allowed access.
1916 ##      </summary>
1917 ## </param>
1918 #
1919 interface(`userdom_relabelto_user_home_files',`
1920         gen_require(`
1921                 type user_home_t;
1922         ')
1923
1924         allow $1 user_home_t:file relabelto;
1925 ')
1926 ########################################
1927 ## <summary>
1928 ##      Relabel user home files.
1929 ## </summary>
1930 ## <param name="domain">
1931 ##      <summary>
1932 ##      Domain allowed access.
1933 ##      </summary>
1934 ## </param>
1935 #
1936 interface(`userdom_relabel_user_home_files',`
1937         gen_require(`
1938                 type user_home_t;
1939         ')
1940
1941         allow $1 user_home_t:file relabel_file_perms;
1942 ')
1943
1944 ########################################
1945 ## <summary>
1946 ##      Create directories in the home dir root with
1947 ##      the user home directory type.
1948 ## </summary>
1949 ## <param name="domain">
1950 ##      <summary>
1951 ##      Domain allowed access.
1952 ##      </summary>
1953 ## </param>
1954 #
1955 interface(`userdom_home_filetrans_user_home_dir',`
1956         gen_require(`
1957                 type user_home_dir_t;
1958         ')
1959
1960         files_home_filetrans($1, user_home_dir_t, dir)
1961 ')
1962
1963 ########################################
1964 ## <summary>
1965 ##      Do a domain transition to the specified
1966 ##      domain when executing a program in the
1967 ##      user home directory.
1968 ## </summary>
1969 ## <desc>
1970 ##      <p>
1971 ##      Do a domain transition to the specified
1972 ##      domain when executing a program in the
1973 ##      user home directory.
1974 ##      </p>
1975 ##      <p>
1976 ##      No interprocess communication (signals, pipes,
1977 ##      etc.) is provided by this interface since
1978 ##      the domains are not owned by this module.
1979 ##      </p>
1980 ## </desc>
1981 ## <param name="source_domain">
1982 ##      <summary>
1983 ##      Domain allowed to transition.
1984 ##      </summary>
1985 ## </param>
1986 ## <param name="target_domain">
1987 ##      <summary>
1988 ##      Domain to transition to.
1989 ##      </summary>
1990 ## </param>
1991 #
1992 interface(`userdom_user_home_domtrans',`
1993         gen_require(`
1994                 type user_home_dir_t, user_home_t;
1995         ')
1996
1997         domain_auto_trans($1, user_home_t, $2)
1998         allow $1 user_home_dir_t:dir search_dir_perms;
1999         files_search_home($1)
2000 ')
2001
2002 ########################################
2003 ## <summary>
2004 ##      Do not audit attempts to search user home content directories.
2005 ## </summary>
2006 ## <param name="domain">
2007 ##      <summary>
2008 ##      Domain to not audit.
2009 ##      </summary>
2010 ## </param>
2011 #
2012 interface(`userdom_dontaudit_search_user_home_content',`
2013         gen_require(`
2014                 type user_home_t;
2015         ')
2016
2017         dontaudit $1 user_home_t:dir search_dir_perms;
2018         fs_dontaudit_list_nfs($1)
2019         fs_dontaudit_list_cifs($1)
2020 ')
2021
2022 ########################################
2023 ## <summary>
2024 ##      List contents of users home directory.
2025 ## </summary>
2026 ## <param name="domain">
2027 ##      <summary>
2028 ##      Domain allowed access.
2029 ##      </summary>
2030 ## </param>
2031 #
2032 interface(`userdom_list_user_home_content',`
2033         gen_require(`
2034                 type user_home_dir_t;
2035                 attribute user_home_type;
2036         ')
2037
2038         files_list_home($1)
2039         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2040 ')
2041
2042 ########################################
2043 ## <summary>
2044 ##      Create, read, write, and delete directories
2045 ##      in a user home subdirectory.
2046 ## </summary>
2047 ## <param name="domain">
2048 ##      <summary>
2049 ##      Domain allowed access.
2050 ##      </summary>
2051 ## </param>
2052 #
2053 interface(`userdom_manage_user_home_content_dirs',`
2054         gen_require(`
2055                 type user_home_dir_t, user_home_t;
2056         ')
2057
2058         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2059         files_search_home($1)
2060 ')
2061
2062 ########################################
2063 ## <summary>
2064 ##      Delete directories in a user home subdirectory.
2065 ## </summary>
2066 ## <param name="domain">
2067 ##      <summary>
2068 ##      Domain allowed access.
2069 ##      </summary>
2070 ## </param>
2071 #
2072 interface(`userdom_delete_user_home_content_dirs',`
2073         gen_require(`
2074                 type user_home_t;
2075         ')
2076
2077         allow $1 user_home_t:dir delete_dir_perms;
2078 ')
2079
2080 ########################################
2081 ## <summary>
2082 ##      Delete all directories in a user home subdirectory.
2083 ## </summary>
2084 ## <param name="domain">
2085 ##      <summary>
2086 ##      Domain allowed access.
2087 ##      </summary>
2088 ## </param>
2089 #
2090 interface(`userdom_delete_all_user_home_content_dirs',`
2091         gen_require(`
2092                 attribute user_home_type;
2093         ')
2094
2095         allow $1 user_home_type:dir delete_dir_perms;
2096 ')
2097
2098 ########################################
2099 ## <summary>
2100 ##      Set the attributes of user home files.
2101 ## </summary>
2102 ## <param name="domain">
2103 ##      <summary>
2104 ##      Domain allowed access.
2105 ##      </summary>
2106 ## </param>
2107 ## <rolecap/>
2108 #
2109 interface(`userdom_setattr_user_home_content_files',`
2110         gen_require(`
2111                 type user_home_t;
2112         ')
2113
2114         allow $1 user_home_t:file setattr;
2115 ')
2116
2117 ########################################
2118 ## <summary>
2119 ##      Do not audit attempts to set the
2120 ##      attributes of user home files.
2121 ## </summary>
2122 ## <param name="domain">
2123 ##      <summary>
2124 ##      Domain to not audit.
2125 ##      </summary>
2126 ## </param>
2127 #
2128 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2129         gen_require(`
2130                 type user_home_t;
2131         ')
2132
2133         dontaudit $1 user_home_t:file setattr_file_perms;
2134 ')
2135
2136 ########################################
2137 ## <summary>
2138 ##      Set the attributes of all user home directories.
2139 ## </summary>
2140 ## <param name="domain">
2141 ##      <summary>
2142 ##      Domain allowed access.
2143 ##      </summary>
2144 ## </param>
2145 ## <rolecap/>
2146 #
2147 interface(`userdom_setattr_all_user_home_content_dirs',`
2148         gen_require(`
2149                 attribute user_home_type;
2150         ')
2151
2152         allow $1 user_home_type:dir setattr_dir_perms;
2153 ')
2154
2155 ########################################
2156 ## <summary>
2157 ##      Mmap user home files.
2158 ## </summary>
2159 ## <param name="domain">
2160 ##      <summary>
2161 ##      Domain allowed access.
2162 ##      </summary>
2163 ## </param>
2164 #
2165 interface(`userdom_mmap_user_home_content_files',`
2166         gen_require(`
2167                 type user_home_dir_t, user_home_t;
2168         ')
2169
2170         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2171         files_search_home($1)
2172 ')
2173
2174 ########################################
2175 ## <summary>
2176 ##      Read user home files.
2177 ## </summary>
2178 ## <param name="domain">
2179 ##      <summary>
2180 ##      Domain allowed access.
2181 ##      </summary>
2182 ## </param>
2183 #
2184 interface(`userdom_read_user_home_content_files',`
2185         gen_require(`
2186                 type user_home_dir_t, user_home_t;
2187         ')
2188
2189         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2190         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2191         files_search_home($1)
2192 ')
2193
2194 ########################################
2195 ## <summary>
2196 ##      Do not audit attempts to getattr user home files.
2197 ## </summary>
2198 ## <param name="domain">
2199 ##      <summary>
2200 ##      Domain to not audit.
2201 ##      </summary>
2202 ## </param>
2203 #
2204 interface(`userdom_dontaudit_getattr_user_home_content',`
2205         gen_require(`
2206                 attribute user_home_type;
2207         ')
2208
2209         dontaudit $1 user_home_type:dir getattr;
2210         dontaudit $1 user_home_type:file getattr;
2211 ')
2212
2213 ########################################
2214 ## <summary>
2215 ##      Do not audit attempts to read user home files.
2216 ## </summary>
2217 ## <param name="domain">
2218 ##      <summary>
2219 ##      Domain to not audit.
2220 ##      </summary>
2221 ## </param>
2222 #
2223 interface(`userdom_dontaudit_read_user_home_content_files',`
2224         gen_require(`
2225                 attribute user_home_type;
2226                 type user_home_dir_t;
2227         ')
2228
2229         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2230         dontaudit $1 user_home_type:dir list_dir_perms;
2231         dontaudit $1 user_home_type:file read_file_perms;
2232         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2233 ')
2234
2235 ########################################
2236 ## <summary>
2237 ##      Do not audit attempts to append user home files.
2238 ## </summary>
2239 ## <param name="domain">
2240 ##      <summary>
2241 ##      Domain to not audit.
2242 ##      </summary>
2243 ## </param>
2244 #
2245 interface(`userdom_dontaudit_append_user_home_content_files',`
2246         gen_require(`
2247                 type user_home_t;
2248         ')
2249
2250         dontaudit $1 user_home_t:file append_file_perms;
2251 ')
2252
2253 ########################################
2254 ## <summary>
2255 ##      Do not audit attempts to write user home files.
2256 ## </summary>
2257 ## <param name="domain">
2258 ##      <summary>
2259 ##      Domain to not audit.
2260 ##      </summary>
2261 ## </param>
2262 #
2263 interface(`userdom_dontaudit_write_user_home_content_files',`
2264         gen_require(`
2265                 type user_home_t;
2266         ')
2267
2268         dontaudit $1 user_home_t:file write_file_perms;
2269 ')
2270
2271 ########################################
2272 ## <summary>
2273 ##      Delete files in a user home subdirectory.
2274 ## </summary>
2275 ## <param name="domain">
2276 ##      <summary>
2277 ##      Domain allowed access.
2278 ##      </summary>
2279 ## </param>
2280 #
2281 interface(`userdom_delete_user_home_content_files',`
2282         gen_require(`
2283                 type user_home_t;
2284         ')
2285
2286         allow $1 user_home_t:file delete_file_perms;
2287 ')
2288
2289 ########################################
2290 ## <summary>
2291 ##      Delete all files in a user home subdirectory.
2292 ## </summary>
2293 ## <param name="domain">
2294 ##      <summary>
2295 ##      Domain allowed access.
2296 ##      </summary>
2297 ## </param>
2298 #
2299 interface(`userdom_delete_all_user_home_content_files',`
2300         gen_require(`
2301                 attribute user_home_type;
2302         ')
2303
2304         allow $1 user_home_type:file delete_file_perms;
2305 ')
2306
2307 ########################################
2308 ## <summary>
2309 ##      Delete sock files in a user home subdirectory.
2310 ## </summary>
2311 ## <param name="domain">
2312 ##      <summary>
2313 ##      Domain allowed access.
2314 ##      </summary>
2315 ## </param>
2316 #
2317 interface(`userdom_delete_user_home_content_sock_files',`
2318         gen_require(`
2319                 type user_home_t;
2320         ')
2321
2322         allow $1 user_home_t:sock_file delete_file_perms;
2323 ')
2324
2325 ########################################
2326 ## <summary>
2327 ##      Delete all sock files in a user home subdirectory.
2328 ## </summary>
2329 ## <param name="domain">
2330 ##      <summary>
2331 ##      Domain allowed access.
2332 ##      </summary>
2333 ## </param>
2334 #
2335 interface(`userdom_delete_all_user_home_content_sock_files',`
2336         gen_require(`
2337                 attribute user_home_type;
2338         ')
2339
2340         allow $1 user_home_type:sock_file delete_file_perms;
2341 ')
2342
2343 ########################################
2344 ## <summary>
2345 ##      Do not audit attempts to write user home files.
2346 ## </summary>
2347 ## <param name="domain">
2348 ##      <summary>
2349 ##      Domain to not audit.
2350 ##      </summary>
2351 ## </param>
2352 #
2353 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2354         gen_require(`
2355                 type user_home_t;
2356         ')
2357
2358         dontaudit $1 user_home_t:file relabel_file_perms;
2359 ')
2360
2361 ########################################
2362 ## <summary>
2363 ##      Read user home subdirectory symbolic links.
2364 ## </summary>
2365 ## <param name="domain">
2366 ##      <summary>
2367 ##      Domain allowed access.
2368 ##      </summary>
2369 ## </param>
2370 #
2371 interface(`userdom_read_user_home_content_symlinks',`
2372         gen_require(`
2373                 type user_home_dir_t, user_home_t;
2374         ')
2375
2376         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2377 ')
2378
2379 ########################################
2380 ## <summary>
2381 ##      Execute user home files.
2382 ## </summary>
2383 ## <param name="domain">
2384 ##      <summary>
2385 ##      Domain allowed access.
2386 ##      </summary>
2387 ## </param>
2388 ## <rolecap/>
2389 #
2390 interface(`userdom_exec_user_home_content_files',`
2391         gen_require(`
2392                 type user_home_dir_t;
2393                 attribute user_home_type;
2394         ')
2395
2396         files_search_home($1)
2397         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2398         dontaudit $1 user_home_type:sock_file execute;
2399         ')
2400
2401 ########################################
2402 ## <summary>
2403 ##      Do not audit attempts to execute user home files.
2404 ## </summary>
2405 ## <param name="domain">
2406 ##      <summary>
2407 ##      Domain to not audit.
2408 ##      </summary>
2409 ## </param>
2410 #
2411 interface(`userdom_dontaudit_exec_user_home_content_files',`
2412         gen_require(`
2413                 type user_home_t;
2414         ')
2415
2416         dontaudit $1 user_home_t:file exec_file_perms;
2417 ')
2418
2419 ########################################
2420 ## <summary>
2421 ##      Create, read, write, and delete files
2422 ##      in a user home subdirectory.
2423 ## </summary>
2424 ## <param name="domain">
2425 ##      <summary>
2426 ##      Domain allowed access.
2427 ##      </summary>
2428 ## </param>
2429 #
2430 interface(`userdom_manage_user_home_content_files',`
2431         gen_require(`
2432                 type user_home_dir_t, user_home_t;
2433         ')
2434
2435         manage_files_pattern($1, user_home_t, user_home_t)
2436         allow $1 user_home_dir_t:dir search_dir_perms;
2437         files_search_home($1)
2438 ')
2439
2440 ########################################
2441 ## <summary>
2442 ##      Do not audit attempts to create, read, write, and delete directories
2443 ##      in a user home subdirectory.
2444 ## </summary>
2445 ## <param name="domain">
2446 ##      <summary>
2447 ##      Domain to not audit.
2448 ##      </summary>
2449 ## </param>
2450 #
2451 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2452         gen_require(`
2453                 type user_home_dir_t, user_home_t;
2454         ')
2455
2456         dontaudit $1 user_home_t:dir manage_dir_perms;
2457 ')
2458
2459 ########################################
2460 ## <summary>
2461 ##      Create, read, write, and delete symbolic links
2462 ##      in a user home subdirectory.
2463 ## </summary>
2464 ## <param name="domain">
2465 ##      <summary>
2466 ##      Domain allowed access.
2467 ##      </summary>
2468 ## </param>
2469 #
2470 interface(`userdom_manage_user_home_content_symlinks',`
2471         gen_require(`
2472                 type user_home_dir_t, user_home_t;
2473         ')
2474
2475         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2476         allow $1 user_home_dir_t:dir search_dir_perms;
2477         files_search_home($1)
2478 ')
2479
2480 ########################################
2481 ## <summary>
2482 ##      Delete symbolic links in a user home directory.
2483 ## </summary>
2484 ## <param name="domain">
2485 ##      <summary>
2486 ##      Domain allowed access.
2487 ##      </summary>
2488 ## </param>
2489 #
2490 interface(`userdom_delete_user_home_content_symlinks',`
2491         gen_require(`
2492                 type user_home_t;
2493         ')
2494
2495         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2496 ')
2497
2498 ########################################
2499 ## <summary>
2500 ##      Delete all symbolic links in a user home directory.
2501 ## </summary>
2502 ## <param name="domain">
2503 ##      <summary>
2504 ##      Domain allowed access.
2505 ##      </summary>
2506 ## </param>
2507 #
2508 interface(`userdom_delete_all_user_home_content_symlinks',`
2509         gen_require(`
2510                 attribute user_home_type;
2511         ')
2512
2513         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2514 ')
2515
2516 ########################################
2517 ## <summary>
2518 ##      Create, read, write, and delete named pipes
2519 ##      in a user home subdirectory.
2520 ## </summary>
2521 ## <param name="domain">
2522 ##      <summary>
2523 ##      Domain allowed access.
2524 ##      </summary>
2525 ## </param>
2526 #
2527 interface(`userdom_manage_user_home_content_pipes',`
2528         gen_require(`
2529                 type user_home_dir_t, user_home_t;
2530         ')
2531
2532         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2533         allow $1 user_home_dir_t:dir search_dir_perms;
2534         files_search_home($1)
2535 ')
2536
2537 ########################################
2538 ## <summary>
2539 ##      Create, read, write, and delete named sockets
2540 ##      in a user home subdirectory.
2541 ## </summary>
2542 ## <param name="domain">
2543 ##      <summary>
2544 ##      Domain allowed access.
2545 ##      </summary>
2546 ## </param>
2547 #
2548 interface(`userdom_manage_user_home_content_sockets',`
2549         gen_require(`
2550                 type user_home_dir_t, user_home_t;
2551         ')
2552
2553         allow $1 user_home_dir_t:dir search_dir_perms;
2554         manage_sock_files_pattern($1, user_home_t, user_home_t)
2555         files_search_home($1)
2556 ')
2557
2558 ########################################
2559 ## <summary>
2560 ##      Create objects in a user home directory
2561 ##      with an automatic type transition to
2562 ##      a specified private type.
2563 ## </summary>
2564 ## <param name="domain">
2565 ##      <summary>
2566 ##      Domain allowed access.
2567 ##      </summary>
2568 ## </param>
2569 ## <param name="private_type">
2570 ##      <summary>
2571 ##      The type of the object to create.
2572 ##      </summary>
2573 ## </param>
2574 ## <param name="object_class">
2575 ##      <summary>
2576 ##      The class of the object to be created.
2577 ##      </summary>
2578 ## </param>
2579 #
2580 interface(`userdom_user_home_dir_filetrans',`
2581         gen_require(`
2582                 type user_home_dir_t;
2583         ')
2584
2585         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2586         files_search_home($1)
2587 ')
2588
2589 ########################################
2590 ## <summary>
2591 ##      Create objects in a user home directory
2592 ##      with an automatic type transition to
2593 ##      a specified private type.
2594 ## </summary>
2595 ## <param name="domain">
2596 ##      <summary>
2597 ##      Domain allowed access.
2598 ##      </summary>
2599 ## </param>
2600 ## <param name="private_type">
2601 ##      <summary>
2602 ##      The type of the object to create.
2603 ##      </summary>
2604 ## </param>
2605 ## <param name="object_class">
2606 ##      <summary>
2607 ##      The class of the object to be created.
2608 ##      </summary>
2609 ## </param>
2610 #
2611 interface(`userdom_user_home_content_filetrans',`
2612         gen_require(`
2613                 type user_home_dir_t, user_home_t;
2614         ')
2615
2616         filetrans_pattern($1, user_home_t, $2, $3, $4)
2617         allow $1 user_home_dir_t:dir search_dir_perms;
2618         files_search_home($1)
2619 ')
2620
2621 ########################################
2622 ## <summary>
2623 ##      Create objects in a user home directory
2624 ##      with an automatic type transition to
2625 ##      the user home file type.
2626 ## </summary>
2627 ## <param name="domain">
2628 ##      <summary>
2629 ##      Domain allowed access.
2630 ##      </summary>
2631 ## </param>
2632 ## <param name="object_class">
2633 ##      <summary>
2634 ##      The class of the object to be created.
2635 ##      </summary>
2636 ## </param>
2637 #
2638 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2639         gen_require(`
2640                 type user_home_dir_t, user_home_t;
2641         ')
2642
2643         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2644         files_search_home($1)
2645 ')
2646
2647 ########################################
2648 ## <summary>
2649 ##      Write to user temporary named sockets.
2650 ## </summary>
2651 ## <param name="domain">
2652 ##      <summary>
2653 ##      Domain allowed access.
2654 ##      </summary>
2655 ## </param>
2656 #
2657 interface(`userdom_write_user_tmp_sockets',`
2658         gen_require(`
2659                 type user_tmp_t;
2660         ')
2661
2662         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2663         files_search_tmp($1)
2664 ')
2665
2666 ########################################
2667 ## <summary>
2668 ##      List user temporary directories.
2669 ## </summary>
2670 ## <param name="domain">
2671 ##      <summary>
2672 ##      Domain allowed access.
2673 ##      </summary>
2674 ## </param>
2675 #
2676 interface(`userdom_list_user_tmp',`
2677         gen_require(`
2678                 type user_tmp_t;
2679         ')
2680
2681         allow $1 user_tmp_t:dir list_dir_perms;
2682         files_search_tmp($1)
2683 ')
2684
2685 ########################################
2686 ## <summary>
2687 ##      Do not audit attempts to list user
2688 ##      temporary directories.
2689 ## </summary>
2690 ## <param name="domain">
2691 ##      <summary>
2692 ##      Domain to not audit.
2693 ##      </summary>
2694 ## </param>
2695 #
2696 interface(`userdom_dontaudit_list_user_tmp',`
2697         gen_require(`
2698                 type user_tmp_t;
2699         ')
2700
2701         dontaudit $1 user_tmp_t:dir list_dir_perms;
2702 ')
2703
2704 ########################################
2705 ## <summary>
2706 ##      Do not audit attempts to manage users
2707 ##      temporary directories.
2708 ## </summary>
2709 ## <param name="domain">
2710 ##      <summary>
2711 ##      Domain to not audit.
2712 ##      </summary>
2713 ## </param>
2714 #
2715 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2716         gen_require(`
2717                 type user_tmp_t;
2718         ')
2719
2720         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2721 ')
2722
2723 ########################################
2724 ## <summary>
2725 ##      Read user temporary files.
2726 ## </summary>
2727 ## <param name="domain">
2728 ##      <summary>
2729 ##      Domain allowed access.
2730 ##      </summary>
2731 ## </param>
2732 #
2733 interface(`userdom_read_user_tmp_files',`
2734         gen_require(`
2735                 type user_tmp_t;
2736         ')
2737
2738         read_files_pattern($1, user_tmp_t, user_tmp_t)
2739         allow $1 user_tmp_t:dir list_dir_perms;
2740         files_search_tmp($1)
2741 ')
2742
2743 ########################################
2744 ## <summary>
2745 ##      Do not audit attempts to read users
2746 ##      temporary files.
2747 ## </summary>
2748 ## <param name="domain">
2749 ##      <summary>
2750 ##      Domain to not audit.
2751 ##      </summary>
2752 ## </param>
2753 #
2754 interface(`userdom_dontaudit_read_user_tmp_files',`
2755         gen_require(`
2756                 type user_tmp_t;
2757         ')
2758
2759         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2760 ')
2761
2762 ########################################
2763 ## <summary>
2764 ##      Do not audit attempts to append users
2765 ##      temporary files.
2766 ## </summary>
2767 ## <param name="domain">
2768 ##      <summary>
2769 ##      Domain to not audit.
2770 ##      </summary>
2771 ## </param>
2772 #
2773 interface(`userdom_dontaudit_append_user_tmp_files',`
2774         gen_require(`
2775                 type user_tmp_t;
2776         ')
2777
2778         dontaudit $1 user_tmp_t:file append_file_perms;
2779 ')
2780
2781 ########################################
2782 ## <summary>
2783 ##      Read and write user temporary files.
2784 ## </summary>
2785 ## <param name="domain">
2786 ##      <summary>
2787 ##      Domain allowed access.
2788 ##      </summary>
2789 ## </param>
2790 #
2791 interface(`userdom_rw_user_tmp_files',`
2792         gen_require(`
2793                 type user_tmp_t;
2794         ')
2795
2796         allow $1 user_tmp_t:dir list_dir_perms;
2797         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2798         files_search_tmp($1)
2799 ')
2800
2801 ########################################
2802 ## <summary>
2803 ##      Do not audit attempts to manage users
2804 ##      temporary files.
2805 ## </summary>
2806 ## <param name="domain">
2807 ##      <summary>
2808 ##      Domain to not audit.
2809 ##      </summary>
2810 ## </param>
2811 #
2812 interface(`userdom_dontaudit_manage_user_tmp_files',`
2813         gen_require(`
2814                 type user_tmp_t;
2815         ')
2816
2817         dontaudit $1 user_tmp_t:file manage_file_perms;
2818 ')
2819
2820 ########################################
2821 ## <summary>
2822 ##      Read user temporary symbolic links.
2823 ## </summary>
2824 ## <param name="domain">
2825 ##      <summary>
2826 ##      Domain allowed access.
2827 ##      </summary>
2828 ## </param>
2829 #
2830 interface(`userdom_read_user_tmp_symlinks',`
2831         gen_require(`
2832                 type user_tmp_t;
2833         ')
2834
2835         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2836         allow $1 user_tmp_t:dir list_dir_perms;
2837         files_search_tmp($1)
2838 ')
2839
2840 ########################################
2841 ## <summary>
2842 ##      Create, read, write, and delete user
2843 ##      temporary directories.
2844 ## </summary>
2845 ## <param name="domain">
2846 ##      <summary>
2847 ##      Domain allowed access.
2848 ##      </summary>
2849 ## </param>
2850 #
2851 interface(`userdom_manage_user_tmp_dirs',`
2852         gen_require(`
2853                 type user_tmp_t;
2854         ')
2855
2856         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2857         files_search_tmp($1)
2858 ')
2859
2860 ########################################
2861 ## <summary>
2862 ##      Create, read, write, and delete user
2863 ##      temporary files.
2864 ## </summary>
2865 ## <param name="domain">
2866 ##      <summary>
2867 ##      Domain allowed access.
2868 ##      </summary>
2869 ## </param>
2870 #
2871 interface(`userdom_manage_user_tmp_files',`
2872         gen_require(`
2873                 type user_tmp_t;
2874         ')
2875
2876         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2877         files_search_tmp($1)
2878 ')
2879
2880 ########################################
2881 ## <summary>
2882 ##      Create, read, write, and delete user
2883 ##      temporary symbolic links.
2884 ## </summary>
2885 ## <param name="domain">
2886 ##      <summary>
2887 ##      Domain allowed access.
2888 ##      </summary>
2889 ## </param>
2890 #
2891 interface(`userdom_manage_user_tmp_symlinks',`
2892         gen_require(`
2893                 type user_tmp_t;
2894         ')
2895
2896         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2897         files_search_tmp($1)
2898 ')
2899
2900 ########################################
2901 ## <summary>
2902 ##      Create, read, write, and delete user
2903 ##      temporary named pipes.
2904 ## </summary>
2905 ## <param name="domain">
2906 ##      <summary>
2907 ##      Domain allowed access.
2908 ##      </summary>
2909 ## </param>
2910 #
2911 interface(`userdom_manage_user_tmp_pipes',`
2912         gen_require(`
2913                 type user_tmp_t;
2914         ')
2915
2916         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2917         files_search_tmp($1)
2918 ')
2919
2920 ########################################
2921 ## <summary>
2922 ##      Create, read, write, and delete user
2923 ##      temporary named sockets.
2924 ## </summary>
2925 ## <param name="domain">
2926 ##      <summary>
2927 ##      Domain allowed access.
2928 ##      </summary>
2929 ## </param>
2930 #
2931 interface(`userdom_manage_user_tmp_sockets',`
2932         gen_require(`
2933                 type user_tmp_t;
2934         ')
2935
2936         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2937         files_search_tmp($1)
2938 ')
2939
2940 ########################################
2941 ## <summary>
2942 ##      Create objects in a user temporary directory
2943 ##      with an automatic type transition to
2944 ##      a specified private type.
2945 ## </summary>
2946 ## <param name="domain">
2947 ##      <summary>
2948 ##      Domain allowed access.
2949 ##      </summary>
2950 ## </param>
2951 ## <param name="private_type">
2952 ##      <summary>
2953 ##      The type of the object to create.
2954 ##      </summary>
2955 ## </param>
2956 ## <param name="object_class">
2957 ##      <summary>
2958 ##      The class of the object to be created.
2959 ##      </summary>
2960 ## </param>
2961 #
2962 interface(`userdom_user_tmp_filetrans',`
2963         gen_require(`
2964                 type user_tmp_t;
2965         ')
2966
2967         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2968         files_search_tmp($1)
2969 ')
2970
2971 ########################################
2972 ## <summary>
2973 ##      Create objects in the temporary directory
2974 ##      with an automatic type transition to
2975 ##      the user temporary type.
2976 ## </summary>
2977 ## <param name="domain">
2978 ##      <summary>
2979 ##      Domain allowed access.
2980 ##      </summary>
2981 ## </param>
2982 ## <param name="object_class">
2983 ##      <summary>
2984 ##      The class of the object to be created.
2985 ##      </summary>
2986 ## </param>
2987 #
2988 interface(`userdom_tmp_filetrans_user_tmp',`
2989         gen_require(`
2990                 type user_tmp_t;
2991         ')
2992
2993         files_tmp_filetrans($1, user_tmp_t, $2)
2994 ')
2995
2996 #######################################
2997 ## <summary>
2998 ##  Getattr user tmpfs files.
2999 ## </summary>
3000 ## <param name="domain">
3001 ##  <summary>
3002 ##  Domain allowed access.
3003 ##  </summary>
3004 ## </param>
3005 #
3006 interface(`userdom_getattr_user_tmpfs_files',`
3007     gen_require(`
3008         type user_tmpfs_t;
3009     ')
3010
3011     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3012     fs_search_tmpfs($1)
3013 ')
3014
3015 ########################################
3016 ## <summary>
3017 ##      Read user tmpfs files.
3018 ## </summary>
3019 ## <param name="domain">
3020 ##      <summary>
3021 ##      Domain allowed access.
3022 ##      </summary>
3023 ## </param>
3024 #
3025 interface(`userdom_read_user_tmpfs_files',`
3026         gen_require(`
3027                 type user_tmpfs_t;
3028         ')
3029
3030         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3031         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3032         allow $1 user_tmpfs_t:dir list_dir_perms;
3033         fs_search_tmpfs($1)
3034 ')
3035
3036 ########################################
3037 ## <summary>
3038 ##      Read/Write user tmpfs files.
3039 ## </summary>
3040 ## <param name="domain">
3041 ##      <summary>
3042 ##      Domain allowed access.
3043 ##      </summary>
3044 ## </param>
3045 #
3046 interface(`userdom_rw_user_tmpfs_files',`
3047         gen_require(`
3048                 type user_tmpfs_t;
3049         ')
3050
3051         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3052         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3053         allow $1 user_tmpfs_t:dir list_dir_perms;
3054         fs_search_tmpfs($1)
3055 ')
3056
3057 ########################################
3058 ## <summary>
3059 ##      Read/Write inherited user tmpfs files.
3060 ## </summary>
3061 ## <param name="domain">
3062 ##      <summary>
3063 ##      Domain allowed access.
3064 ##      </summary>
3065 ## </param>
3066 #
3067 interface(`userdom_rw_inherited_user_tmpfs_files',`
3068         gen_require(`
3069                 type user_tmpfs_t;
3070         ')
3071
3072         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3073 ')
3074
3075 ########################################
3076 ## <summary>
3077 ##      Execute user tmpfs files.
3078 ## </summary>
3079 ## <param name="domain">
3080 ##      <summary>
3081 ##      Domain allowed access.
3082 ##      </summary>
3083 ## </param>
3084 #
3085 interface(`userdom_execute_user_tmpfs_files',`
3086         gen_require(`
3087                 type user_tmpfs_t;
3088         ')
3089
3090         allow $1 user_tmpfs_t:file execute;
3091 ')
3092
3093 ########################################
3094 ## <summary>
3095 ##      Get the attributes of a user domain tty.
3096 ## </summary>
3097 ## <param name="domain">
3098 ##      <summary>
3099 ##      Domain allowed access.
3100 ##      </summary>
3101 ## </param>
3102 #
3103 interface(`userdom_getattr_user_ttys',`
3104         gen_require(`
3105                 type user_tty_device_t;
3106         ')
3107
3108         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3109 ')
3110
3111 ########################################
3112 ## <summary>
3113 ##      Do not audit attempts to get the attributes of a user domain tty.
3114 ## </summary>
3115 ## <param name="domain">
3116 ##      <summary>
3117 ##      Domain to not audit.
3118 ##      </summary>
3119 ## </param>
3120 #
3121 interface(`userdom_dontaudit_getattr_user_ttys',`
3122         gen_require(`
3123                 type user_tty_device_t;
3124         ')
3125
3126         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3127 ')
3128
3129 ########################################
3130 ## <summary>
3131 ##      Set the attributes of a user domain tty.
3132 ## </summary>
3133 ## <param name="domain">
3134 ##      <summary>
3135 ##      Domain allowed access.
3136 ##      </summary>
3137 ## </param>
3138 #
3139 interface(`userdom_setattr_user_ttys',`
3140         gen_require(`
3141                 type user_tty_device_t;
3142         ')
3143
3144         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3145 ')
3146
3147 ########################################
3148 ## <summary>
3149 ##      Do not audit attempts to set the attributes of a user domain tty.
3150 ## </summary>
3151 ## <param name="domain">
3152 ##      <summary>
3153 ##      Domain to not audit.
3154 ##      </summary>
3155 ## </param>
3156 #
3157 interface(`userdom_dontaudit_setattr_user_ttys',`
3158         gen_require(`
3159                 type user_tty_device_t;
3160         ')
3161
3162         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3163 ')
3164
3165 ########################################
3166 ## <summary>
3167 ##      Read and write a user domain tty.
3168 ## </summary>
3169 ## <param name="domain">
3170 ##      <summary>
3171 ##      Domain allowed access.
3172 ##      </summary>
3173 ## </param>
3174 #
3175 interface(`userdom_use_user_ttys',`
3176         gen_require(`
3177                 type user_tty_device_t;
3178         ')
3179
3180         allow $1 user_tty_device_t:chr_file rw_term_perms;
3181 ')
3182
3183 ########################################
3184 ## <summary>
3185 ##      Read and write a inherited user domain tty.
3186 ## </summary>
3187 ## <param name="domain">
3188 ##      <summary>
3189 ##      Domain allowed access.
3190 ##      </summary>
3191 ## </param>
3192 #
3193 interface(`userdom_use_inherited_user_ttys',`
3194         gen_require(`
3195                 type user_tty_device_t;
3196         ')
3197
3198         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3199 ')
3200
3201 ########################################
3202 ## <summary>
3203 ##      Read and write a user domain pty.
3204 ## </summary>
3205 ## <param name="domain">
3206 ##      <summary>
3207 ##      Domain allowed access.
3208 ##      </summary>
3209 ## </param>
3210 #
3211 interface(`userdom_use_user_ptys',`
3212         gen_require(`
3213                 type user_devpts_t;
3214         ')
3215
3216         allow $1 user_devpts_t:chr_file rw_term_perms;
3217 ')
3218
3219 ########################################
3220 ## <summary>
3221 ##      Read and write a inherited user domain pty.
3222 ## </summary>
3223 ## <param name="domain">
3224 ##      <summary>
3225 ##      Domain allowed access.
3226 ##      </summary>
3227 ## </param>
3228 #
3229 interface(`userdom_use_inherited_user_ptys',`
3230         gen_require(`
3231                 type user_devpts_t;
3232         ')
3233
3234         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3235 ')
3236
3237 ########################################
3238 ## <summary>
3239 ##      Read and write a inherited user TTYs and PTYs.
3240 ## </summary>
3241 ## <desc>
3242 ##      <p>
3243 ##      Allow the specified domain to read and write inherited user
3244 ##      TTYs and PTYs. This will allow the domain to
3245 ##      interact with the user via the terminal. Typically
3246 ##      all interactive applications will require this
3247 ##      access.
3248 ##      </p>
3249 ## </desc>
3250 ## <param name="domain">
3251 ##      <summary>
3252 ##      Domain allowed access.
3253 ##      </summary>
3254 ## </param>
3255 ## <infoflow type="both" weight="10"/>
3256 #
3257 interface(`userdom_use_inherited_user_terminals',`
3258         gen_require(`
3259                 type user_tty_device_t, user_devpts_t;
3260         ')
3261
3262         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3263         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3264 ')
3265
3266 #######################################
3267 ## <summary>
3268 ##  Allow attempts to read and write
3269 ##  a user domain tty and pty.
3270 ## </summary>
3271 ## <param name="domain">
3272 ##  <summary>
3273 ##  Domain to not audit.
3274 ##  </summary>
3275 ## </param>
3276 #
3277 interface(`userdom_use_user_terminals',`
3278     gen_require(`
3279         type user_tty_device_t, user_devpts_t;
3280     ')
3281
3282     allow $1 user_tty_device_t:chr_file rw_term_perms;
3283     allow $1 user_devpts_t:chr_file rw_term_perms;
3284 ')
3285
3286 ########################################
3287 ## <summary>
3288 ##      Do not audit attempts to read and write
3289 ##      a user domain tty and pty.
3290 ## </summary>
3291 ## <param name="domain">
3292 ##      <summary>
3293 ##      Domain to not audit.
3294 ##      </summary>
3295 ## </param>
3296 #
3297 interface(`userdom_dontaudit_use_user_terminals',`
3298         gen_require(`
3299                 type user_tty_device_t, user_devpts_t;
3300         ')
3301
3302         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3303         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3304 ')
3305
3306
3307 ########################################
3308 ## <summary>
3309 ##      Get attributes of user domain tty and pty.
3310 ## </summary>
3311 ## <param name="domain">
3312 ##      <summary>
3313 ##      Domain allowed access.
3314 ##      </summary>
3315 ## </param>
3316 #
3317 interface(`userdom_getattr_user_terminals',`
3318         gen_require(`
3319                 type user_tty_device_t, user_devpts_t;
3320         ')
3321
3322         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3323 ')
3324
3325 ########################################
3326 ## <summary>
3327 ##      Execute a shell in all user domains.  This
3328 ##      is an explicit transition, requiring the
3329 ##      caller to use setexeccon().
3330 ## </summary>
3331 ## <param name="domain">
3332 ##      <summary>
3333 ##      Domain allowed to transition.
3334 ##      </summary>
3335 ## </param>
3336 #
3337 interface(`userdom_spec_domtrans_all_users',`
3338         gen_require(`
3339                 attribute userdomain;
3340         ')
3341
3342         corecmd_shell_spec_domtrans($1, userdomain)
3343         allow userdomain $1:fd use;
3344         allow userdomain $1:fifo_file rw_file_perms;
3345         allow userdomain $1:process sigchld;
3346 ')
3347
3348 ########################################
3349 ## <summary>
3350 ##      Execute an Xserver session in all unprivileged user domains.  This
3351 ##      is an explicit transition, requiring the
3352 ##      caller to use setexeccon().
3353 ## </summary>
3354 ## <param name="domain">
3355 ##      <summary>
3356 ##      Domain allowed to transition.
3357 ##      </summary>
3358 ## </param>
3359 #
3360 interface(`userdom_xsession_spec_domtrans_all_users',`
3361         gen_require(`
3362                 attribute userdomain;
3363         ')
3364
3365         xserver_xsession_spec_domtrans($1, userdomain)
3366         allow userdomain $1:fd use;
3367         allow userdomain $1:fifo_file rw_file_perms;
3368         allow userdomain $1:process sigchld;
3369 ')
3370
3371 ########################################
3372 ## <summary>
3373 ##      Execute a shell in all unprivileged user domains.  This
3374 ##      is an explicit transition, requiring the
3375 ##      caller to use setexeccon().
3376 ## </summary>
3377 ## <param name="domain">
3378 ##      <summary>
3379 ##      Domain allowed to transition.
3380 ##      </summary>
3381 ## </param>
3382 #
3383 interface(`userdom_spec_domtrans_unpriv_users',`
3384         gen_require(`
3385                 attribute unpriv_userdomain;
3386         ')
3387
3388         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3389         allow unpriv_userdomain $1:fd use;
3390         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3391         allow unpriv_userdomain $1:process sigchld;
3392 ')
3393
3394 #####################################
3395 ## <summary>
3396 ##  Allow domain dyntrans to unpriv userdomain.
3397 ## </summary>
3398 ## <param name="domain">
3399 ##  <summary>
3400 ##  Domain allowed access.
3401 ##  </summary>
3402 ## </param>
3403 #
3404 interface(`userdom_dyntransition_unpriv_users',`
3405     gen_require(`
3406         attribute unpriv_userdomain;
3407     ')
3408
3409     allow $1 unpriv_userdomain:process dyntransition;
3410 ')
3411
3412 ########################################
3413 ## <summary>
3414 ##      Execute an Xserver session in all unprivileged user domains.  This
3415 ##      is an explicit transition, requiring the
3416 ##      caller to use setexeccon().
3417 ## </summary>
3418 ## <param name="domain">
3419 ##      <summary>
3420 ##      Domain allowed to transition.
3421 ##      </summary>
3422 ## </param>
3423 #
3424 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3425         gen_require(`
3426                 attribute unpriv_userdomain;
3427         ')
3428
3429         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3430         allow unpriv_userdomain $1:fd use;
3431         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3432         allow unpriv_userdomain $1:process sigchld;
3433 ')
3434
3435 ########################################
3436 ## <summary>
3437 ##      Manage unpriviledged user SysV sempaphores.
3438 ## </summary>
3439 ## <param name="domain">
3440 ##      <summary>
3441 ##      Domain allowed access.
3442 ##      </summary>
3443 ## </param>
3444 #
3445 interface(`userdom_manage_unpriv_user_semaphores',`
3446         gen_require(`
3447                 attribute unpriv_userdomain;
3448         ')
3449
3450         allow $1 unpriv_userdomain:sem create_sem_perms;
3451 ')
3452
3453 ########################################
3454 ## <summary>
3455 ##      Manage unpriviledged user SysV shared
3456 ##      memory segments.
3457 ## </summary>
3458 ## <param name="domain">
3459 ##      <summary>
3460 ##      Domain allowed access.
3461 ##      </summary>
3462 ## </param>
3463 #
3464 interface(`userdom_manage_unpriv_user_shared_mem',`
3465         gen_require(`
3466                 attribute unpriv_userdomain;
3467         ')
3468
3469         allow $1 unpriv_userdomain:shm create_shm_perms;
3470 ')
3471
3472 ########################################
3473 ## <summary>
3474 ##      Execute bin_t in the unprivileged user domains. This
3475 ##      is an explicit transition, requiring the
3476 ##      caller to use setexeccon().
3477 ## </summary>
3478 ## <param name="domain">
3479 ##      <summary>
3480 ##      Domain allowed to transition.
3481 ##      </summary>
3482 ## </param>
3483 #
3484 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3485         gen_require(`
3486                 attribute unpriv_userdomain;
3487         ')
3488
3489         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3490         allow unpriv_userdomain $1:fd use;
3491         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3492         allow unpriv_userdomain $1:process sigchld;
3493 ')
3494
3495 ########################################
3496 ## <summary>
3497 ##      Execute all entrypoint files in unprivileged user
3498 ##      domains. This is an explicit transition, requiring the
3499 ##      caller to use setexeccon().
3500 ## </summary>
3501 ## <param name="domain">
3502 ##      <summary>
3503 ##      Domain allowed access.
3504 ##      </summary>
3505 ## </param>
3506 #
3507 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3508         gen_require(`
3509                 attribute unpriv_userdomain;
3510         ')
3511
3512         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3513         allow unpriv_userdomain $1:fd use;
3514         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3515         allow unpriv_userdomain $1:process sigchld;
3516 ')
3517
3518 ########################################
3519 ## <summary>
3520 ##      Search users home directories.
3521 ## </summary>
3522 ## <param name="domain">
3523 ##      <summary>
3524 ##      Domain allowed access.
3525 ##      </summary>
3526 ## </param>
3527 #
3528 interface(`userdom_search_user_home_content',`
3529         gen_require(`
3530                 type user_home_dir_t;
3531                 attribute user_home_type;
3532         ')
3533
3534         files_list_home($1)
3535         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3536         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3537 ')
3538
3539 ########################################
3540 ## <summary>
3541 ##      Send general signals to unprivileged user domains.
3542 ## </summary>
3543 ## <param name="domain">
3544 ##      <summary>
3545 ##      Domain allowed access.
3546 ##      </summary>
3547 ## </param>
3548 #
3549 interface(`userdom_signal_unpriv_users',`
3550         gen_require(`
3551                 attribute unpriv_userdomain;
3552         ')
3553
3554         allow $1 unpriv_userdomain:process signal;
3555 ')
3556
3557 ########################################
3558 ## <summary>
3559 ##      Inherit the file descriptors from unprivileged user domains.
3560 ## </summary>
3561 ## <param name="domain">
3562 ##      <summary>
3563 ##      Domain allowed access.
3564 ##      </summary>
3565 ## </param>
3566 #
3567 interface(`userdom_use_unpriv_users_fds',`
3568         gen_require(`
3569                 attribute unpriv_userdomain;
3570         ')
3571
3572         allow $1 unpriv_userdomain:fd use;
3573 ')
3574
3575 ########################################
3576 ## <summary>
3577 ##      Do not audit attempts to inherit the file descriptors
3578 ##      from unprivileged user domains.
3579 ## </summary>
3580 ## <desc>
3581 ##      <p>
3582 ##      Do not audit attempts to inherit the file descriptors
3583 ##      from unprivileged user domains. This will supress
3584 ##      SELinux denial messages when the specified domain is denied
3585 ##      the permission to inherit these file descriptors.
3586 ##      </p>
3587 ## </desc>
3588 ## <param name="domain">
3589 ##      <summary>
3590 ##      Domain to not audit.
3591 ##      </summary>
3592 ## </param>
3593 ## <infoflow type="none"/>
3594 #
3595 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3596         gen_require(`
3597                 attribute unpriv_userdomain;
3598         ')
3599
3600         dontaudit $1 unpriv_userdomain:fd use;
3601 ')
3602
3603 ########################################
3604 ## <summary>
3605 ##      Do not audit attempts to use user ptys.
3606 ## </summary>
3607 ## <param name="domain">
3608 ##      <summary>
3609 ##      Domain to not audit.
3610 ##      </summary>
3611 ## </param>
3612 #
3613 interface(`userdom_dontaudit_use_user_ptys',`
3614         gen_require(`
3615                 type user_devpts_t;
3616         ')
3617
3618         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3619 ')
3620
3621 ########################################
3622 ## <summary>
3623 ##      Relabel files to unprivileged user pty types.
3624 ## </summary>
3625 ## <param name="domain">
3626 ##      <summary>
3627 ##      Domain allowed access.
3628 ##      </summary>
3629 ## </param>
3630 #
3631 interface(`userdom_relabelto_user_ptys',`
3632         gen_require(`
3633                 type user_devpts_t;
3634         ')
3635
3636         allow $1 user_devpts_t:chr_file relabelto;
3637 ')
3638
3639 ########################################
3640 ## <summary>
3641 ##      Do not audit attempts to relabel files from
3642 ##      user pty types.
3643 ## </summary>
3644 ## <param name="domain">
3645 ##      <summary>
3646 ##      Domain to not audit.
3647 ##      </summary>
3648 ## </param>
3649 #
3650 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3651         gen_require(`
3652                 type user_devpts_t;
3653         ')
3654
3655         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3656 ')
3657
3658 ########################################
3659 ## <summary>
3660 ##      Write all users files in /tmp
3661 ## </summary>
3662 ## <param name="domain">
3663 ##      <summary>
3664 ##      Domain allowed access.
3665 ##      </summary>
3666 ## </param>
3667 #
3668 interface(`userdom_write_user_tmp_files',`
3669         gen_require(`
3670                 type user_tmp_t;
3671         ')
3672
3673         write_files_pattern($1, user_tmp_t, user_tmp_t)
3674 ')
3675
3676 ########################################
3677 ## <summary>
3678 ##      Do not audit attempts to write users
3679 ##      temporary files.
3680 ## </summary>
3681 ## <param name="domain">
3682 ##      <summary>
3683 ##      Domain to not audit.
3684 ##      </summary>
3685 ## </param>
3686 #
3687 interface(`userdom_dontaudit_write_user_tmp_files',`
3688         gen_require(`
3689                 type user_tmp_t;
3690         ')
3691
3692         dontaudit $1 user_tmp_t:file write;
3693 ')
3694
3695 ########################################
3696 ## <summary>
3697 ##      Do not audit attempts to read/write users
3698 ##      temporary fifo files.
3699 ## </summary>
3700 ## <param name="domain">
3701 ##      <summary>
3702 ##      Domain to not audit.
3703 ##      </summary>
3704 ## </param>
3705 #
3706 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3707         gen_require(`
3708                 type user_tmp_t;
3709         ')
3710
3711         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3712 ')
3713
3714 ########################################
3715 ## <summary>
3716 ##      Do not audit attempts to use user ttys.
3717 ## </summary>
3718 ## <param name="domain">
3719 ##      <summary>
3720 ##      Domain to not audit.
3721 ##      </summary>
3722 ## </param>
3723 #
3724 interface(`userdom_dontaudit_use_user_ttys',`
3725         gen_require(`
3726                 type user_tty_device_t;
3727         ')
3728
3729         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3730 ')
3731
3732 ########################################
3733 ## <summary>
3734 ##      Read the process state of all user domains.
3735 ## </summary>
3736 ## <param name="domain">
3737 ##      <summary>
3738 ##      Domain allowed access.
3739 ##      </summary>
3740 ## </param>
3741 #
3742 interface(`userdom_read_all_users_state',`
3743         gen_require(`
3744                 attribute userdomain;
3745         ')
3746
3747         read_files_pattern($1, userdomain, userdomain)
3748         read_lnk_files_pattern($1,userdomain,userdomain)
3749         kernel_search_proc($1)
3750 ')
3751
3752 ########################################
3753 ## <summary>
3754 ##      Get the attributes of all user domains.
3755 ## </summary>
3756 ## <param name="domain">
3757 ##      <summary>
3758 ##      Domain allowed access.
3759 ##      </summary>
3760 ## </param>
3761 #
3762 interface(`userdom_getattr_all_users',`
3763         gen_require(`
3764                 attribute userdomain;
3765         ')
3766
3767         allow $1 userdomain:process getattr;
3768 ')
3769
3770 ########################################
3771 ## <summary>
3772 ##      Inherit the file descriptors from all user domains
3773 ## </summary>
3774 ## <param name="domain">
3775 ##      <summary>
3776 ##      Domain allowed access.
3777 ##      </summary>
3778 ## </param>
3779 #
3780 interface(`userdom_use_all_users_fds',`
3781         gen_require(`
3782                 attribute userdomain;
3783         ')
3784
3785         allow $1 userdomain:fd use;
3786 ')
3787
3788 ########################################
3789 ## <summary>
3790 ##      Do not audit attempts to inherit the file
3791 ##      descriptors from any user domains.
3792 ## </summary>
3793 ## <param name="domain">
3794 ##      <summary>
3795 ##      Domain to not audit.
3796 ##      </summary>
3797 ## </param>
3798 #
3799 interface(`userdom_dontaudit_use_all_users_fds',`
3800         gen_require(`
3801                 attribute userdomain;
3802         ')
3803
3804         dontaudit $1 userdomain:fd use;
3805 ')
3806
3807 ########################################
3808 ## <summary>
3809 ##      Send general signals to all user domains.
3810 ## </summary>
3811 ## <param name="domain">
3812 ##      <summary>
3813 ##      Domain allowed access.
3814 ##      </summary>
3815 ## </param>
3816 #
3817 interface(`userdom_signal_all_users',`
3818         gen_require(`
3819                 attribute userdomain;
3820         ')
3821
3822         allow $1 userdomain:process signal;
3823 ')
3824
3825 ########################################
3826 ## <summary>
3827 ##      Send kill signals to all user domains.
3828 ## </summary>
3829 ## <param name="domain">
3830 ##      <summary>
3831 ##      Domain allowed access.
3832 ##      </summary>
3833 ## </param>
3834 #
3835 interface(`userdom_kill_all_users',`
3836         gen_require(`
3837                 attribute userdomain;
3838         ')
3839
3840         allow $1 userdomain:process sigkill;
3841 ')
3842
3843 ########################################
3844 ## <summary>
3845 ##      Send a SIGCHLD signal to all user domains.
3846 ## </summary>
3847 ## <param name="domain">
3848 ##      <summary>
3849 ##      Domain allowed access.
3850 ##      </summary>
3851 ## </param>
3852 #
3853 interface(`userdom_sigchld_all_users',`
3854         gen_require(`
3855                 attribute userdomain;
3856         ')
3857
3858         allow $1 userdomain:process sigchld;
3859 ')
3860
3861 ########################################
3862 ## <summary>
3863 ##      Read keys for all user domains.
3864 ## </summary>
3865 ## <param name="domain">
3866 ##      <summary>
3867 ##      Domain allowed access.
3868 ##      </summary>
3869 ## </param>
3870 #
3871 interface(`userdom_read_all_users_keys',`
3872         gen_require(`
3873                 attribute userdomain;
3874         ')
3875
3876         allow $1 userdomain:key read;
3877 ')
3878
3879 ########################################
3880 ## <summary>
3881 ##      Create keys for all user domains.
3882 ## </summary>
3883 ## <param name="domain">
3884 ##      <summary>
3885 ##      Domain allowed access.
3886 ##      </summary>
3887 ## </param>
3888 #
3889 interface(`userdom_create_all_users_keys',`
3890         gen_require(`
3891                 attribute userdomain;
3892         ')
3893
3894         allow $1 userdomain:key create;
3895 ')
3896
3897 ########################################
3898 ## <summary>
3899 ##      Send a dbus message to all user domains.
3900 ## </summary>
3901 ## <param name="domain">
3902 ##      <summary>
3903 ##      Domain allowed access.
3904 ##      </summary>
3905 ## </param>
3906 #
3907 interface(`userdom_dbus_send_all_users',`
3908         gen_require(`
3909                 attribute userdomain;
3910                 class dbus send_msg;
3911         ')
3912
3913         allow $1 userdomain:dbus send_msg;
3914 ')
3915
3916 ########################################
3917 ## <summary>
3918 ##      Allow apps to set rlimits on userdomain
3919 ## </summary>
3920 ## <param name="domain">
3921 ##      <summary>
3922 ##      Domain allowed access.
3923 ##      </summary>
3924 ## </param>
3925 #
3926 interface(`userdom_set_rlimitnh',`
3927         gen_require(`
3928                 attribute userdomain;
3929         ')
3930
3931         allow $1 userdomain:process rlimitinh;
3932 ')
3933
3934 ########################################
3935 ## <summary>
3936 ##      Define this type as a Allow apps to set rlimits on userdomain
3937 ## </summary>
3938 ## <param name="domain">
3939 ##      <summary>
3940 ##      Domain allowed access.
3941 ##      </summary>
3942 ## </param>
3943 ## <param name="userdomain_prefix">
3944 ##      <summary>
3945 ##      The prefix of the user domain (e.g., user
3946 ##      is the prefix for user_t).
3947 ## </summary>
3948 ## </param>
3949 ## <param name="domain">
3950 ##      <summary>
3951 ##      Domain allowed access.
3952 ##      </summary>
3953 ## </param>
3954 #
3955 template(`userdom_unpriv_usertype',`
3956         gen_require(`
3957                 attribute unpriv_userdomain, userdomain;
3958                 attribute $1_usertype;
3959         ')
3960         typeattribute $2  $1_usertype;
3961         typeattribute $2  unpriv_userdomain;
3962         typeattribute $2  userdomain;
3963
3964         auth_use_nsswitch($2)
3965         ubac_constrained($2)
3966 ')
3967
3968 #######################################
3969 ## <summary>
3970 ##  Define this type as a Allow apps to set rlimits on userdomain
3971 ## </summary>
3972 ## <param name="domain">
3973 ##  <summary>
3974 ##  Domain allowed access.
3975 ##  </summary>
3976 ## </param>
3977 ## <param name="userdomain_prefix">
3978 ##  <summary>
3979 ##  The prefix of the user domain (e.g., user
3980 ##  is the prefix for user_t).
3981 ## </summary>
3982 ## </param>
3983 ## <param name="domain">
3984 ##  <summary>
3985 ##  Domain allowed access.
3986 ##  </summary>
3987 ## </param>
3988 #
3989 template(`userdom_unpriv_type',`
3990     gen_require(`
3991         attribute unpriv_userdomain, userdomain;
3992     ')
3993     typeattribute $2  unpriv_userdomain;
3994     typeattribute $2  userdomain;
3995
3996     auth_use_nsswitch($2)
3997     ubac_constrained($2)
3998 ')
3999
4000 ########################################
4001 ## <summary>
4002 ##      Connect to users over an unix stream socket.
4003 ## </summary>
4004 ## <param name="domain">
4005 ##      <summary>
4006 ##      Domain allowed access.
4007 ##      </summary>
4008 ## </param>
4009 #
4010 interface(`userdom_stream_connect',`
4011         gen_require(`
4012                 type user_tmp_t;
4013                 attribute userdomain;
4014         ')
4015
4016         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
4017 ')
4018
4019 ########################################
4020 ## <summary>
4021 ##      Ptrace user domains.
4022 ## </summary>
4023 ## <param name="domain">
4024 ##      <summary>
4025 ##      Domain allowed access.
4026 ##      </summary>
4027 ## </param>
4028 #
4029 interface(`userdom_ptrace_all_users',`
4030         gen_require(`
4031                 attribute userdomain;
4032         ')
4033
4034         tunable_policy(`deny_ptrace',`',`
4035                 allow $1 userdomain:process ptrace;
4036         ')
4037 ')
4038
4039 ########################################
4040 ## <summary>
4041 ##      dontaudit Search /root
4042 ## </summary>
4043 ## <param name="domain">
4044 ##      <summary>
4045 ##      Domain to not audit.
4046 ##      </summary>
4047 ## </param>
4048 #
4049 interface(`userdom_dontaudit_search_admin_dir',`
4050         gen_require(`
4051                 type admin_home_t;
4052         ')
4053
4054         dontaudit $1 admin_home_t:dir search_dir_perms;
4055 ')
4056
4057 ########################################
4058 ## <summary>
4059 ##      dontaudit list /root
4060 ## </summary>
4061 ## <param name="domain">
4062 ##      <summary>
4063 ##      Domain to not audit.
4064 ##      </summary>
4065 ## </param>
4066 #
4067 interface(`userdom_dontaudit_list_admin_dir',`
4068         gen_require(`
4069                 type admin_home_t;
4070         ')
4071
4072         dontaudit $1 admin_home_t:dir list_dir_perms;
4073 ')
4074
4075 ########################################
4076 ## <summary>
4077 ##      Allow domain to  list /root
4078 ## </summary>
4079 ## <param name="domain">
4080 ##      <summary>
4081 ##      Domain allowed access.
4082 ##      </summary>
4083 ## </param>
4084 #
4085 interface(`userdom_list_admin_dir',`
4086         gen_require(`
4087                 type admin_home_t;
4088         ')
4089
4090         allow $1 admin_home_t:dir list_dir_perms;
4091 ')
4092
4093 ########################################
4094 ## <summary>
4095 ##      Allow Search /root
4096 ## </summary>
4097 ## <param name="domain">
4098 ##      <summary>
4099 ##      Domain allowed access.
4100 ##      </summary>
4101 ## </param>
4102 #
4103 interface(`userdom_search_admin_dir',`
4104         gen_require(`
4105                 type admin_home_t;
4106         ')
4107
4108         allow $1 admin_home_t:dir search_dir_perms;
4109 ')
4110
4111 ########################################
4112 ## <summary>
4113 ##      RW unpriviledged user SysV sempaphores.
4114 ## </summary>
4115 ## <param name="domain">
4116 ##      <summary>
4117 ##      Domain allowed access.
4118 ##      </summary>
4119 ## </param>
4120 #
4121 interface(`userdom_rw_semaphores',`
4122         gen_require(`
4123                 attribute unpriv_userdomain;
4124         ')
4125
4126         allow $1 unpriv_userdomain:sem rw_sem_perms;
4127 ')
4128
4129 ########################################
4130 ## <summary>
4131 ##      Send a message to unpriv users over a unix domain
4132 ##      datagram socket.
4133 ## </summary>
4134 ## <param name="domain">
4135 ##      <summary>
4136 ##      Domain allowed access.
4137 ##      </summary>
4138 ## </param>
4139 #
4140 interface(`userdom_dgram_send',`
4141         gen_require(`
4142                 attribute unpriv_userdomain;
4143         ')
4144
4145         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4146 ')
4147
4148 ######################################
4149 ## <summary>
4150 ##      Send a message to users over a unix domain
4151 ##      datagram socket.
4152 ## </summary>
4153 ## <param name="domain">
4154 ##      <summary>
4155 ##      Domain allowed access.
4156 ##      </summary>
4157 ## </param>
4158 #
4159 interface(`userdom_users_dgram_send',`
4160         gen_require(`
4161                  attribute userdomain;
4162       ')
4163
4164        allow $1 userdomain:unix_dgram_socket sendto;
4165 ')
4166
4167 #######################################
4168 ## <summary>
4169 ##      Allow execmod on files in homedirectory
4170 ## </summary>
4171 ## <param name="domain">
4172 ##      <summary>
4173 ##      Domain allowed access.
4174 ##      </summary>
4175 ## </param>
4176 ## <rolebase/>
4177 #
4178 interface(`userdom_execmod_user_home_files',`
4179         gen_require(`
4180                 type user_home_type;
4181         ')
4182
4183         allow $1 user_home_type:file execmod;
4184 ')
4185
4186 ########################################
4187 ## <summary>
4188 ##      Read admin home files.
4189 ## </summary>
4190 ## <param name="domain">
4191 ##      <summary>
4192 ##      Domain allowed access.
4193 ##      </summary>
4194 ## </param>
4195 ## <rolecap/>
4196 #
4197 interface(`userdom_read_admin_home_files',`
4198         gen_require(`
4199                 type admin_home_t;
4200         ')
4201
4202         read_files_pattern($1, admin_home_t, admin_home_t)
4203 ')
4204
4205 ########################################
4206 ## <summary>
4207 ##      Delete admin home files.
4208 ## </summary>
4209 ## <param name="domain">
4210 ##      <summary>
4211 ##      Domain allowed access.
4212 ##      </summary>
4213 ## </param>
4214 ## <rolecap/>
4215 #
4216 interface(`userdom_delete_admin_home_files',`
4217         gen_require(`
4218                 type admin_home_t;
4219         ')
4220
4221         allow $1 admin_home_t:file delete_file_perms;
4222 ')
4223
4224 ########################################
4225 ## <summary>
4226 ##      Execute admin home files.
4227 ## </summary>
4228 ## <param name="domain">
4229 ##      <summary>
4230 ##      Domain allowed access.
4231 ##      </summary>
4232 ## </param>
4233 ## <rolecap/>
4234 #
4235 interface(`userdom_exec_admin_home_files',`
4236         gen_require(`
4237                 type admin_home_t;
4238         ')
4239
4240         exec_files_pattern($1, admin_home_t, admin_home_t)
4241 ')
4242
4243 ########################################
4244 ## <summary>
4245 ##      Append files inherited
4246 ##      in the /root directory.
4247 ## </summary>
4248 ## <param name="domain">
4249 ##      <summary>
4250 ##      Domain allowed access.
4251 ##      </summary>
4252 ## </param>
4253 #
4254 interface(`userdom_inherit_append_admin_home_files',`
4255         gen_require(`
4256                 type admin_home_t;
4257         ')
4258
4259         allow $1 admin_home_t:file { getattr append };
4260 ')
4261
4262
4263 #######################################
4264 ## <summary>
4265 ##      Manage all files/directories in the homedir
4266 ## </summary>
4267 ## <param name="userdomain">
4268 ##      <summary>
4269 ##      The user domain
4270 ##      </summary>
4271 ## </param>
4272 ## <rolebase/>
4273 #
4274 interface(`userdom_manage_user_home_content',`
4275         gen_require(`
4276                 type user_home_dir_t, user_home_t;
4277                 attribute user_home_type;
4278         ')
4279
4280         files_list_home($1)
4281         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4282         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4283         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4284         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4285         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4286         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4287
4288 ')
4289
4290
4291 ########################################
4292 ## <summary>
4293 ##      Create objects in a user home directory
4294 ##      with an automatic type transition to
4295 ##      the user home file type.
4296 ## </summary>
4297 ## <param name="domain">
4298 ##      <summary>
4299 ##      Domain allowed access.
4300 ##      </summary>
4301 ## </param>
4302 ## <param name="object_class">
4303 ##      <summary>
4304 ##      The class of the object to be created.
4305 ##      </summary>
4306 ## </param>
4307 #
4308 interface(`userdom_user_home_dir_filetrans_pattern',`
4309         gen_require(`
4310                 type user_home_dir_t, user_home_t;
4311         ')
4312
4313         type_transition $1 user_home_dir_t:$2 user_home_t;
4314 ')
4315
4316 ########################################
4317 ## <summary>
4318 ##      Create objects in the /root directory
4319 ##      with an automatic type transition to
4320 ##      a specified private type.
4321 ## </summary>
4322 ## <param name="domain">
4323 ##      <summary>
4324 ##      Domain allowed access.
4325 ##      </summary>
4326 ## </param>
4327 ## <param name="private_type">
4328 ##      <summary>
4329 ##      The type of the object to create.
4330 ##      </summary>
4331 ## </param>
4332 ## <param name="object_class">
4333 ##      <summary>
4334 ##      The class of the object to be created.
4335 ##      </summary>
4336 ## </param>
4337 #
4338 interface(`userdom_admin_home_dir_filetrans',`
4339         gen_require(`
4340                 type admin_home_t;
4341         ')
4342
4343         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4344 ')
4345
4346 ########################################
4347 ## <summary>
4348 ##      Send signull to unprivileged user domains.
4349 ## </summary>
4350 ## <param name="domain">
4351 ##      <summary>
4352 ##      Domain allowed access.
4353 ##      </summary>
4354 ## </param>
4355 #
4356 interface(`userdom_signull_unpriv_users',`
4357         gen_require(`
4358                 attribute unpriv_userdomain;
4359         ')
4360
4361         allow $1 unpriv_userdomain:process signull;
4362 ')
4363
4364 ########################################
4365 ## <summary>
4366 ##      Write all users files in /tmp
4367 ## </summary>
4368 ## <param name="domain">
4369 ##      <summary>
4370 ##      Domain allowed access.
4371 ##      </summary>
4372 ## </param>
4373 #
4374 interface(`userdom_write_user_tmp_dirs',`
4375         gen_require(`
4376                 type user_tmp_t;
4377         ')
4378
4379         write_files_pattern($1, user_tmp_t, user_tmp_t)
4380 ')
4381
4382 ########################################
4383 ## <summary>
4384 ##      Manage keys for all user domains.
4385 ## </summary>
4386 ## <param name="domain">
4387 ##      <summary>
4388 ##      Domain allowed access.
4389 ##      </summary>
4390 ## </param>
4391 #
4392 interface(`userdom_manage_all_users_keys',`
4393         gen_require(`
4394                 attribute userdomain;
4395         ')
4396
4397         allow $1 userdomain:key manage_key_perms;
4398 ')
4399
4400
4401 ########################################
4402 ## <summary>
4403 ##      Do not audit attempts to read and write
4404 ##      unserdomain stream.
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain to not audit.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`userdom_dontaudit_rw_stream',`
4413         gen_require(`
4414                 attribute userdomain;
4415         ')
4416
4417         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4418 ')
4419
4420 ########################################
4421 ## <summary>
4422 ##      Do not audit attempts to read and write
4423 ##      unserdomain datagram socket.
4424 ## </summary>
4425 ## <param name="domain">
4426 ##      <summary>
4427 ##      Domain to not audit.
4428 ##      </summary>
4429 ## </param>
4430 #
4431 interface(`userdom_dontaudit_rw_dgram_socket',`
4432         gen_require(`
4433                 attribute userdomain;
4434         ')
4435
4436         dontaudit $1 userdomain:unix_dgram_socket { read write };
4437 ')
4438
4439 ########################################
4440 ## <summary>
4441 ##      Append files
4442 ##      in a user home subdirectory.
4443 ## </summary>
4444 ## <param name="domain">
4445 ##      <summary>
4446 ##      Domain allowed access.
4447 ##      </summary>
4448 ## </param>
4449 #
4450 interface(`userdom_append_user_home_content_files',`
4451         gen_require(`
4452                 type user_home_dir_t, user_home_t;
4453         ')
4454
4455         append_files_pattern($1, user_home_t, user_home_t)
4456         allow $1 user_home_dir_t:dir search_dir_perms;
4457         files_search_home($1)
4458 ')
4459
4460 ########################################
4461 ## <summary>
4462 ##      Read files inherited
4463 ##      in a user home subdirectory.
4464 ## </summary>
4465 ## <param name="domain">
4466 ##      <summary>
4467 ##      Domain allowed access.
4468 ##      </summary>
4469 ## </param>
4470 #
4471 interface(`userdom_read_inherited_user_home_content_files',`
4472         gen_require(`
4473                 attribute user_home_type;
4474         ')
4475
4476         allow $1 user_home_type:file { getattr read };
4477 ')
4478
4479 ########################################
4480 ## <summary>
4481 ##      Append files inherited
4482 ##      in a user home subdirectory.
4483 ## </summary>
4484 ## <param name="domain">
4485 ##      <summary>
4486 ##      Domain allowed access.
4487 ##      </summary>
4488 ## </param>
4489 #
4490 interface(`userdom_inherit_append_user_home_content_files',`
4491         gen_require(`
4492                 type user_home_t;
4493         ')
4494
4495         allow $1 user_home_t:file { getattr append };
4496 ')
4497
4498 ########################################
4499 ## <summary>
4500 ##      Append files inherited
4501 ##      in a user tmp files.
4502 ## </summary>
4503 ## <param name="domain">
4504 ##      <summary>
4505 ##      Domain allowed access.
4506 ##      </summary>
4507 ## </param>
4508 #
4509 interface(`userdom_inherit_append_user_tmp_files',`
4510         gen_require(`
4511                 type user_tmp_t;
4512         ')
4513
4514         allow $1 user_tmp_t:file { getattr append };
4515 ')
4516
4517 ######################################
4518 ## <summary>
4519 ##      Read audio files in the users homedir.
4520 ## </summary>
4521 ## <param name="domain">
4522 ##      <summary>
4523 ##      Domain allowed access.
4524 ##      </summary>
4525 ## </param>
4526 ## <rolecap/>
4527 #
4528 interface(`userdom_read_home_audio_files',`
4529         gen_require(`
4530                 type audio_home_t;
4531         ')
4532
4533         userdom_search_user_home_dirs($1)
4534         allow $1 audio_home_t:dir list_dir_perms;
4535         read_files_pattern($1, audio_home_t, audio_home_t)
4536         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4537 ')
4538
4539 ########################################
4540 ## <summary>
4541 ##      Do not audit attempts to write all user home content files.
4542 ## </summary>
4543 ## <param name="domain">
4544 ##      <summary>
4545 ##      Domain to not audit.
4546 ##      </summary>
4547 ## </param>
4548 #
4549 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4550         gen_require(`
4551                 attribute user_home_type;
4552         ')
4553
4554         dontaudit $1 user_home_type:file write_file_perms;
4555 ')
4556
4557 ########################################
4558 ## <summary>
4559 ##      Do not audit attempts to write all user tmp content files.
4560 ## </summary>
4561 ## <param name="domain">
4562 ##      <summary>
4563 ##      Domain to not audit.
4564 ##      </summary>
4565 ## </param>
4566 #
4567 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4568         gen_require(`
4569                 attribute user_tmp_type;
4570         ')
4571
4572         dontaudit $1 user_tmp_type:file write_file_perms;
4573 ')
4574
4575 ########################################
4576 ## <summary>
4577 ##      Manage all user temporary content.
4578 ## </summary>
4579 ## <param name="domain">
4580 ##      <summary>
4581 ##      Domain allowed access.
4582 ##      </summary>
4583 ## </param>
4584 #
4585 interface(`userdom_manage_all_user_tmp_content',`
4586         gen_require(`
4587                 attribute user_tmp_type;
4588         ')
4589
4590         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4591         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4592         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4593         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4594         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4595         files_search_tmp($1)
4596 ')
4597
4598 ########################################
4599 ## <summary>
4600 ##      List all user temporary content.
4601 ## </summary>
4602 ## <param name="domain">
4603 ##      <summary>
4604 ##      Domain allowed access.
4605 ##      </summary>
4606 ## </param>
4607 #
4608 interface(`userdom_list_all_user_tmp_content',`
4609         gen_require(`
4610                 attribute user_tmp_type;
4611         ')
4612
4613         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4614         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4615         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4616         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4617         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4618         files_search_var($1)
4619         files_search_tmp($1)
4620 ')
4621
4622 ########################################
4623 ## <summary>
4624 ##      Manage all user tmpfs content.
4625 ## </summary>
4626 ## <param name="domain">
4627 ##      <summary>
4628 ##      Domain allowed access.
4629 ##      </summary>
4630 ## </param>
4631 #
4632 interface(`userdom_manage_all_user_tmpfs_content',`
4633         gen_require(`
4634                 attribute user_tmpfs_type;
4635         ')
4636
4637         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4638         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4639         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4640         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4641         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4642         fs_search_tmpfs($1)
4643 ')
4644
4645 ########################################
4646 ## <summary>
4647 ##      Delete all user temporary content.
4648 ## </summary>
4649 ## <param name="domain">
4650 ##      <summary>
4651 ##      Domain allowed access.
4652 ##      </summary>
4653 ## </param>
4654 #
4655 interface(`userdom_delete_all_user_tmp_content',`
4656         gen_require(`
4657                 attribute user_tmp_type;
4658         ')
4659
4660         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4661         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4662         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4663         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4664         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4665         # /var/tmp
4666         files_search_var($1)
4667         files_delete_tmp_dir_entry($1)
4668 ')
4669
4670 ########################################
4671 ## <summary>
4672 ##      Read system SSL certificates in the users homedir.
4673 ## </summary>
4674 ## <param name="domain">
4675 ##      <summary>
4676 ##      Domain allowed access.
4677 ##      </summary>
4678 ## </param>
4679 #
4680 interface(`userdom_read_home_certs',`
4681         gen_require(`
4682                 type home_cert_t;
4683         ')
4684
4685         userdom_search_user_home_content($1)
4686         allow $1 home_cert_t:dir list_dir_perms;
4687         read_files_pattern($1, home_cert_t, home_cert_t)
4688         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4689 ')
4690
4691 ########################################
4692 ## <summary>
4693 ##      Manage system SSL certificates in the users homedir.
4694 ## </summary>
4695 ## <param name="domain">
4696 ##      <summary>
4697 ##      Domain allowed access.
4698 ##      </summary>
4699 ## </param>
4700 #
4701 interface(`userdom_manage_home_certs',`
4702         gen_require(`
4703                 type home_cert_t;
4704         ')
4705
4706         allow $1 home_cert_t:dir list_dir_perms;
4707         manage_files_pattern($1, home_cert_t, home_cert_t)
4708         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4709
4710         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4711         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4712 ')
4713
4714 #######################################
4715 ## <summary>
4716 ##  Dontaudit Write system SSL certificates in the users homedir.
4717 ## </summary>
4718 ## <param name="domain">
4719 ##  <summary>
4720 ##      Domain to not audit.
4721 ##  </summary>
4722 ## </param>
4723 #
4724 interface(`userdom_dontaudit_write_home_certs',`
4725     gen_require(`
4726         type home_cert_t;
4727     ')
4728
4729     dontaudit $1 home_cert_t:file write;
4730 ')
4731
4732 ########################################
4733 ## <summary>
4734 ##      dontaudit Search getatrr /root files
4735 ## </summary>
4736 ## <param name="domain">
4737 ##      <summary>
4738 ##      Domain to not audit.
4739 ##      </summary>
4740 ## </param>
4741 #
4742 interface(`userdom_dontaudit_getattr_admin_home_files',`
4743         gen_require(`
4744                 type admin_home_t;
4745         ')
4746
4747         dontaudit $1 admin_home_t:file getattr;
4748 ')
4749
4750 ########################################
4751 ## <summary>
4752 ##      dontaudit read /root lnk files
4753 ## </summary>
4754 ## <param name="domain">
4755 ##      <summary>
4756 ##      Domain to not audit.
4757 ##      </summary>
4758 ## </param>
4759 #
4760 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4761         gen_require(`
4762                 type admin_home_t;
4763         ')
4764
4765         dontaudit $1 admin_home_t:lnk_file read;
4766 ')
4767
4768 ########################################
4769 ## <summary>
4770 ##      dontaudit read /root files
4771 ## </summary>
4772 ## <param name="domain">
4773 ##      <summary>
4774 ##      Domain to not audit.
4775 ##      </summary>
4776 ## </param>
4777 #
4778 interface(`userdom_dontaudit_read_admin_home_files',`
4779         gen_require(`
4780                 type admin_home_t;
4781         ')
4782
4783         dontaudit $1 admin_home_t:file read_file_perms;
4784 ')
4785
4786 ########################################
4787 ## <summary>
4788 ##      Create, read, write, and delete user
4789 ##      temporary chr files.
4790 ## </summary>
4791 ## <param name="domain">
4792 ##      <summary>
4793 ##      Domain allowed access.
4794 ##      </summary>
4795 ## </param>
4796 #
4797 interface(`userdom_manage_user_tmp_chr_files',`
4798         gen_require(`
4799                 type user_tmp_t;
4800         ')
4801
4802         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4803         files_search_tmp($1)
4804 ')
4805
4806 ########################################
4807 ## <summary>
4808 ##      Create, read, write, and delete user
4809 ##      temporary blk files.
4810 ## </summary>
4811 ## <param name="domain">
4812 ##      <summary>
4813 ##      Domain allowed access.
4814 ##      </summary>
4815 ## </param>
4816 #
4817 interface(`userdom_manage_user_tmp_blk_files',`
4818         gen_require(`
4819                 type user_tmp_t;
4820         ')
4821
4822         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4823         files_search_tmp($1)
4824 ')
4825
4826 ########################################
4827 ## <summary>
4828 ##      Dontaudit attempt to set attributes on  user temporary directories.
4829 ## </summary>
4830 ## <param name="domain">
4831 ##      <summary>
4832 ##      Domain to not audit.
4833 ##      </summary>
4834 ## </param>
4835 #
4836 interface(`userdom_dontaudit_setattr_user_tmp',`
4837         gen_require(`
4838                 type user_tmp_t;
4839         ')
4840
4841         dontaudit $1 user_tmp_t:dir setattr;
4842 ')
4843
4844 ########################################
4845 ## <summary>
4846 ##      Read all inherited users files in /tmp
4847 ## </summary>
4848 ## <param name="domain">
4849 ##      <summary>
4850 ##      Domain allowed access.
4851 ##      </summary>
4852 ## </param>
4853 #
4854 interface(`userdom_read_inherited_user_tmp_files',`
4855         gen_require(`
4856                 type user_tmp_t;
4857         ')
4858
4859         allow $1 user_tmp_t:file read_inherited_file_perms;
4860 ')
4861
4862 ########################################
4863 ## <summary>
4864 ##      Write all inherited users files in /tmp
4865 ## </summary>
4866 ## <param name="domain">
4867 ##      <summary>
4868 ##      Domain allowed access.
4869 ##      </summary>
4870 ## </param>
4871 #
4872 interface(`userdom_write_inherited_user_tmp_files',`
4873         gen_require(`
4874                 type user_tmp_t;
4875         ')
4876
4877         allow $1 user_tmp_t:file write;
4878 ')
4879
4880 ########################################
4881 ## <summary>
4882 ##      Delete all users files in /tmp
4883 ## </summary>
4884 ## <param name="domain">
4885 ##      <summary>
4886 ##      Domain allowed access.
4887 ##      </summary>
4888 ## </param>
4889 #
4890 interface(`userdom_delete_user_tmp_files',`
4891         gen_require(`
4892                 type user_tmp_t;
4893         ')
4894
4895         allow $1 user_tmp_t:file delete_file_perms;
4896 ')
4897
4898 ########################################
4899 ## <summary>
4900 ##      Delete user tmpfs files.
4901 ## </summary>
4902 ## <param name="domain">
4903 ##      <summary>
4904 ##      Domain allowed access.
4905 ##      </summary>
4906 ## </param>
4907 #
4908 interface(`userdom_delete_user_tmpfs_files',`
4909         gen_require(`
4910                 type user_tmpfs_t;
4911         ')
4912
4913         allow $1 user_tmpfs_t:file delete_file_perms;
4914 ')
4915
4916 ########################################
4917 ## <summary>
4918 ##      Read/Write unpriviledged user SysV shared
4919 ##      memory segments.
4920 ## </summary>
4921 ## <param name="domain">
4922 ##      <summary>
4923 ##      Domain allowed access.
4924 ##      </summary>
4925 ## </param>
4926 #
4927 interface(`userdom_rw_unpriv_user_shared_mem',`
4928         gen_require(`
4929                 attribute unpriv_userdomain;
4930         ')
4931
4932         allow $1 unpriv_userdomain:shm rw_shm_perms;
4933 ')
4934
4935 ########################################
4936 ## <summary>
4937 ##      Do not audit attempts to search user
4938 ##      temporary directories.
4939 ## </summary>
4940 ## <param name="domain">
4941 ##      <summary>
4942 ##      Domain to not audit.
4943 ##      </summary>
4944 ## </param>
4945 #
4946 interface(`userdom_dontaudit_search_user_tmp',`
4947         gen_require(`
4948                 type user_tmp_t;
4949         ')
4950
4951         dontaudit $1 user_tmp_t:dir search_dir_perms;
4952 ')
4953
4954 ########################################
4955 ## <summary>
4956 ##      Execute a file in a user home directory
4957 ##      in the specified domain.
4958 ## </summary>
4959 ## <desc>
4960 ##      <p>
4961 ##      Execute a file in a user home directory
4962 ##      in the specified domain.
4963 ##      </p>
4964 ##      <p>
4965 ##      No interprocess communication (signals, pipes,
4966 ##      etc.) is provided by this interface since
4967 ##      the domains are not owned by this module.
4968 ##      </p>
4969 ## </desc>
4970 ## <param name="domain">
4971 ##      <summary>
4972 ##      Domain allowed access.
4973 ##      </summary>
4974 ## </param>
4975 ## <param name="target_domain">
4976 ##      <summary>
4977 ##      The type of the new process.
4978 ##      </summary>
4979 ## </param>
4980 #
4981 interface(`userdom_domtrans_user_home',`
4982         gen_require(`
4983                 type user_home_t;
4984         ')
4985
4986         read_lnk_files_pattern($1, user_home_t, user_home_t)
4987         domain_transition_pattern($1, user_home_t, $2)
4988         type_transition $1 user_home_t:process $2;
4989 ')
4990
4991 ########################################
4992 ## <summary>
4993 ##      Execute a file in a user tmp directory
4994 ##      in the specified domain.
4995 ## </summary>
4996 ## <desc>
4997 ##      <p>
4998 ##      Execute a file in a user tmp directory
4999 ##      in the specified domain.
5000 ##      </p>
5001 ##      <p>
5002 ##      No interprocess communication (signals, pipes,
5003 ##      etc.) is provided by this interface since
5004 ##      the domains are not owned by this module.
5005 ##      </p>
5006 ## </desc>
5007 ## <param name="domain">
5008 ##      <summary>
5009 ##      Domain allowed access.
5010 ##      </summary>
5011 ## </param>
5012 ## <param name="target_domain">
5013 ##      <summary>
5014 ##      The type of the new process.
5015 ##      </summary>
5016 ## </param>
5017 #
5018 interface(`userdom_domtrans_user_tmp',`
5019         gen_require(`
5020                 type user_tmp_t;
5021         ')
5022
5023         files_search_tmp($1)
5024         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5025         domain_transition_pattern($1, user_tmp_t, $2)
5026         type_transition $1 user_tmp_t:process $2;
5027 ')
5028
5029 ########################################
5030 ## <summary>
5031 ##      Do not audit attempts to read all user home content files.
5032 ## </summary>
5033 ## <param name="domain">
5034 ##      <summary>
5035 ##      Domain to not audit.
5036 ##      </summary>
5037 ## </param>
5038 #
5039 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5040         gen_require(`
5041                 attribute user_home_type;
5042         ')
5043
5044         dontaudit $1 user_home_type:file read_file_perms;
5045 ')
5046
5047 ########################################
5048 ## <summary>
5049 ##      Do not audit attempts to read all user tmp content files.
5050 ## </summary>
5051 ## <param name="domain">
5052 ##      <summary>
5053 ##      Domain to not audit.
5054 ##      </summary>
5055 ## </param>
5056 #
5057 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5058         gen_require(`
5059                 attribute user_tmp_type;
5060         ')
5061
5062         dontaudit $1 user_tmp_type:file read_file_perms;
5063 ')
5064
5065 #######################################
5066 ## <summary>
5067 ## Read and write unpriviledged user SysV sempaphores.
5068 ## </summary>
5069 ## <param name="domain">
5070 ## <summary>
5071 ## Domain allowed access.
5072 ## </summary>
5073 ## </param>
5074 #
5075 interface(`userdom_rw_unpriv_user_semaphores',`
5076    gen_require(`
5077        attribute unpriv_userdomain;
5078    ')
5079
5080    allow $1 unpriv_userdomain:sem rw_sem_perms;
5081 ')
5082
5083 ########################################
5084 ## <summary>
5085 ##      Transition to userdom named content
5086 ## </summary>
5087 ## <param name="domain">
5088 ##      <summary>
5089 ##      Domain allowed access.
5090 ##      </summary>
5091 ## </param>
5092 #
5093 interface(`userdom_filetrans_home_content',`
5094         gen_require(`
5095                 type home_bin_t, home_cert_t;
5096                 type audio_home_t;
5097         ')
5098
5099         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5100         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5101         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5102         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5103         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5104         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5105         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5106
5107         #optional_policy(`
5108         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5109         #')
5110 ')
5111
5112 ########################################
5113 ## <summary>
5114 ##      Make the specified type able to read content in user home dirs
5115 ## </summary>
5116 ## <param name="type">
5117 ##      <summary>
5118 ##      Domain allowed access.
5119 ##      </summary>
5120 ## </param>
5121 #
5122 interface(`userdom_home_reader',`
5123         gen_require(`
5124                 attribute userdom_home_reader_type;
5125         ')
5126
5127         typeattribute $1 userdom_home_reader_type;
5128 ')
5129
5130
5131 ########################################
5132 ## <summary>
5133 ##      Make the specified type able to manage content in user home dirs
5134 ## </summary>
5135 ## <param name="type">
5136 ##      <summary>
5137 ##      Domain allowed access.
5138 ##      </summary>
5139 ## </param>
5140 #
5141 interface(`userdom_home_manager',`
5142         gen_require(`
5143                 attribute userdom_home_manager_type;
5144         ')
5145
5146         typeattribute $1 userdom_home_manager_type;
5147 ')