policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678         ')
 679
 680         optional_policy(`
 681                 # Allow graphical boot to check battery lifespan
 682                 apm_stream_connect($1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 canna_stream_connect($1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 chrome_role($1_r, $1_usertype)
 691         ')
 692
 693         optional_policy(`
 694                 colord_read_lib_files($1_usertype)
 695         ')
 696
 697         optional_policy(`
 698                 dbus_system_bus_client($1_usertype)
 699
 700                 allow $1_usertype $1_usertype:dbus  send_msg;
 701
 702                 optional_policy(`
 703                         avahi_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         policykit_dbus_chat($1_usertype)
 708                 ')
 709
 710                 optional_policy(`
 711                         bluetooth_dbus_chat($1_usertype)
 712                 ')
 713
 714                 optional_policy(`
 715                         consolekit_dbus_chat($1_usertype)
 716                         consolekit_read_log($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         devicekit_dbus_chat($1_usertype)
 721                         devicekit_dbus_chat_power($1_usertype)
 722                         devicekit_dbus_chat_disk($1_usertype)
 723                 ')
 724
 725                 optional_policy(`
 726                         evolution_dbus_chat($1_usertype)
 727                         evolution_alarm_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         gnome_dbus_chat_gconfdefault($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         hal_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         kde_dbus_chat_backlighthelper($1_usertype)
 740                 ')
 741
 742                 optional_policy(`
 743                         modemmanager_dbus_chat($1_usertype)
 744                 ')
 745
 746                 optional_policy(`
 747                         networkmanager_dbus_chat($1_usertype)
 748                         networkmanager_read_lib_files($1_usertype)
 749                 ')
 750
 751                 optional_policy(`
 752                         vpn_dbus_chat($1_usertype)
 753                 ')
 754         ')
 755
 756         optional_policy(`
 757                 git_session_role($1_r, $1_usertype)
 758         ')
 759
 760         optional_policy(`
 761                 inetd_use_fds($1_usertype)
 762                 inetd_rw_tcp_sockets($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 inn_read_config($1_usertype)
 767                 inn_read_news_lib($1_usertype)
 768                 inn_read_news_spool($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 lircd_stream_connect($1_usertype)
 773         ')
 774
 775         optional_policy(`
 776                 locate_read_lib_files($1_usertype)
 777         ')
 778
 779         # for running depmod as part of the kernel packaging process
 780         optional_policy(`
 781                 modutils_read_module_config($1_usertype)
 782         ')
 783
 784         optional_policy(`
 785                 mta_rw_spool($1_usertype)
 786                 mta_manage_queue($1_usertype)
 787                 mta_filetrans_home_content($1_usertype)
 788         ')
 789
 790         optional_policy(`
 791                 nsplugin_role($1_r, $1_usertype)
 792         ')
 793
 794         optional_policy(`
 795                 tunable_policy(`allow_user_mysql_connect',`
 796                         mysql_stream_connect($1_t)
 797                 ')
 798         ')
 799
 800         optional_policy(`
 801                 oident_manage_user_content($1_t)
 802                 oident_relabel_user_content($1_t)
 803         ')
 804
 805         optional_policy(`
 806                 # to allow monitoring of pcmcia status
 807                 pcmcia_read_pid($1_usertype)
 808         ')
 809
 810         optional_policy(`
 811                 pcscd_read_pub_files($1_usertype)
 812                 pcscd_stream_connect($1_usertype)
 813         ')
 814
 815         optional_policy(`
 816                 tunable_policy(`allow_user_postgresql_connect',`
 817                         postgresql_stream_connect($1_usertype)
 818                         postgresql_tcp_connect($1_usertype)
 819                 ')
 820         ')
 821
 822         optional_policy(`
 823                 resmgr_stream_connect($1_usertype)
 824         ')
 825
 826         optional_policy(`
 827                 rpc_dontaudit_getattr_exports($1_usertype)
 828                 rpc_manage_nfs_rw_content($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 rpcbind_stream_connect($1_usertype)
 833         ')
 834
 835         optional_policy(`
 836                 samba_stream_connect_winbind($1_usertype)
 837         ')
 838
 839         optional_policy(`
 840                 sandbox_transition($1_usertype, $1_r)
 841         ')
 842
 843         optional_policy(`
 844                 seunshare_role_template($1, $1_r, $1_t)
 845         ')
 846
 847         optional_policy(`
 848                 slrnpull_search_spool($1_usertype)
 849         ')
 850
 851 ')
 852
 853 #######################################
 854 ## <summary>
 855 ##      The template for creating a login user.
 856 ## </summary>
 857 ## <desc>
 858 ##      <p>
 859 ##      This template creates a user domain, types, and
 860 ##      rules for the user's tty, pty, home directories,
 861 ##      tmp, and tmpfs files.
 862 ##      </p>
 863 ## </desc>
 864 ## <param name="userdomain_prefix">
 865 ##      <summary>
 866 ##      The prefix of the user domain (e.g., user
 867 ##      is the prefix for user_t).
 868 ##      </summary>
 869 ## </param>
 870 #
 871 template(`userdom_login_user_template', `
 872         gen_require(`
 873                 class context contains;
 874         ')
 875
 876         userdom_base_user_template($1)
 877
 878         userdom_manage_home_role($1_r, $1_usertype)
 879
 880         userdom_manage_tmp_role($1_r, $1_usertype)
 881         userdom_manage_tmpfs_role($1_r, $1_usertype)
 882
 883         ifelse(`$1',`unconfined',`',`
 884                 gen_tunable(allow_$1_exec_content, true)
 885
 886                 tunable_policy(`allow_$1_exec_content',`
 887                         userdom_exec_user_tmp_files($1_usertype)
 888                         userdom_exec_user_home_content_files($1_usertype)
 889                 ')
 890                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 891                         fs_exec_nfs_files($1_usertype)
 892                 ')
 893
 894                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 895                         fs_exec_cifs_files($1_usertype)
 896                 ')
 897         ')
 898
 899         userdom_change_password_template($1)
 900
 901         ##############################
 902         #
 903         # User domain Local policy
 904         #
 905
 906         allow $1_t self:capability { setgid chown fowner };
 907         dontaudit $1_t self:capability { sys_nice fsetid };
 908
 909         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 910         dontaudit $1_t self:process setrlimit;
 911         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 912
 913         allow $1_t self:context contains;
 914
 915         kernel_dontaudit_read_system_state($1_usertype)
 916         kernel_dontaudit_list_all_proc($1_usertype)
 917
 918         dev_read_sysfs($1_usertype)
 919         dev_read_urand($1_usertype)
 920
 921         domain_use_interactive_fds($1_usertype)
 922         # Command completion can fire hundreds of denials
 923         domain_dontaudit_exec_all_entry_files($1_usertype)
 924
 925         files_dontaudit_list_default($1_usertype)
 926         files_dontaudit_read_default_files($1_usertype)
 927         # Stat lost+found.
 928         files_getattr_lost_found_dirs($1_usertype)
 929
 930         fs_get_all_fs_quotas($1_usertype)
 931         fs_getattr_all_fs($1_usertype)
 932         fs_search_all($1_usertype)
 933         fs_list_inotifyfs($1_usertype)
 934         fs_rw_anon_inodefs_files($1_usertype)
 935
 936         auth_dontaudit_write_login_records($1_t)
 937         auth_rw_cache($1_t)
 938
 939         application_exec_all($1_t)
 940         # The library functions always try to open read-write first,
 941         # then fall back to read-only if it fails.
 942         init_dontaudit_rw_utmp($1_t)
 943
 944         # Stop warnings about access to /dev/console
 945         init_dontaudit_use_fds($1_usertype)
 946         init_dontaudit_use_script_fds($1_usertype)
 947
 948         libs_exec_lib_files($1_usertype)
 949
 950         logging_dontaudit_getattr_all_logs($1_usertype)
 951
 952         # for running TeX programs
 953         miscfiles_read_tetex_data($1_usertype)
 954         miscfiles_exec_tetex_data($1_usertype)
 955
 956         seutil_read_config($1_usertype)
 957
 958         optional_policy(`
 959                 cups_read_config($1_usertype)
 960                 cups_stream_connect($1_usertype)
 961                 cups_stream_connect_ptal($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 kerberos_use($1_usertype)
 966                 kerberos_filetrans_home_content($1_usertype)
 967         ')
 968
 969         optional_policy(`
 970                 mta_dontaudit_read_spool_symlinks($1_usertype)
 971         ')
 972
 973         optional_policy(`
 974                 quota_dontaudit_getattr_db($1_usertype)
 975         ')
 976
 977         optional_policy(`
 978                 rpm_read_db($1_usertype)
 979                 rpm_dontaudit_manage_db($1_usertype)
 980                 rpm_read_cache($1_usertype)
 981         ')
 982
 983         optional_policy(`
 984                 oddjob_run_mkhomedir($1_t, $1_r)
 985         ')
 986 ')
 987
 988 #######################################
 989 ## <summary>
 990 ##      The template for creating a unprivileged login user.
 991 ## </summary>
 992 ## <desc>
 993 ##      <p>
 994 ##      This template creates a user domain, types, and
 995 ##      rules for the user's tty, pty, home directories,
 996 ##      tmp, and tmpfs files.
 997 ##      </p>
 998 ## </desc>
 999 ## <param name="userdomain_prefix">
1000 ##      <summary>
1001 ##      The prefix of the user domain (e.g., user
1002 ##      is the prefix for user_t).
1003 ##      </summary>
1004 ## </param>
1005 #
1006 template(`userdom_restricted_user_template',`
1007         gen_require(`
1008                 attribute unpriv_userdomain;
1009         ')
1010
1011         userdom_login_user_template($1)
1012
1013         typeattribute $1_t unpriv_userdomain;
1014         domain_interactive_fd($1_t)
1015
1016         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1017         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1018
1019         ##############################
1020         #
1021         # Local policy
1022         #
1023
1024         optional_policy(`
1025                 loadkeys_run($1_t, $1_r)
1026         ')
1027 ')
1028
1029 #######################################
1030 ## <summary>
1031 ##      The template for creating a unprivileged xwindows login user.
1032 ## </summary>
1033 ## <desc>
1034 ##      <p>
1035 ##      The template for creating a unprivileged xwindows login user.
1036 ##      </p>
1037 ##      <p>
1038 ##      This template creates a user domain, types, and
1039 ##      rules for the user's tty, pty, home directories,
1040 ##      tmp, and tmpfs files.
1041 ##      </p>
1042 ## </desc>
1043 ## <param name="userdomain_prefix">
1044 ##      <summary>
1045 ##      The prefix of the user domain (e.g., user
1046 ##      is the prefix for user_t).
1047 ##      </summary>
1048 ## </param>
1049 #
1050 template(`userdom_restricted_xwindows_user_template',`
1051
1052         userdom_restricted_user_template($1)
1053
1054         ##############################
1055         #
1056         # Local policy
1057         #
1058
1059         auth_role($1_r, $1_t)
1060         auth_search_pam_console_data($1_usertype)
1061         auth_dontaudit_read_login_records($1_usertype)
1062
1063         dev_read_sound($1_usertype)
1064         dev_write_sound($1_usertype)
1065         # gnome keyring wants to read this.
1066         dev_dontaudit_read_rand($1_usertype)
1067         # temporarily allow since openoffice requires this
1068         dev_read_rand($1_usertype)
1069
1070         dev_read_video_dev($1_usertype)
1071         dev_write_video_dev($1_usertype)
1072         dev_rw_wireless($1_usertype)
1073
1074         libs_dontaudit_setattr_lib_files($1_usertype)
1075
1076         tunable_policy(`user_rw_noexattrfile',`
1077                 dev_rw_usbfs($1_t)
1078                 dev_rw_generic_usb_dev($1_usertype)
1079
1080                 fs_manage_noxattr_fs_files($1_usertype)
1081                 fs_manage_noxattr_fs_dirs($1_usertype)
1082                 fs_manage_dos_dirs($1_usertype)
1083                 fs_manage_dos_files($1_usertype)
1084                 storage_raw_read_removable_device($1_usertype)
1085                 storage_raw_write_removable_device($1_usertype)
1086         ')
1087
1088         logging_send_syslog_msg($1_usertype)
1089         logging_dontaudit_send_audit_msgs($1_t)
1090
1091         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1092         logging_send_audit_msgs($1_t)
1093         selinux_get_enforce_mode($1_t)
1094         seutil_exec_restorecond($1_t)
1095         seutil_read_file_contexts($1_t)
1096         seutil_read_default_contexts($1_t)
1097
1098         xserver_restricted_role($1_r, $1_t)
1099
1100         optional_policy(`
1101                 alsa_read_rw_config($1_usertype)
1102         ')
1103
1104          # cjp: needed by KDE apps
1105          # bug: #682499
1106          optional_policy(`
1107                 gnome_read_usr_config($1_usertype)
1108                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1109                 # cjp: telepathy F15 bugs
1110                 telepathy_role($1_r, $1_t, $1)
1111         ')
1112
1113         optional_policy(`
1114                 dbus_role_template($1, $1_r, $1_usertype)
1115                 dbus_system_bus_client($1_usertype)
1116                 allow $1_usertype $1_usertype:dbus send_msg;
1117
1118                 optional_policy(`
1119                         abrt_dbus_chat($1_usertype)
1120                         abrt_run_helper($1_usertype, $1_r)
1121                 ')
1122
1123                 optional_policy(`
1124                         consolekit_dontaudit_read_log($1_usertype)
1125                         consolekit_dbus_chat($1_usertype)
1126                 ')
1127
1128                 optional_policy(`
1129                         cups_dbus_chat($1_usertype)
1130                         cups_dbus_chat_config($1_usertype)
1131                 ')
1132
1133                 optional_policy(`
1134                         devicekit_dbus_chat($1_usertype)
1135                         devicekit_dbus_chat_disk($1_usertype)
1136                         devicekit_dbus_chat_power($1_usertype)
1137                 ')
1138
1139                 optional_policy(`
1140                         fprintd_dbus_chat($1_t)
1141                 ')
1142         ')
1143
1144         optional_policy(`
1145                 openoffice_role_template($1, $1_r, $1_usertype)
1146         ')
1147
1148         optional_policy(`
1149                 policykit_role($1_r, $1_usertype)
1150         ')
1151
1152         optional_policy(`
1153                 pulseaudio_role($1_r, $1_usertype)
1154                 pulseaudio_filetrans_admin_home_content($1_usertype)
1155                 pulseaudio_filetrans_home_content($1_usertype)
1156         ')
1157
1158         optional_policy(`
1159                 rtkit_scheduled($1_usertype)
1160         ')
1161
1162         optional_policy(`
1163                 setroubleshoot_dontaudit_stream_connect($1_t)
1164         ')
1165
1166         optional_policy(`
1167                 udev_read_db($1_usertype)
1168         ')
1169
1170         optional_policy(`
1171                 wm_role_template($1, $1_r, $1_t)
1172         ')
1173 ')
1174
1175 #######################################
1176 ## <summary>
1177 ##      The template for creating a unprivileged user roughly
1178 ##      equivalent to a regular linux user.
1179 ## </summary>
1180 ## <desc>
1181 ##      <p>
1182 ##      The template for creating a unprivileged user roughly
1183 ##      equivalent to a regular linux user.
1184 ##      </p>
1185 ##      <p>
1186 ##      This template creates a user domain, types, and
1187 ##      rules for the user's tty, pty, home directories,
1188 ##      tmp, and tmpfs files.
1189 ##      </p>
1190 ## </desc>
1191 ## <param name="userdomain_prefix">
1192 ##      <summary>
1193 ##      The prefix of the user domain (e.g., user
1194 ##      is the prefix for user_t).
1195 ##      </summary>
1196 ## </param>
1197 #
1198 template(`userdom_unpriv_user_template', `
1199
1200         ##############################
1201         #
1202         # Declarations
1203         #
1204
1205         # Inherit rules for ordinary users.
1206         userdom_restricted_xwindows_user_template($1)
1207         userdom_common_user_template($1)
1208
1209         ##############################
1210         #
1211         # Local policy
1212         #
1213
1214         # port access is audited even if dac would not have allowed it, so dontaudit it here
1215 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1216         # Need the following rule to allow users to run vpnc
1217         corenet_tcp_bind_xserver_port($1_t)
1218         corenet_tcp_bind_generic_node($1_usertype)
1219
1220         storage_rw_fuse($1_t)
1221
1222         files_exec_usr_files($1_t)
1223    # cjp: why?
1224         files_read_kernel_symbol_table($1_t)
1225
1226         ifndef(`enable_mls',`
1227                 fs_exec_noxattr($1_t)
1228
1229                 tunable_policy(`user_rw_noexattrfile',`
1230                         fs_manage_noxattr_fs_files($1_t)
1231                         fs_manage_noxattr_fs_dirs($1_t)
1232                         # Write floppies
1233                         storage_raw_read_removable_device($1_t)
1234                         storage_raw_write_removable_device($1_t)
1235                 ',`
1236                         storage_raw_read_removable_device($1_t)
1237                 ')
1238         ')
1239
1240         miscfiles_read_hwdata($1_usertype)
1241
1242         # Allow users to run TCP servers (bind to ports and accept connection from
1243         # the same domain and outside users) disabling this forces FTP passive mode
1244         # and may change other protocols
1245
1246         tunable_policy(`user_share_music',`
1247                 corenet_tcp_bind_daap_port($1_usertype)
1248         ')
1249
1250         tunable_policy(`user_tcp_server',`
1251                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1252         ')
1253
1254         tunable_policy(`user_setrlimit',`
1255                 allow $1_usertype self:process setrlimit;
1256         ')
1257
1258         optional_policy(`
1259                 cdrecord_role($1_r, $1_t)
1260         ')
1261
1262         optional_policy(`
1263                 cron_role($1_r, $1_t)
1264         ')
1265
1266         optional_policy(`
1267                 games_rw_data($1_usertype)
1268         ')
1269
1270         optional_policy(`
1271                 gpg_role($1_r, $1_usertype)
1272         ')
1273
1274         optional_policy(`
1275                 gnomeclock_dbus_chat($1_t)
1276         ')
1277
1278         optional_policy(`
1279                 gpm_stream_connect($1_usertype)
1280         ')
1281
1282         optional_policy(`
1283                 execmem_role_template($1, $1_r, $1_t)
1284         ')
1285
1286         optional_policy(`
1287                 java_role_template($1, $1_r, $1_t)
1288         ')
1289
1290         optional_policy(`
1291                 mono_role_template($1, $1_r, $1_t)
1292         ')
1293
1294         optional_policy(`
1295                 mount_run_fusermount($1_t, $1_r)
1296                 mount_read_pid_files($1_t)
1297         ')
1298
1299         optional_policy(`
1300                 wine_role_template($1, $1_r, $1_t)
1301         ')
1302
1303         optional_policy(`
1304                 postfix_run_postdrop($1_t, $1_r)
1305         ')
1306
1307         # Run pppd in pppd_t by default for user
1308         optional_policy(`
1309                 ppp_run_cond($1_t, $1_r)
1310         ')
1311 ')
1312
1313 #######################################
1314 ## <summary>
1315 ##      The template for creating an administrative user.
1316 ## </summary>
1317 ## <desc>
1318 ##      <p>
1319 ##      This template creates a user domain, types, and
1320 ##      rules for the user's tty, pty, home directories,
1321 ##      tmp, and tmpfs files.
1322 ##      </p>
1323 ##      <p>
1324 ##      The privileges given to administrative users are:
1325 ##      <ul>
1326 ##              <li>Raw disk access</li>
1327 ##              <li>Set all sysctls</li>
1328 ##              <li>All kernel ring buffer controls</li>
1329 ##              <li>Create, read, write, and delete all files but shadow</li>
1330 ##              <li>Manage source and binary format SELinux policy</li>
1331 ##              <li>Run insmod</li>
1332 ##      </ul>
1333 ##      </p>
1334 ## </desc>
1335 ## <param name="userdomain_prefix">
1336 ##      <summary>
1337 ##      The prefix of the user domain (e.g., sysadm
1338 ##      is the prefix for sysadm_t).
1339 ##      </summary>
1340 ## </param>
1341 #
1342 template(`userdom_admin_user_template',`
1343         gen_require(`
1344                 attribute admindomain;
1345                 class passwd { passwd chfn chsh rootok crontab };
1346         ')
1347
1348         ##############################
1349         #
1350         # Declarations
1351         #
1352
1353         # Inherit rules for ordinary users.
1354         userdom_login_user_template($1)
1355         userdom_common_user_template($1)
1356
1357         domain_obj_id_change_exemption($1_t)
1358         role system_r types $1_t;
1359
1360         typeattribute $1_t admindomain;
1361
1362         ifdef(`direct_sysadm_daemon',`
1363                 domain_system_change_exemption($1_t)
1364         ')
1365
1366         ##############################
1367         #
1368         # $1_t local policy
1369         #
1370
1371         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1372         allow $1_t self:capability2 syslog;
1373         allow $1_t self:process { setexec setfscreate };
1374         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1375         allow $1_t self:tun_socket create;
1376         # Set password information for other users.
1377         allow $1_t self:passwd { passwd chfn chsh };
1378         # Skip authentication when pam_rootok is specified.
1379         allow $1_t self:passwd rootok;
1380
1381         # Manipulate other users crontab.
1382         allow $1_t self:passwd crontab;
1383
1384         kernel_read_software_raid_state($1_t)
1385         kernel_getattr_core_if($1_t)
1386         kernel_getattr_message_if($1_t)
1387         kernel_change_ring_buffer_level($1_t)
1388         kernel_clear_ring_buffer($1_t)
1389         kernel_read_ring_buffer($1_t)
1390         kernel_get_sysvipc_info($1_t)
1391         kernel_rw_all_sysctls($1_t)
1392         # signal unlabeled processes:
1393         kernel_kill_unlabeled($1_t)
1394         kernel_signal_unlabeled($1_t)
1395         kernel_sigstop_unlabeled($1_t)
1396         kernel_signull_unlabeled($1_t)
1397         kernel_sigchld_unlabeled($1_t)
1398         kernel_signal($1_t)
1399
1400         corenet_tcp_bind_generic_port($1_t)
1401         # allow setting up tunnels
1402         corenet_rw_tun_tap_dev($1_t)
1403
1404         dev_getattr_generic_blk_files($1_t)
1405         dev_getattr_generic_chr_files($1_t)
1406         # for lsof
1407         dev_getattr_mtrr_dev($1_t)
1408         # Allow MAKEDEV to work
1409         dev_create_all_blk_files($1_t)
1410         dev_create_all_chr_files($1_t)
1411         dev_delete_all_blk_files($1_t)
1412         dev_delete_all_chr_files($1_t)
1413         dev_rename_all_blk_files($1_t)
1414         dev_rename_all_chr_files($1_t)
1415         dev_create_generic_symlinks($1_t)
1416         dev_rw_generic_usb_dev($1_t)
1417         dev_rw_usbfs($1_t)
1418
1419         domain_setpriority_all_domains($1_t)
1420         domain_read_all_domains_state($1_t)
1421         domain_getattr_all_domains($1_t)
1422         domain_getcap_all_domains($1_t)
1423         domain_dontaudit_ptrace_all_domains($1_t)
1424         # signal all domains:
1425         domain_kill_all_domains($1_t)
1426         domain_signal_all_domains($1_t)
1427         domain_signull_all_domains($1_t)
1428         domain_sigstop_all_domains($1_t)
1429         domain_sigstop_all_domains($1_t)
1430         domain_sigchld_all_domains($1_t)
1431         # for lsof
1432         domain_getattr_all_sockets($1_t)
1433         domain_dontaudit_getattr_all_sockets($1_t)
1434
1435         files_exec_usr_src_files($1_t)
1436
1437         fs_getattr_all_fs($1_t)
1438         fs_getattr_all_files($1_t)
1439         fs_list_all($1_t)
1440         fs_set_all_quotas($1_t)
1441         fs_exec_noxattr($1_t)
1442
1443         storage_raw_read_removable_device($1_t)
1444         storage_raw_write_removable_device($1_t)
1445         storage_dontaudit_read_fixed_disk($1_t)
1446
1447         term_use_all_inherited_terms($1_t)
1448         term_use_unallocated_ttys($1_t)
1449
1450         auth_getattr_shadow($1_t)
1451         # Manage almost all files
1452         files_manage_non_security_files($1_t)
1453         # Relabel almost all files
1454         files_relabel_non_security_files($1_t)
1455
1456         init_telinit($1_t)
1457
1458         logging_send_syslog_msg($1_t)
1459
1460         optional_policy(`
1461                 modutils_domtrans_insmod($1_t)
1462                 modutils_domtrans_depmod($1_t)
1463         ')
1464
1465         # The following rule is temporary until such time that a complete
1466         # policy management infrastructure is in place so that an administrator
1467         # cannot directly manipulate policy files with arbitrary programs.
1468         seutil_manage_src_policy($1_t)
1469         # Violates the goal of limiting write access to checkpolicy.
1470         # But presently necessary for installing the file_contexts file.
1471         seutil_manage_bin_policy($1_t)
1472
1473         systemd_config_all_services($1_t)
1474
1475         userdom_manage_user_home_content_dirs($1_t)
1476         userdom_manage_user_home_content_files($1_t)
1477         userdom_manage_user_home_content_symlinks($1_t)
1478         userdom_manage_user_home_content_pipes($1_t)
1479         userdom_manage_user_home_content_sockets($1_t)
1480         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1481
1482         tunable_policy(`user_rw_noexattrfile',`
1483                 fs_manage_noxattr_fs_files($1_t)
1484                 fs_manage_noxattr_fs_dirs($1_t)
1485         ',`
1486                 fs_read_noxattr_fs_files($1_t)
1487         ')
1488
1489         optional_policy(`
1490                 postgresql_unconfined($1_t)
1491         ')
1492
1493         optional_policy(`
1494                 userhelper_exec($1_t)
1495         ')
1496 ')
1497
1498 ########################################
1499 ## <summary>
1500 ##      Allow user to run as a secadm
1501 ## </summary>
1502 ## <desc>
1503 ##      <p>
1504 ##      Create objects in a user home directory
1505 ##      with an automatic type transition to
1506 ##      a specified private type.
1507 ##      </p>
1508 ##      <p>
1509 ##      This is a templated interface, and should only
1510 ##      be called from a per-userdomain template.
1511 ##      </p>
1512 ## </desc>
1513 ## <param name="domain">
1514 ##      <summary>
1515 ##      Domain allowed access.
1516 ##      </summary>
1517 ## </param>
1518 ## <param name="role">
1519 ##      <summary>
1520 ##      The role  of the object to create.
1521 ##      </summary>
1522 ## </param>
1523 #
1524 template(`userdom_security_admin_template',`
1525         allow $1 self:capability { dac_read_search dac_override };
1526
1527         corecmd_exec_shell($1)
1528
1529         domain_obj_id_change_exemption($1)
1530
1531         dev_relabel_all_dev_nodes($1)
1532
1533         files_create_boot_flag($1)
1534         files_create_default_dir($1)
1535         files_root_filetrans_default($1, dir)
1536
1537         # Necessary for managing /boot/efi
1538         fs_manage_dos_files($1)
1539
1540         mls_process_read_up($1)
1541         mls_file_read_all_levels($1)
1542         mls_file_upgrade($1)
1543         mls_file_downgrade($1)
1544
1545         selinux_set_enforce_mode($1)
1546         selinux_set_all_booleans($1)
1547         selinux_set_parameters($1)
1548         selinux_read_policy($1)
1549
1550         files_relabel_all_files($1)
1551         auth_relabel_shadow($1)
1552
1553         init_exec($1)
1554
1555         logging_send_syslog_msg($1)
1556         logging_read_audit_log($1)
1557         logging_read_generic_logs($1)
1558         logging_read_audit_config($1)
1559
1560         seutil_manage_bin_policy($1)
1561         seutil_manage_default_contexts($1)
1562         seutil_manage_file_contexts($1)
1563         seutil_manage_module_store($1)
1564         seutil_manage_config($1)
1565         seutil_run_checkpolicy($1,$2)
1566         seutil_run_loadpolicy($1,$2)
1567         seutil_run_semanage($1,$2)
1568         seutil_run_setsebool($1,$2)
1569         seutil_run_setfiles($1, $2)
1570
1571         seutil_manage_bin_policy($1)
1572     seutil_manage_default_contexts($1)
1573     seutil_manage_file_contexts($1)
1574     seutil_manage_module_store($1)
1575     seutil_manage_config($1)
1576
1577         optional_policy(`
1578                 aide_run($1,$2)
1579         ')
1580
1581         optional_policy(`
1582                 consoletype_exec($1)
1583         ')
1584
1585         optional_policy(`
1586                 dmesg_exec($1)
1587         ')
1588
1589         optional_policy(`
1590                 ipsec_run_setkey($1,$2)
1591         ')
1592
1593         optional_policy(`
1594                 netlabel_run_mgmt($1,$2)
1595         ')
1596
1597         optional_policy(`
1598                 samhain_run($1, $2)
1599         ')
1600 ')
1601
1602 ########################################
1603 ## <summary>
1604 ##      Make the specified type usable in a
1605 ##      user home directory.
1606 ## </summary>
1607 ## <param name="type">
1608 ##      <summary>
1609 ##      Type to be used as a file in the
1610 ##      user home directory.
1611 ##      </summary>
1612 ## </param>
1613 #
1614 interface(`userdom_user_home_content',`
1615         gen_require(`
1616                 type user_home_t;
1617                 attribute user_home_type;
1618         ')
1619
1620         allow $1 user_home_t:filesystem associate;
1621         files_type($1)
1622         ubac_constrained($1)
1623
1624         files_poly_member($1)
1625         typeattribute $1  user_home_type;
1626 ')
1627
1628 ########################################
1629 ## <summary>
1630 ##      Make the specified type usable in a
1631 ##      generic temporary directory.
1632 ## </summary>
1633 ## <param name="type">
1634 ##      <summary>
1635 ##      Type to be used as a file in the
1636 ##      generic temporary directory.
1637 ##      </summary>
1638 ## </param>
1639 #
1640 interface(`userdom_user_tmp_content',`
1641         gen_require(`
1642                 attribute user_tmp_type;
1643         ')
1644
1645         typeattribute $1 user_tmp_type;
1646
1647         files_tmp_file($1)
1648         ubac_constrained($1)
1649 ')
1650
1651 ########################################
1652 ## <summary>
1653 ##      Make the specified type usable in a
1654 ##      generic tmpfs_t directory.
1655 ## </summary>
1656 ## <param name="type">
1657 ##      <summary>
1658 ##      Type to be used as a file in the
1659 ##      generic temporary directory.
1660 ##      </summary>
1661 ## </param>
1662 #
1663 interface(`userdom_user_tmpfs_content',`
1664         gen_require(`
1665                 attribute user_tmpfs_type;
1666         ')
1667
1668         typeattribute $1 user_tmpfs_type;
1669
1670         files_tmpfs_file($1)
1671         ubac_constrained($1)
1672 ')
1673
1674 ########################################
1675 ## <summary>
1676 ##      Allow domain to attach to TUN devices created by administrative users.
1677 ## </summary>
1678 ## <param name="domain">
1679 ##      <summary>
1680 ##      Domain allowed access.
1681 ##      </summary>
1682 ## </param>
1683 #
1684 interface(`userdom_attach_admin_tun_iface',`
1685         gen_require(`
1686                 attribute admindomain;
1687         ')
1688
1689         allow $1 admindomain:tun_socket relabelfrom;
1690         allow $1 self:tun_socket relabelto;
1691 ')
1692
1693 ########################################
1694 ## <summary>
1695 ##      Set the attributes of a user pty.
1696 ## </summary>
1697 ## <param name="domain">
1698 ##      <summary>
1699 ##      Domain allowed access.
1700 ##      </summary>
1701 ## </param>
1702 #
1703 interface(`userdom_setattr_user_ptys',`
1704         gen_require(`
1705                 type user_devpts_t;
1706         ')
1707
1708         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1709 ')
1710
1711 ########################################
1712 ## <summary>
1713 ##      Create a user pty.
1714 ## </summary>
1715 ## <param name="domain">
1716 ##      <summary>
1717 ##      Domain allowed access.
1718 ##      </summary>
1719 ## </param>
1720 #
1721 interface(`userdom_create_user_pty',`
1722         gen_require(`
1723                 type user_devpts_t;
1724         ')
1725
1726         term_create_pty($1, user_devpts_t)
1727 ')
1728
1729 ########################################
1730 ## <summary>
1731 ##      Get the attributes of user home directories.
1732 ## </summary>
1733 ## <param name="domain">
1734 ##      <summary>
1735 ##      Domain allowed access.
1736 ##      </summary>
1737 ## </param>
1738 #
1739 interface(`userdom_getattr_user_home_dirs',`
1740         gen_require(`
1741                 type user_home_dir_t;
1742         ')
1743
1744         allow $1 user_home_dir_t:dir getattr_dir_perms;
1745         files_search_home($1)
1746 ')
1747
1748 ########################################
1749 ## <summary>
1750 ##      Do not audit attempts to get the attributes of user home directories.
1751 ## </summary>
1752 ## <param name="domain">
1753 ##      <summary>
1754 ##      Domain to not audit.
1755 ##      </summary>
1756 ## </param>
1757 #
1758 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1759         gen_require(`
1760                 type user_home_dir_t;
1761         ')
1762
1763         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1764 ')
1765
1766 ########################################
1767 ## <summary>
1768 ##      Search user home directories.
1769 ## </summary>
1770 ## <param name="domain">
1771 ##      <summary>
1772 ##      Domain allowed access.
1773 ##      </summary>
1774 ## </param>
1775 #
1776 interface(`userdom_search_user_home_dirs',`
1777         gen_require(`
1778                 type user_home_dir_t;
1779         ')
1780
1781         allow $1 user_home_dir_t:dir search_dir_perms;
1782         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1783         files_search_home($1)
1784 ')
1785
1786 ########################################
1787 ## <summary>
1788 ##      Do not audit attempts to search user home directories.
1789 ## </summary>
1790 ## <desc>
1791 ##      <p>
1792 ##      Do not audit attempts to search user home directories.
1793 ##      This will supress SELinux denial messages when the specified
1794 ##      domain is denied the permission to search these directories.
1795 ##      </p>
1796 ## </desc>
1797 ## <param name="domain">
1798 ##      <summary>
1799 ##      Domain to not audit.
1800 ##      </summary>
1801 ## </param>
1802 ## <infoflow type="none"/>
1803 #
1804 interface(`userdom_dontaudit_search_user_home_dirs',`
1805         gen_require(`
1806                 type user_home_dir_t;
1807         ')
1808
1809         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1810 ')
1811
1812 ########################################
1813 ## <summary>
1814 ##      List user home directories.
1815 ## </summary>
1816 ## <param name="domain">
1817 ##      <summary>
1818 ##      Domain allowed access.
1819 ##      </summary>
1820 ## </param>
1821 #
1822 interface(`userdom_list_user_home_dirs',`
1823         gen_require(`
1824                 type user_home_dir_t;
1825         ')
1826
1827         allow $1 user_home_dir_t:dir list_dir_perms;
1828         files_search_home($1)
1829
1830         tunable_policy(`use_nfs_home_dirs',`
1831                 fs_list_nfs($1)
1832         ')
1833
1834         tunable_policy(`use_samba_home_dirs',`
1835                 fs_list_cifs($1)
1836         ')
1837 ')
1838
1839 ########################################
1840 ## <summary>
1841 ##      Do not audit attempts to list user home subdirectories.
1842 ## </summary>
1843 ## <param name="domain">
1844 ##      <summary>
1845 ##      Domain to not audit.
1846 ##      </summary>
1847 ## </param>
1848 #
1849 interface(`userdom_dontaudit_list_user_home_dirs',`
1850         gen_require(`
1851                 type user_home_dir_t;
1852                 type user_home_t;
1853         ')
1854
1855         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1856         dontaudit $1 user_home_t:dir list_dir_perms;
1857 ')
1858
1859 ########################################
1860 ## <summary>
1861 ##      Create user home directories.
1862 ## </summary>
1863 ## <param name="domain">
1864 ##      <summary>
1865 ##      Domain allowed access.
1866 ##      </summary>
1867 ## </param>
1868 #
1869 interface(`userdom_create_user_home_dirs',`
1870         gen_require(`
1871                 type user_home_dir_t;
1872         ')
1873
1874         allow $1 user_home_dir_t:dir create_dir_perms;
1875 ')
1876
1877 ########################################
1878 ## <summary>
1879 ##      Create user home directories.
1880 ## </summary>
1881 ## <param name="domain">
1882 ##      <summary>
1883 ##      Domain allowed access.
1884 ##      </summary>
1885 ## </param>
1886 #
1887 interface(`userdom_manage_user_home_dirs',`
1888         gen_require(`
1889                 type user_home_dir_t;
1890         ')
1891
1892         allow $1 user_home_dir_t:dir manage_dir_perms;
1893 ')
1894
1895 ########################################
1896 ## <summary>
1897 ##      Relabel to user home directories.
1898 ## </summary>
1899 ## <param name="domain">
1900 ##      <summary>
1901 ##      Domain allowed access.
1902 ##      </summary>
1903 ## </param>
1904 #
1905 interface(`userdom_relabelto_user_home_dirs',`
1906         gen_require(`
1907                 type user_home_dir_t;
1908         ')
1909
1910         allow $1 user_home_dir_t:dir relabelto;
1911 ')
1912
1913
1914 ########################################
1915 ## <summary>
1916 ##      Relabel to user home files.
1917 ## </summary>
1918 ## <param name="domain">
1919 ##      <summary>
1920 ##      Domain allowed access.
1921 ##      </summary>
1922 ## </param>
1923 #
1924 interface(`userdom_relabelto_user_home_files',`
1925         gen_require(`
1926                 type user_home_t;
1927         ')
1928
1929         allow $1 user_home_t:file relabelto;
1930 ')
1931 ########################################
1932 ## <summary>
1933 ##      Relabel user home files.
1934 ## </summary>
1935 ## <param name="domain">
1936 ##      <summary>
1937 ##      Domain allowed access.
1938 ##      </summary>
1939 ## </param>
1940 #
1941 interface(`userdom_relabel_user_home_files',`
1942         gen_require(`
1943                 type user_home_t;
1944         ')
1945
1946         allow $1 user_home_t:file relabel_file_perms;
1947 ')
1948
1949 ########################################
1950 ## <summary>
1951 ##      Create directories in the home dir root with
1952 ##      the user home directory type.
1953 ## </summary>
1954 ## <param name="domain">
1955 ##      <summary>
1956 ##      Domain allowed access.
1957 ##      </summary>
1958 ## </param>
1959 #
1960 interface(`userdom_home_filetrans_user_home_dir',`
1961         gen_require(`
1962                 type user_home_dir_t;
1963         ')
1964
1965         files_home_filetrans($1, user_home_dir_t, dir)
1966 ')
1967
1968 ########################################
1969 ## <summary>
1970 ##      Do a domain transition to the specified
1971 ##      domain when executing a program in the
1972 ##      user home directory.
1973 ## </summary>
1974 ## <desc>
1975 ##      <p>
1976 ##      Do a domain transition to the specified
1977 ##      domain when executing a program in the
1978 ##      user home directory.
1979 ##      </p>
1980 ##      <p>
1981 ##      No interprocess communication (signals, pipes,
1982 ##      etc.) is provided by this interface since
1983 ##      the domains are not owned by this module.
1984 ##      </p>
1985 ## </desc>
1986 ## <param name="source_domain">
1987 ##      <summary>
1988 ##      Domain allowed to transition.
1989 ##      </summary>
1990 ## </param>
1991 ## <param name="target_domain">
1992 ##      <summary>
1993 ##      Domain to transition to.
1994 ##      </summary>
1995 ## </param>
1996 #
1997 interface(`userdom_user_home_domtrans',`
1998         gen_require(`
1999                 type user_home_dir_t, user_home_t;
2000         ')
2001
2002         domain_auto_trans($1, user_home_t, $2)
2003         allow $1 user_home_dir_t:dir search_dir_perms;
2004         files_search_home($1)
2005 ')
2006
2007 ########################################
2008 ## <summary>
2009 ##      Do not audit attempts to search user home content directories.
2010 ## </summary>
2011 ## <param name="domain">
2012 ##      <summary>
2013 ##      Domain to not audit.
2014 ##      </summary>
2015 ## </param>
2016 #
2017 interface(`userdom_dontaudit_search_user_home_content',`
2018         gen_require(`
2019                 type user_home_t;
2020         ')
2021
2022         dontaudit $1 user_home_t:dir search_dir_perms;
2023         fs_dontaudit_list_nfs($1)
2024         fs_dontaudit_list_cifs($1)
2025 ')
2026
2027 ########################################
2028 ## <summary>
2029 ##      List contents of users home directory.
2030 ## </summary>
2031 ## <param name="domain">
2032 ##      <summary>
2033 ##      Domain allowed access.
2034 ##      </summary>
2035 ## </param>
2036 #
2037 interface(`userdom_list_user_home_content',`
2038         gen_require(`
2039                 type user_home_dir_t;
2040                 attribute user_home_type;
2041         ')
2042
2043         files_list_home($1)
2044         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2045 ')
2046
2047 ########################################
2048 ## <summary>
2049 ##      Create, read, write, and delete directories
2050 ##      in a user home subdirectory.
2051 ## </summary>
2052 ## <param name="domain">
2053 ##      <summary>
2054 ##      Domain allowed access.
2055 ##      </summary>
2056 ## </param>
2057 #
2058 interface(`userdom_manage_user_home_content_dirs',`
2059         gen_require(`
2060                 type user_home_dir_t, user_home_t;
2061         ')
2062
2063         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2064         files_search_home($1)
2065 ')
2066
2067 ########################################
2068 ## <summary>
2069 ##      Delete directories in a user home subdirectory.
2070 ## </summary>
2071 ## <param name="domain">
2072 ##      <summary>
2073 ##      Domain allowed access.
2074 ##      </summary>
2075 ## </param>
2076 #
2077 interface(`userdom_delete_user_home_content_dirs',`
2078         gen_require(`
2079                 type user_home_t;
2080         ')
2081
2082         allow $1 user_home_t:dir delete_dir_perms;
2083 ')
2084
2085 ########################################
2086 ## <summary>
2087 ##      Delete all directories in a user home subdirectory.
2088 ## </summary>
2089 ## <param name="domain">
2090 ##      <summary>
2091 ##      Domain allowed access.
2092 ##      </summary>
2093 ## </param>
2094 #
2095 interface(`userdom_delete_all_user_home_content_dirs',`
2096         gen_require(`
2097                 attribute user_home_type;
2098         ')
2099
2100         allow $1 user_home_type:dir delete_dir_perms;
2101 ')
2102
2103 ########################################
2104 ## <summary>
2105 ##      Set the attributes of user home files.
2106 ## </summary>
2107 ## <param name="domain">
2108 ##      <summary>
2109 ##      Domain allowed access.
2110 ##      </summary>
2111 ## </param>
2112 ## <rolecap/>
2113 #
2114 interface(`userdom_setattr_user_home_content_files',`
2115         gen_require(`
2116                 type user_home_t;
2117         ')
2118
2119         allow $1 user_home_t:file setattr;
2120 ')
2121
2122 ########################################
2123 ## <summary>
2124 ##      Do not audit attempts to set the
2125 ##      attributes of user home files.
2126 ## </summary>
2127 ## <param name="domain">
2128 ##      <summary>
2129 ##      Domain to not audit.
2130 ##      </summary>
2131 ## </param>
2132 #
2133 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2134         gen_require(`
2135                 type user_home_t;
2136         ')
2137
2138         dontaudit $1 user_home_t:file setattr_file_perms;
2139 ')
2140
2141 ########################################
2142 ## <summary>
2143 ##      Set the attributes of all user home directories.
2144 ## </summary>
2145 ## <param name="domain">
2146 ##      <summary>
2147 ##      Domain allowed access.
2148 ##      </summary>
2149 ## </param>
2150 ## <rolecap/>
2151 #
2152 interface(`userdom_setattr_all_user_home_content_dirs',`
2153         gen_require(`
2154                 attribute user_home_type;
2155         ')
2156
2157         allow $1 user_home_type:dir setattr_dir_perms;
2158 ')
2159
2160 ########################################
2161 ## <summary>
2162 ##      Mmap user home files.
2163 ## </summary>
2164 ## <param name="domain">
2165 ##      <summary>
2166 ##      Domain allowed access.
2167 ##      </summary>
2168 ## </param>
2169 #
2170 interface(`userdom_mmap_user_home_content_files',`
2171         gen_require(`
2172                 type user_home_dir_t, user_home_t;
2173         ')
2174
2175         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2176         files_search_home($1)
2177 ')
2178
2179 ########################################
2180 ## <summary>
2181 ##      Read user home files.
2182 ## </summary>
2183 ## <param name="domain">
2184 ##      <summary>
2185 ##      Domain allowed access.
2186 ##      </summary>
2187 ## </param>
2188 #
2189 interface(`userdom_read_user_home_content_files',`
2190         gen_require(`
2191                 type user_home_dir_t, user_home_t;
2192         ')
2193
2194         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2195         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2196         files_search_home($1)
2197 ')
2198
2199 ########################################
2200 ## <summary>
2201 ##      Do not audit attempts to getattr user home files.
2202 ## </summary>
2203 ## <param name="domain">
2204 ##      <summary>
2205 ##      Domain to not audit.
2206 ##      </summary>
2207 ## </param>
2208 #
2209 interface(`userdom_dontaudit_getattr_user_home_content',`
2210         gen_require(`
2211                 attribute user_home_type;
2212         ')
2213
2214         dontaudit $1 user_home_type:dir getattr;
2215         dontaudit $1 user_home_type:file getattr;
2216 ')
2217
2218 ########################################
2219 ## <summary>
2220 ##      Do not audit attempts to read user home files.
2221 ## </summary>
2222 ## <param name="domain">
2223 ##      <summary>
2224 ##      Domain to not audit.
2225 ##      </summary>
2226 ## </param>
2227 #
2228 interface(`userdom_dontaudit_read_user_home_content_files',`
2229         gen_require(`
2230                 attribute user_home_type;
2231                 type user_home_dir_t;
2232         ')
2233
2234         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2235         dontaudit $1 user_home_type:dir list_dir_perms;
2236         dontaudit $1 user_home_type:file read_file_perms;
2237         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2238 ')
2239
2240 ########################################
2241 ## <summary>
2242 ##      Do not audit attempts to append user home files.
2243 ## </summary>
2244 ## <param name="domain">
2245 ##      <summary>
2246 ##      Domain to not audit.
2247 ##      </summary>
2248 ## </param>
2249 #
2250 interface(`userdom_dontaudit_append_user_home_content_files',`
2251         gen_require(`
2252                 type user_home_t;
2253         ')
2254
2255         dontaudit $1 user_home_t:file append_file_perms;
2256 ')
2257
2258 ########################################
2259 ## <summary>
2260 ##      Do not audit attempts to write user home files.
2261 ## </summary>
2262 ## <param name="domain">
2263 ##      <summary>
2264 ##      Domain to not audit.
2265 ##      </summary>
2266 ## </param>
2267 #
2268 interface(`userdom_dontaudit_write_user_home_content_files',`
2269         gen_require(`
2270                 type user_home_t;
2271         ')
2272
2273         dontaudit $1 user_home_t:file write_file_perms;
2274 ')
2275
2276 ########################################
2277 ## <summary>
2278 ##      Delete files in a user home subdirectory.
2279 ## </summary>
2280 ## <param name="domain">
2281 ##      <summary>
2282 ##      Domain allowed access.
2283 ##      </summary>
2284 ## </param>
2285 #
2286 interface(`userdom_delete_user_home_content_files',`
2287         gen_require(`
2288                 type user_home_t;
2289         ')
2290
2291         allow $1 user_home_t:file delete_file_perms;
2292 ')
2293
2294 ########################################
2295 ## <summary>
2296 ##      Delete all files in a user home subdirectory.
2297 ## </summary>
2298 ## <param name="domain">
2299 ##      <summary>
2300 ##      Domain allowed access.
2301 ##      </summary>
2302 ## </param>
2303 #
2304 interface(`userdom_delete_all_user_home_content_files',`
2305         gen_require(`
2306                 attribute user_home_type;
2307         ')
2308
2309         allow $1 user_home_type:file delete_file_perms;
2310 ')
2311
2312 ########################################
2313 ## <summary>
2314 ##      Delete sock files in a user home subdirectory.
2315 ## </summary>
2316 ## <param name="domain">
2317 ##      <summary>
2318 ##      Domain allowed access.
2319 ##      </summary>
2320 ## </param>
2321 #
2322 interface(`userdom_delete_user_home_content_sock_files',`
2323         gen_require(`
2324                 type user_home_t;
2325         ')
2326
2327         allow $1 user_home_t:sock_file delete_file_perms;
2328 ')
2329
2330 ########################################
2331 ## <summary>
2332 ##      Delete all sock files in a user home subdirectory.
2333 ## </summary>
2334 ## <param name="domain">
2335 ##      <summary>
2336 ##      Domain allowed access.
2337 ##      </summary>
2338 ## </param>
2339 #
2340 interface(`userdom_delete_all_user_home_content_sock_files',`
2341         gen_require(`
2342                 attribute user_home_type;
2343         ')
2344
2345         allow $1 user_home_type:sock_file delete_file_perms;
2346 ')
2347
2348 ########################################
2349 ## <summary>
2350 ##      Do not audit attempts to write user home files.
2351 ## </summary>
2352 ## <param name="domain">
2353 ##      <summary>
2354 ##      Domain to not audit.
2355 ##      </summary>
2356 ## </param>
2357 #
2358 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2359         gen_require(`
2360                 type user_home_t;
2361         ')
2362
2363         dontaudit $1 user_home_t:file relabel_file_perms;
2364 ')
2365
2366 ########################################
2367 ## <summary>
2368 ##      Read user home subdirectory symbolic links.
2369 ## </summary>
2370 ## <param name="domain">
2371 ##      <summary>
2372 ##      Domain allowed access.
2373 ##      </summary>
2374 ## </param>
2375 #
2376 interface(`userdom_read_user_home_content_symlinks',`
2377         gen_require(`
2378                 type user_home_dir_t, user_home_t;
2379         ')
2380
2381         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2382 ')
2383
2384 ########################################
2385 ## <summary>
2386 ##      Execute user home files.
2387 ## </summary>
2388 ## <param name="domain">
2389 ##      <summary>
2390 ##      Domain allowed access.
2391 ##      </summary>
2392 ## </param>
2393 ## <rolecap/>
2394 #
2395 interface(`userdom_exec_user_home_content_files',`
2396         gen_require(`
2397                 type user_home_dir_t;
2398                 attribute user_home_type;
2399         ')
2400
2401         files_search_home($1)
2402         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2403         dontaudit $1 user_home_type:sock_file execute;
2404         ')
2405
2406 ########################################
2407 ## <summary>
2408 ##      Do not audit attempts to execute user home files.
2409 ## </summary>
2410 ## <param name="domain">
2411 ##      <summary>
2412 ##      Domain to not audit.
2413 ##      </summary>
2414 ## </param>
2415 #
2416 interface(`userdom_dontaudit_exec_user_home_content_files',`
2417         gen_require(`
2418                 type user_home_t;
2419         ')
2420
2421         dontaudit $1 user_home_t:file exec_file_perms;
2422 ')
2423
2424 ########################################
2425 ## <summary>
2426 ##      Create, read, write, and delete files
2427 ##      in a user home subdirectory.
2428 ## </summary>
2429 ## <param name="domain">
2430 ##      <summary>
2431 ##      Domain allowed access.
2432 ##      </summary>
2433 ## </param>
2434 #
2435 interface(`userdom_manage_user_home_content_files',`
2436         gen_require(`
2437                 type user_home_dir_t, user_home_t;
2438         ')
2439
2440         manage_files_pattern($1, user_home_t, user_home_t)
2441         allow $1 user_home_dir_t:dir search_dir_perms;
2442         files_search_home($1)
2443 ')
2444
2445 ########################################
2446 ## <summary>
2447 ##      Do not audit attempts to create, read, write, and delete directories
2448 ##      in a user home subdirectory.
2449 ## </summary>
2450 ## <param name="domain">
2451 ##      <summary>
2452 ##      Domain to not audit.
2453 ##      </summary>
2454 ## </param>
2455 #
2456 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2457         gen_require(`
2458                 type user_home_dir_t, user_home_t;
2459         ')
2460
2461         dontaudit $1 user_home_t:dir manage_dir_perms;
2462 ')
2463
2464 ########################################
2465 ## <summary>
2466 ##      Create, read, write, and delete symbolic links
2467 ##      in a user home subdirectory.
2468 ## </summary>
2469 ## <param name="domain">
2470 ##      <summary>
2471 ##      Domain allowed access.
2472 ##      </summary>
2473 ## </param>
2474 #
2475 interface(`userdom_manage_user_home_content_symlinks',`
2476         gen_require(`
2477                 type user_home_dir_t, user_home_t;
2478         ')
2479
2480         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2481         allow $1 user_home_dir_t:dir search_dir_perms;
2482         files_search_home($1)
2483 ')
2484
2485 ########################################
2486 ## <summary>
2487 ##      Delete symbolic links in a user home directory.
2488 ## </summary>
2489 ## <param name="domain">
2490 ##      <summary>
2491 ##      Domain allowed access.
2492 ##      </summary>
2493 ## </param>
2494 #
2495 interface(`userdom_delete_user_home_content_symlinks',`
2496         gen_require(`
2497                 type user_home_t;
2498         ')
2499
2500         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2501 ')
2502
2503 ########################################
2504 ## <summary>
2505 ##      Delete all symbolic links in a user home directory.
2506 ## </summary>
2507 ## <param name="domain">
2508 ##      <summary>
2509 ##      Domain allowed access.
2510 ##      </summary>
2511 ## </param>
2512 #
2513 interface(`userdom_delete_all_user_home_content_symlinks',`
2514         gen_require(`
2515                 attribute user_home_type;
2516         ')
2517
2518         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2519 ')
2520
2521 ########################################
2522 ## <summary>
2523 ##      Create, read, write, and delete named pipes
2524 ##      in a user home subdirectory.
2525 ## </summary>
2526 ## <param name="domain">
2527 ##      <summary>
2528 ##      Domain allowed access.
2529 ##      </summary>
2530 ## </param>
2531 #
2532 interface(`userdom_manage_user_home_content_pipes',`
2533         gen_require(`
2534                 type user_home_dir_t, user_home_t;
2535         ')
2536
2537         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2538         allow $1 user_home_dir_t:dir search_dir_perms;
2539         files_search_home($1)
2540 ')
2541
2542 ########################################
2543 ## <summary>
2544 ##      Create, read, write, and delete named sockets
2545 ##      in a user home subdirectory.
2546 ## </summary>
2547 ## <param name="domain">
2548 ##      <summary>
2549 ##      Domain allowed access.
2550 ##      </summary>
2551 ## </param>
2552 #
2553 interface(`userdom_manage_user_home_content_sockets',`
2554         gen_require(`
2555                 type user_home_dir_t, user_home_t;
2556         ')
2557
2558         allow $1 user_home_dir_t:dir search_dir_perms;
2559         manage_sock_files_pattern($1, user_home_t, user_home_t)
2560         files_search_home($1)
2561 ')
2562
2563 ########################################
2564 ## <summary>
2565 ##      Create objects in a user home directory
2566 ##      with an automatic type transition to
2567 ##      a specified private type.
2568 ## </summary>
2569 ## <param name="domain">
2570 ##      <summary>
2571 ##      Domain allowed access.
2572 ##      </summary>
2573 ## </param>
2574 ## <param name="private_type">
2575 ##      <summary>
2576 ##      The type of the object to create.
2577 ##      </summary>
2578 ## </param>
2579 ## <param name="object_class">
2580 ##      <summary>
2581 ##      The class of the object to be created.
2582 ##      </summary>
2583 ## </param>
2584 #
2585 interface(`userdom_user_home_dir_filetrans',`
2586         gen_require(`
2587                 type user_home_dir_t;
2588         ')
2589
2590         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2591         files_search_home($1)
2592 ')
2593
2594 ########################################
2595 ## <summary>
2596 ##      Create objects in a user home directory
2597 ##      with an automatic type transition to
2598 ##      a specified private type.
2599 ## </summary>
2600 ## <param name="domain">
2601 ##      <summary>
2602 ##      Domain allowed access.
2603 ##      </summary>
2604 ## </param>
2605 ## <param name="private_type">
2606 ##      <summary>
2607 ##      The type of the object to create.
2608 ##      </summary>
2609 ## </param>
2610 ## <param name="object_class">
2611 ##      <summary>
2612 ##      The class of the object to be created.
2613 ##      </summary>
2614 ## </param>
2615 #
2616 interface(`userdom_user_home_content_filetrans',`
2617         gen_require(`
2618                 type user_home_dir_t, user_home_t;
2619         ')
2620
2621         filetrans_pattern($1, user_home_t, $2, $3)
2622         allow $1 user_home_dir_t:dir search_dir_perms;
2623         files_search_home($1)
2624 ')
2625
2626 ########################################
2627 ## <summary>
2628 ##      Create objects in a user home directory
2629 ##      with an automatic type transition to
2630 ##      the user home file type.
2631 ## </summary>
2632 ## <param name="domain">
2633 ##      <summary>
2634 ##      Domain allowed access.
2635 ##      </summary>
2636 ## </param>
2637 ## <param name="object_class">
2638 ##      <summary>
2639 ##      The class of the object to be created.
2640 ##      </summary>
2641 ## </param>
2642 #
2643 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2644         gen_require(`
2645                 type user_home_dir_t, user_home_t;
2646         ')
2647
2648         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2649         files_search_home($1)
2650 ')
2651
2652 ########################################
2653 ## <summary>
2654 ##      Write to user temporary named sockets.
2655 ## </summary>
2656 ## <param name="domain">
2657 ##      <summary>
2658 ##      Domain allowed access.
2659 ##      </summary>
2660 ## </param>
2661 #
2662 interface(`userdom_write_user_tmp_sockets',`
2663         gen_require(`
2664                 type user_tmp_t;
2665         ')
2666
2667         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2668         files_search_tmp($1)
2669 ')
2670
2671 ########################################
2672 ## <summary>
2673 ##      List user temporary directories.
2674 ## </summary>
2675 ## <param name="domain">
2676 ##      <summary>
2677 ##      Domain allowed access.
2678 ##      </summary>
2679 ## </param>
2680 #
2681 interface(`userdom_list_user_tmp',`
2682         gen_require(`
2683                 type user_tmp_t;
2684         ')
2685
2686         allow $1 user_tmp_t:dir list_dir_perms;
2687         files_search_tmp($1)
2688 ')
2689
2690 ########################################
2691 ## <summary>
2692 ##      Do not audit attempts to list user
2693 ##      temporary directories.
2694 ## </summary>
2695 ## <param name="domain">
2696 ##      <summary>
2697 ##      Domain to not audit.
2698 ##      </summary>
2699 ## </param>
2700 #
2701 interface(`userdom_dontaudit_list_user_tmp',`
2702         gen_require(`
2703                 type user_tmp_t;
2704         ')
2705
2706         dontaudit $1 user_tmp_t:dir list_dir_perms;
2707 ')
2708
2709 ########################################
2710 ## <summary>
2711 ##      Do not audit attempts to manage users
2712 ##      temporary directories.
2713 ## </summary>
2714 ## <param name="domain">
2715 ##      <summary>
2716 ##      Domain to not audit.
2717 ##      </summary>
2718 ## </param>
2719 #
2720 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2721         gen_require(`
2722                 type user_tmp_t;
2723         ')
2724
2725         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2726 ')
2727
2728 ########################################
2729 ## <summary>
2730 ##      Read user temporary files.
2731 ## </summary>
2732 ## <param name="domain">
2733 ##      <summary>
2734 ##      Domain allowed access.
2735 ##      </summary>
2736 ## </param>
2737 #
2738 interface(`userdom_read_user_tmp_files',`
2739         gen_require(`
2740                 type user_tmp_t;
2741         ')
2742
2743         read_files_pattern($1, user_tmp_t, user_tmp_t)
2744         allow $1 user_tmp_t:dir list_dir_perms;
2745         files_search_tmp($1)
2746 ')
2747
2748 ########################################
2749 ## <summary>
2750 ##      Do not audit attempts to read users
2751 ##      temporary files.
2752 ## </summary>
2753 ## <param name="domain">
2754 ##      <summary>
2755 ##      Domain to not audit.
2756 ##      </summary>
2757 ## </param>
2758 #
2759 interface(`userdom_dontaudit_read_user_tmp_files',`
2760         gen_require(`
2761                 type user_tmp_t;
2762         ')
2763
2764         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2765 ')
2766
2767 ########################################
2768 ## <summary>
2769 ##      Do not audit attempts to append users
2770 ##      temporary files.
2771 ## </summary>
2772 ## <param name="domain">
2773 ##      <summary>
2774 ##      Domain to not audit.
2775 ##      </summary>
2776 ## </param>
2777 #
2778 interface(`userdom_dontaudit_append_user_tmp_files',`
2779         gen_require(`
2780                 type user_tmp_t;
2781         ')
2782
2783         dontaudit $1 user_tmp_t:file append_file_perms;
2784 ')
2785
2786 ########################################
2787 ## <summary>
2788 ##      Read and write user temporary files.
2789 ## </summary>
2790 ## <param name="domain">
2791 ##      <summary>
2792 ##      Domain allowed access.
2793 ##      </summary>
2794 ## </param>
2795 #
2796 interface(`userdom_rw_user_tmp_files',`
2797         gen_require(`
2798                 type user_tmp_t;
2799         ')
2800
2801         allow $1 user_tmp_t:dir list_dir_perms;
2802         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2803         files_search_tmp($1)
2804 ')
2805
2806 ########################################
2807 ## <summary>
2808 ##      Do not audit attempts to manage users
2809 ##      temporary files.
2810 ## </summary>
2811 ## <param name="domain">
2812 ##      <summary>
2813 ##      Domain to not audit.
2814 ##      </summary>
2815 ## </param>
2816 #
2817 interface(`userdom_dontaudit_manage_user_tmp_files',`
2818         gen_require(`
2819                 type user_tmp_t;
2820         ')
2821
2822         dontaudit $1 user_tmp_t:file manage_file_perms;
2823 ')
2824
2825 ########################################
2826 ## <summary>
2827 ##      Read user temporary symbolic links.
2828 ## </summary>
2829 ## <param name="domain">
2830 ##      <summary>
2831 ##      Domain allowed access.
2832 ##      </summary>
2833 ## </param>
2834 #
2835 interface(`userdom_read_user_tmp_symlinks',`
2836         gen_require(`
2837                 type user_tmp_t;
2838         ')
2839
2840         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2841         allow $1 user_tmp_t:dir list_dir_perms;
2842         files_search_tmp($1)
2843 ')
2844
2845 ########################################
2846 ## <summary>
2847 ##      Create, read, write, and delete user
2848 ##      temporary directories.
2849 ## </summary>
2850 ## <param name="domain">
2851 ##      <summary>
2852 ##      Domain allowed access.
2853 ##      </summary>
2854 ## </param>
2855 #
2856 interface(`userdom_manage_user_tmp_dirs',`
2857         gen_require(`
2858                 type user_tmp_t;
2859         ')
2860
2861         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2862         files_search_tmp($1)
2863 ')
2864
2865 ########################################
2866 ## <summary>
2867 ##      Create, read, write, and delete user
2868 ##      temporary files.
2869 ## </summary>
2870 ## <param name="domain">
2871 ##      <summary>
2872 ##      Domain allowed access.
2873 ##      </summary>
2874 ## </param>
2875 #
2876 interface(`userdom_manage_user_tmp_files',`
2877         gen_require(`
2878                 type user_tmp_t;
2879         ')
2880
2881         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2882         files_search_tmp($1)
2883 ')
2884
2885 ########################################
2886 ## <summary>
2887 ##      Create, read, write, and delete user
2888 ##      temporary symbolic links.
2889 ## </summary>
2890 ## <param name="domain">
2891 ##      <summary>
2892 ##      Domain allowed access.
2893 ##      </summary>
2894 ## </param>
2895 #
2896 interface(`userdom_manage_user_tmp_symlinks',`
2897         gen_require(`
2898                 type user_tmp_t;
2899         ')
2900
2901         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2902         files_search_tmp($1)
2903 ')
2904
2905 ########################################
2906 ## <summary>
2907 ##      Create, read, write, and delete user
2908 ##      temporary named pipes.
2909 ## </summary>
2910 ## <param name="domain">
2911 ##      <summary>
2912 ##      Domain allowed access.
2913 ##      </summary>
2914 ## </param>
2915 #
2916 interface(`userdom_manage_user_tmp_pipes',`
2917         gen_require(`
2918                 type user_tmp_t;
2919         ')
2920
2921         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2922         files_search_tmp($1)
2923 ')
2924
2925 ########################################
2926 ## <summary>
2927 ##      Create, read, write, and delete user
2928 ##      temporary named sockets.
2929 ## </summary>
2930 ## <param name="domain">
2931 ##      <summary>
2932 ##      Domain allowed access.
2933 ##      </summary>
2934 ## </param>
2935 #
2936 interface(`userdom_manage_user_tmp_sockets',`
2937         gen_require(`
2938                 type user_tmp_t;
2939         ')
2940
2941         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2942         files_search_tmp($1)
2943 ')
2944
2945 ########################################
2946 ## <summary>
2947 ##      Create objects in a user temporary directory
2948 ##      with an automatic type transition to
2949 ##      a specified private type.
2950 ## </summary>
2951 ## <param name="domain">
2952 ##      <summary>
2953 ##      Domain allowed access.
2954 ##      </summary>
2955 ## </param>
2956 ## <param name="private_type">
2957 ##      <summary>
2958 ##      The type of the object to create.
2959 ##      </summary>
2960 ## </param>
2961 ## <param name="object_class">
2962 ##      <summary>
2963 ##      The class of the object to be created.
2964 ##      </summary>
2965 ## </param>
2966 #
2967 interface(`userdom_user_tmp_filetrans',`
2968         gen_require(`
2969                 type user_tmp_t;
2970         ')
2971
2972         filetrans_pattern($1, user_tmp_t, $2, $3)
2973         files_search_tmp($1)
2974 ')
2975
2976 ########################################
2977 ## <summary>
2978 ##      Create objects in the temporary directory
2979 ##      with an automatic type transition to
2980 ##      the user temporary type.
2981 ## </summary>
2982 ## <param name="domain">
2983 ##      <summary>
2984 ##      Domain allowed access.
2985 ##      </summary>
2986 ## </param>
2987 ## <param name="object_class">
2988 ##      <summary>
2989 ##      The class of the object to be created.
2990 ##      </summary>
2991 ## </param>
2992 #
2993 interface(`userdom_tmp_filetrans_user_tmp',`
2994         gen_require(`
2995                 type user_tmp_t;
2996         ')
2997
2998         files_tmp_filetrans($1, user_tmp_t, $2)
2999 ')
3000
3001 ########################################
3002 ## <summary>
3003 ##      Read user tmpfs files.
3004 ## </summary>
3005 ## <param name="domain">
3006 ##      <summary>
3007 ##      Domain allowed access.
3008 ##      </summary>
3009 ## </param>
3010 #
3011 interface(`userdom_read_user_tmpfs_files',`
3012         gen_require(`
3013                 type user_tmpfs_t;
3014         ')
3015
3016         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3017         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3018         allow $1 user_tmpfs_t:dir list_dir_perms;
3019         fs_search_tmpfs($1)
3020 ')
3021
3022 ########################################
3023 ## <summary>
3024 ##      Read/Write user tmpfs files.
3025 ## </summary>
3026 ## <param name="domain">
3027 ##      <summary>
3028 ##      Domain allowed access.
3029 ##      </summary>
3030 ## </param>
3031 #
3032 interface(`userdom_rw_user_tmpfs_files',`
3033         gen_require(`
3034                 type user_tmpfs_t;
3035         ')
3036
3037         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3038         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3039         allow $1 user_tmpfs_t:dir list_dir_perms;
3040         fs_search_tmpfs($1)
3041 ')
3042
3043 ########################################
3044 ## <summary>
3045 ##      Get the attributes of a user domain tty.
3046 ## </summary>
3047 ## <param name="domain">
3048 ##      <summary>
3049 ##      Domain allowed access.
3050 ##      </summary>
3051 ## </param>
3052 #
3053 interface(`userdom_getattr_user_ttys',`
3054         gen_require(`
3055                 type user_tty_device_t;
3056         ')
3057
3058         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3059 ')
3060
3061 ########################################
3062 ## <summary>
3063 ##      Do not audit attempts to get the attributes of a user domain tty.
3064 ## </summary>
3065 ## <param name="domain">
3066 ##      <summary>
3067 ##      Domain to not audit.
3068 ##      </summary>
3069 ## </param>
3070 #
3071 interface(`userdom_dontaudit_getattr_user_ttys',`
3072         gen_require(`
3073                 type user_tty_device_t;
3074         ')
3075
3076         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3077 ')
3078
3079 ########################################
3080 ## <summary>
3081 ##      Set the attributes of a user domain tty.
3082 ## </summary>
3083 ## <param name="domain">
3084 ##      <summary>
3085 ##      Domain allowed access.
3086 ##      </summary>
3087 ## </param>
3088 #
3089 interface(`userdom_setattr_user_ttys',`
3090         gen_require(`
3091                 type user_tty_device_t;
3092         ')
3093
3094         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3095 ')
3096
3097 ########################################
3098 ## <summary>
3099 ##      Do not audit attempts to set the attributes of a user domain tty.
3100 ## </summary>
3101 ## <param name="domain">
3102 ##      <summary>
3103 ##      Domain to not audit.
3104 ##      </summary>
3105 ## </param>
3106 #
3107 interface(`userdom_dontaudit_setattr_user_ttys',`
3108         gen_require(`
3109                 type user_tty_device_t;
3110         ')
3111
3112         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3113 ')
3114
3115 ########################################
3116 ## <summary>
3117 ##      Read and write a user domain tty.
3118 ## </summary>
3119 ## <param name="domain">
3120 ##      <summary>
3121 ##      Domain allowed access.
3122 ##      </summary>
3123 ## </param>
3124 #
3125 interface(`userdom_use_user_ttys',`
3126         gen_require(`
3127                 type user_tty_device_t;
3128         ')
3129
3130         allow $1 user_tty_device_t:chr_file rw_term_perms;
3131 ')
3132
3133 ########################################
3134 ## <summary>
3135 ##      Read and write a inherited user domain tty.
3136 ## </summary>
3137 ## <param name="domain">
3138 ##      <summary>
3139 ##      Domain allowed access.
3140 ##      </summary>
3141 ## </param>
3142 #
3143 interface(`userdom_use_inherited_user_ttys',`
3144         gen_require(`
3145                 type user_tty_device_t;
3146         ')
3147
3148         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3149 ')
3150
3151 ########################################
3152 ## <summary>
3153 ##      Read and write a user domain pty.
3154 ## </summary>
3155 ## <param name="domain">
3156 ##      <summary>
3157 ##      Domain allowed access.
3158 ##      </summary>
3159 ## </param>
3160 #
3161 interface(`userdom_use_user_ptys',`
3162         gen_require(`
3163                 type user_devpts_t;
3164         ')
3165
3166         allow $1 user_devpts_t:chr_file rw_term_perms;
3167 ')
3168
3169 ########################################
3170 ## <summary>
3171 ##      Read and write a inherited user domain pty.
3172 ## </summary>
3173 ## <param name="domain">
3174 ##      <summary>
3175 ##      Domain allowed access.
3176 ##      </summary>
3177 ## </param>
3178 #
3179 interface(`userdom_use_inherited_user_ptys',`
3180         gen_require(`
3181                 type user_devpts_t;
3182         ')
3183
3184         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3185 ')
3186
3187 ########################################
3188 ## <summary>
3189 ##      Read and write a inherited user TTYs and PTYs.
3190 ## </summary>
3191 ## <desc>
3192 ##      <p>
3193 ##      Allow the specified domain to read and write inherited user
3194 ##      TTYs and PTYs. This will allow the domain to
3195 ##      interact with the user via the terminal. Typically
3196 ##      all interactive applications will require this
3197 ##      access.
3198 ##      </p>
3199 ## </desc>
3200 ## <param name="domain">
3201 ##      <summary>
3202 ##      Domain allowed access.
3203 ##      </summary>
3204 ## </param>
3205 ## <infoflow type="both" weight="10"/>
3206 #
3207 interface(`userdom_use_inherited_user_terminals',`
3208         gen_require(`
3209                 type user_tty_device_t, user_devpts_t;
3210         ')
3211
3212         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3213         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3214 ')
3215
3216 #######################################
3217 ## <summary>
3218 ##  Allow attempts to read and write
3219 ##  a user domain tty and pty.
3220 ## </summary>
3221 ## <param name="domain">
3222 ##  <summary>
3223 ##  Domain to not audit.
3224 ##  </summary>
3225 ## </param>
3226 #
3227 interface(`userdom_use_user_terminals',`
3228     gen_require(`
3229         type user_tty_device_t, user_devpts_t;
3230     ')
3231
3232     allow $1 user_tty_device_t:chr_file rw_term_perms;
3233     allow $1 user_devpts_t:chr_file rw_term_perms;
3234 ')
3235
3236 ########################################
3237 ## <summary>
3238 ##      Do not audit attempts to read and write
3239 ##      a user domain tty and pty.
3240 ## </summary>
3241 ## <param name="domain">
3242 ##      <summary>
3243 ##      Domain to not audit.
3244 ##      </summary>
3245 ## </param>
3246 #
3247 interface(`userdom_dontaudit_use_user_terminals',`
3248         gen_require(`
3249                 type user_tty_device_t, user_devpts_t;
3250         ')
3251
3252         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3253         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3254 ')
3255
3256
3257 ########################################
3258 ## <summary>
3259 ##      Get attributes of user domain tty and pty.
3260 ## </summary>
3261 ## <param name="domain">
3262 ##      <summary>
3263 ##      Domain allowed access.
3264 ##      </summary>
3265 ## </param>
3266 #
3267 interface(`userdom_getattr_user_terminals',`
3268         gen_require(`
3269                 type user_tty_device_t, user_devpts_t;
3270         ')
3271
3272         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3273 ')
3274
3275 ########################################
3276 ## <summary>
3277 ##      Execute a shell in all user domains.  This
3278 ##      is an explicit transition, requiring the
3279 ##      caller to use setexeccon().
3280 ## </summary>
3281 ## <param name="domain">
3282 ##      <summary>
3283 ##      Domain allowed to transition.
3284 ##      </summary>
3285 ## </param>
3286 #
3287 interface(`userdom_spec_domtrans_all_users',`
3288         gen_require(`
3289                 attribute userdomain;
3290         ')
3291
3292         corecmd_shell_spec_domtrans($1, userdomain)
3293         allow userdomain $1:fd use;
3294         allow userdomain $1:fifo_file rw_file_perms;
3295         allow userdomain $1:process sigchld;
3296 ')
3297
3298 ########################################
3299 ## <summary>
3300 ##      Execute an Xserver session in all unprivileged user domains.  This
3301 ##      is an explicit transition, requiring the
3302 ##      caller to use setexeccon().
3303 ## </summary>
3304 ## <param name="domain">
3305 ##      <summary>
3306 ##      Domain allowed to transition.
3307 ##      </summary>
3308 ## </param>
3309 #
3310 interface(`userdom_xsession_spec_domtrans_all_users',`
3311         gen_require(`
3312                 attribute userdomain;
3313         ')
3314
3315         xserver_xsession_spec_domtrans($1, userdomain)
3316         allow userdomain $1:fd use;
3317         allow userdomain $1:fifo_file rw_file_perms;
3318         allow userdomain $1:process sigchld;
3319 ')
3320
3321 ########################################
3322 ## <summary>
3323 ##      Execute a shell in all unprivileged user domains.  This
3324 ##      is an explicit transition, requiring the
3325 ##      caller to use setexeccon().
3326 ## </summary>
3327 ## <param name="domain">
3328 ##      <summary>
3329 ##      Domain allowed to transition.
3330 ##      </summary>
3331 ## </param>
3332 #
3333 interface(`userdom_spec_domtrans_unpriv_users',`
3334         gen_require(`
3335                 attribute unpriv_userdomain;
3336         ')
3337
3338         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3339         allow unpriv_userdomain $1:fd use;
3340         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3341         allow unpriv_userdomain $1:process sigchld;
3342 ')
3343
3344 ########################################
3345 ## <summary>
3346 ##      Execute an Xserver session in all unprivileged user domains.  This
3347 ##      is an explicit transition, requiring the
3348 ##      caller to use setexeccon().
3349 ## </summary>
3350 ## <param name="domain">
3351 ##      <summary>
3352 ##      Domain allowed to transition.
3353 ##      </summary>
3354 ## </param>
3355 #
3356 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3357         gen_require(`
3358                 attribute unpriv_userdomain;
3359         ')
3360
3361         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3362         allow unpriv_userdomain $1:fd use;
3363         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3364         allow unpriv_userdomain $1:process sigchld;
3365 ')
3366
3367 ########################################
3368 ## <summary>
3369 ##      Manage unpriviledged user SysV sempaphores.
3370 ## </summary>
3371 ## <param name="domain">
3372 ##      <summary>
3373 ##      Domain allowed access.
3374 ##      </summary>
3375 ## </param>
3376 #
3377 interface(`userdom_manage_unpriv_user_semaphores',`
3378         gen_require(`
3379                 attribute unpriv_userdomain;
3380         ')
3381
3382         allow $1 unpriv_userdomain:sem create_sem_perms;
3383 ')
3384
3385 ########################################
3386 ## <summary>
3387 ##      Manage unpriviledged user SysV shared
3388 ##      memory segments.
3389 ## </summary>
3390 ## <param name="domain">
3391 ##      <summary>
3392 ##      Domain allowed access.
3393 ##      </summary>
3394 ## </param>
3395 #
3396 interface(`userdom_manage_unpriv_user_shared_mem',`
3397         gen_require(`
3398                 attribute unpriv_userdomain;
3399         ')
3400
3401         allow $1 unpriv_userdomain:shm create_shm_perms;
3402 ')
3403
3404 ########################################
3405 ## <summary>
3406 ##      Execute bin_t in the unprivileged user domains. This
3407 ##      is an explicit transition, requiring the
3408 ##      caller to use setexeccon().
3409 ## </summary>
3410 ## <param name="domain">
3411 ##      <summary>
3412 ##      Domain allowed to transition.
3413 ##      </summary>
3414 ## </param>
3415 #
3416 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3417         gen_require(`
3418                 attribute unpriv_userdomain;
3419         ')
3420
3421         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3422         allow unpriv_userdomain $1:fd use;
3423         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3424         allow unpriv_userdomain $1:process sigchld;
3425 ')
3426
3427 ########################################
3428 ## <summary>
3429 ##      Execute all entrypoint files in unprivileged user
3430 ##      domains. This is an explicit transition, requiring the
3431 ##      caller to use setexeccon().
3432 ## </summary>
3433 ## <param name="domain">
3434 ##      <summary>
3435 ##      Domain allowed access.
3436 ##      </summary>
3437 ## </param>
3438 #
3439 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3440         gen_require(`
3441                 attribute unpriv_userdomain;
3442         ')
3443
3444         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3445         allow unpriv_userdomain $1:fd use;
3446         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3447         allow unpriv_userdomain $1:process sigchld;
3448 ')
3449
3450 ########################################
3451 ## <summary>
3452 ##      Search users home directories.
3453 ## </summary>
3454 ## <param name="domain">
3455 ##      <summary>
3456 ##      Domain allowed access.
3457 ##      </summary>
3458 ## </param>
3459 #
3460 interface(`userdom_search_user_home_content',`
3461         gen_require(`
3462                 type user_home_dir_t;
3463                 attribute user_home_type;
3464         ')
3465
3466         files_list_home($1)
3467         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3468         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3469 ')
3470
3471 ########################################
3472 ## <summary>
3473 ##      Send general signals to unprivileged user domains.
3474 ## </summary>
3475 ## <param name="domain">
3476 ##      <summary>
3477 ##      Domain allowed access.
3478 ##      </summary>
3479 ## </param>
3480 #
3481 interface(`userdom_signal_unpriv_users',`
3482         gen_require(`
3483                 attribute unpriv_userdomain;
3484         ')
3485
3486         allow $1 unpriv_userdomain:process signal;
3487 ')
3488
3489 ########################################
3490 ## <summary>
3491 ##      Inherit the file descriptors from unprivileged user domains.
3492 ## </summary>
3493 ## <param name="domain">
3494 ##      <summary>
3495 ##      Domain allowed access.
3496 ##      </summary>
3497 ## </param>
3498 #
3499 interface(`userdom_use_unpriv_users_fds',`
3500         gen_require(`
3501                 attribute unpriv_userdomain;
3502         ')
3503
3504         allow $1 unpriv_userdomain:fd use;
3505 ')
3506
3507 ########################################
3508 ## <summary>
3509 ##      Do not audit attempts to inherit the file descriptors
3510 ##      from unprivileged user domains.
3511 ## </summary>
3512 ## <desc>
3513 ##      <p>
3514 ##      Do not audit attempts to inherit the file descriptors
3515 ##      from unprivileged user domains. This will supress
3516 ##      SELinux denial messages when the specified domain is denied
3517 ##      the permission to inherit these file descriptors.
3518 ##      </p>
3519 ## </desc>
3520 ## <param name="domain">
3521 ##      <summary>
3522 ##      Domain to not audit.
3523 ##      </summary>
3524 ## </param>
3525 ## <infoflow type="none"/>
3526 #
3527 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3528         gen_require(`
3529                 attribute unpriv_userdomain;
3530         ')
3531
3532         dontaudit $1 unpriv_userdomain:fd use;
3533 ')
3534
3535 ########################################
3536 ## <summary>
3537 ##      Do not audit attempts to use user ptys.
3538 ## </summary>
3539 ## <param name="domain">
3540 ##      <summary>
3541 ##      Domain to not audit.
3542 ##      </summary>
3543 ## </param>
3544 #
3545 interface(`userdom_dontaudit_use_user_ptys',`
3546         gen_require(`
3547                 type user_devpts_t;
3548         ')
3549
3550         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3551 ')
3552
3553 ########################################
3554 ## <summary>
3555 ##      Relabel files to unprivileged user pty types.
3556 ## </summary>
3557 ## <param name="domain">
3558 ##      <summary>
3559 ##      Domain allowed access.
3560 ##      </summary>
3561 ## </param>
3562 #
3563 interface(`userdom_relabelto_user_ptys',`
3564         gen_require(`
3565                 type user_devpts_t;
3566         ')
3567
3568         allow $1 user_devpts_t:chr_file relabelto;
3569 ')
3570
3571 ########################################
3572 ## <summary>
3573 ##      Do not audit attempts to relabel files from
3574 ##      user pty types.
3575 ## </summary>
3576 ## <param name="domain">
3577 ##      <summary>
3578 ##      Domain to not audit.
3579 ##      </summary>
3580 ## </param>
3581 #
3582 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3583         gen_require(`
3584                 type user_devpts_t;
3585         ')
3586
3587         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3588 ')
3589
3590 ########################################
3591 ## <summary>
3592 ##      Write all users files in /tmp
3593 ## </summary>
3594 ## <param name="domain">
3595 ##      <summary>
3596 ##      Domain allowed access.
3597 ##      </summary>
3598 ## </param>
3599 #
3600 interface(`userdom_write_user_tmp_files',`
3601         gen_require(`
3602                 type user_tmp_t;
3603         ')
3604
3605         write_files_pattern($1, user_tmp_t, user_tmp_t)
3606 ')
3607
3608 ########################################
3609 ## <summary>
3610 ##      Do not audit attempts to write users
3611 ##      temporary files.
3612 ## </summary>
3613 ## <param name="domain">
3614 ##      <summary>
3615 ##      Domain to not audit.
3616 ##      </summary>
3617 ## </param>
3618 #
3619 interface(`userdom_dontaudit_write_user_tmp_files',`
3620         gen_require(`
3621                 type user_tmp_t;
3622         ')
3623
3624         dontaudit $1 user_tmp_t:file write;
3625 ')
3626
3627 ########################################
3628 ## <summary>
3629 ##      Do not audit attempts to read/write users
3630 ##      temporary fifo files.
3631 ## </summary>
3632 ## <param name="domain">
3633 ##      <summary>
3634 ##      Domain to not audit.
3635 ##      </summary>
3636 ## </param>
3637 #
3638 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3639         gen_require(`
3640                 type user_tmp_t;
3641         ')
3642
3643         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3644 ')
3645
3646 ########################################
3647 ## <summary>
3648 ##      Do not audit attempts to use user ttys.
3649 ## </summary>
3650 ## <param name="domain">
3651 ##      <summary>
3652 ##      Domain to not audit.
3653 ##      </summary>
3654 ## </param>
3655 #
3656 interface(`userdom_dontaudit_use_user_ttys',`
3657         gen_require(`
3658                 type user_tty_device_t;
3659         ')
3660
3661         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3662 ')
3663
3664 ########################################
3665 ## <summary>
3666 ##      Read the process state of all user domains.
3667 ## </summary>
3668 ## <param name="domain">
3669 ##      <summary>
3670 ##      Domain allowed access.
3671 ##      </summary>
3672 ## </param>
3673 #
3674 interface(`userdom_read_all_users_state',`
3675         gen_require(`
3676                 attribute userdomain;
3677         ')
3678
3679         read_files_pattern($1, userdomain, userdomain)
3680         read_lnk_files_pattern($1,userdomain,userdomain)
3681         kernel_search_proc($1)
3682 ')
3683
3684 ########################################
3685 ## <summary>
3686 ##      Get the attributes of all user domains.
3687 ## </summary>
3688 ## <param name="domain">
3689 ##      <summary>
3690 ##      Domain allowed access.
3691 ##      </summary>
3692 ## </param>
3693 #
3694 interface(`userdom_getattr_all_users',`
3695         gen_require(`
3696                 attribute userdomain;
3697         ')
3698
3699         allow $1 userdomain:process getattr;
3700 ')
3701
3702 ########################################
3703 ## <summary>
3704 ##      Inherit the file descriptors from all user domains
3705 ## </summary>
3706 ## <param name="domain">
3707 ##      <summary>
3708 ##      Domain allowed access.
3709 ##      </summary>
3710 ## </param>
3711 #
3712 interface(`userdom_use_all_users_fds',`
3713         gen_require(`
3714                 attribute userdomain;
3715         ')
3716
3717         allow $1 userdomain:fd use;
3718 ')
3719
3720 ########################################
3721 ## <summary>
3722 ##      Do not audit attempts to inherit the file
3723 ##      descriptors from any user domains.
3724 ## </summary>
3725 ## <param name="domain">
3726 ##      <summary>
3727 ##      Domain to not audit.
3728 ##      </summary>
3729 ## </param>
3730 #
3731 interface(`userdom_dontaudit_use_all_users_fds',`
3732         gen_require(`
3733                 attribute userdomain;
3734         ')
3735
3736         dontaudit $1 userdomain:fd use;
3737 ')
3738
3739 ########################################
3740 ## <summary>
3741 ##      Send general signals to all user domains.
3742 ## </summary>
3743 ## <param name="domain">
3744 ##      <summary>
3745 ##      Domain allowed access.
3746 ##      </summary>
3747 ## </param>
3748 #
3749 interface(`userdom_signal_all_users',`
3750         gen_require(`
3751                 attribute userdomain;
3752         ')
3753
3754         allow $1 userdomain:process signal;
3755 ')
3756
3757 ########################################
3758 ## <summary>
3759 ##      Send kill signals to all user domains.
3760 ## </summary>
3761 ## <param name="domain">
3762 ##      <summary>
3763 ##      Domain allowed access.
3764 ##      </summary>
3765 ## </param>
3766 #
3767 interface(`userdom_kill_all_users',`
3768         gen_require(`
3769                 attribute userdomain;
3770         ')
3771
3772         allow $1 userdomain:process sigkill;
3773 ')
3774
3775 ########################################
3776 ## <summary>
3777 ##      Send a SIGCHLD signal to all user domains.
3778 ## </summary>
3779 ## <param name="domain">
3780 ##      <summary>
3781 ##      Domain allowed access.
3782 ##      </summary>
3783 ## </param>
3784 #
3785 interface(`userdom_sigchld_all_users',`
3786         gen_require(`
3787                 attribute userdomain;
3788         ')
3789
3790         allow $1 userdomain:process sigchld;
3791 ')
3792
3793 ########################################
3794 ## <summary>
3795 ##      Create keys for all user domains.
3796 ## </summary>
3797 ## <param name="domain">
3798 ##      <summary>
3799 ##      Domain allowed access.
3800 ##      </summary>
3801 ## </param>
3802 #
3803 interface(`userdom_create_all_users_keys',`
3804         gen_require(`
3805                 attribute userdomain;
3806         ')
3807
3808         allow $1 userdomain:key create;
3809 ')
3810
3811 ########################################
3812 ## <summary>
3813 ##      Send a dbus message to all user domains.
3814 ## </summary>
3815 ## <param name="domain">
3816 ##      <summary>
3817 ##      Domain allowed access.
3818 ##      </summary>
3819 ## </param>
3820 #
3821 interface(`userdom_dbus_send_all_users',`
3822         gen_require(`
3823                 attribute userdomain;
3824                 class dbus send_msg;
3825         ')
3826
3827         allow $1 userdomain:dbus send_msg;
3828 ')
3829
3830 ########################################
3831 ## <summary>
3832 ##      Allow apps to set rlimits on userdomain
3833 ## </summary>
3834 ## <param name="domain">
3835 ##      <summary>
3836 ##      Domain allowed access.
3837 ##      </summary>
3838 ## </param>
3839 #
3840 interface(`userdom_set_rlimitnh',`
3841         gen_require(`
3842                 attribute userdomain;
3843         ')
3844
3845         allow $1 userdomain:process rlimitinh;
3846 ')
3847
3848 ########################################
3849 ## <summary>
3850 ##      Define this type as a Allow apps to set rlimits on userdomain
3851 ## </summary>
3852 ## <param name="domain">
3853 ##      <summary>
3854 ##      Domain allowed access.
3855 ##      </summary>
3856 ## </param>
3857 ## <param name="userdomain_prefix">
3858 ##      <summary>
3859 ##      The prefix of the user domain (e.g., user
3860 ##      is the prefix for user_t).
3861 ## </summary>
3862 ## </param>
3863 ## <param name="domain">
3864 ##      <summary>
3865 ##      Domain allowed access.
3866 ##      </summary>
3867 ## </param>
3868 #
3869 template(`userdom_unpriv_usertype',`
3870         gen_require(`
3871                 attribute unpriv_userdomain, userdomain;
3872                 attribute $1_usertype;
3873         ')
3874         typeattribute $2  $1_usertype;
3875         typeattribute $2  unpriv_userdomain;
3876         typeattribute $2  userdomain;
3877
3878         auth_use_nsswitch($2)
3879         ubac_constrained($2)
3880 ')
3881
3882 ########################################
3883 ## <summary>
3884 ##      Connect to users over an unix stream socket.
3885 ## </summary>
3886 ## <param name="domain">
3887 ##      <summary>
3888 ##      Domain allowed access.
3889 ##      </summary>
3890 ## </param>
3891 #
3892 interface(`userdom_stream_connect',`
3893         gen_require(`
3894                 type user_tmp_t;
3895                 attribute userdomain;
3896         ')
3897
3898         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3899 ')
3900
3901 ########################################
3902 ## <summary>
3903 ##      Ptrace user domains.
3904 ## </summary>
3905 ## <param name="domain">
3906 ##      <summary>
3907 ##      Domain allowed access.
3908 ##      </summary>
3909 ## </param>
3910 #
3911 interface(`userdom_ptrace_all_users',`
3912         gen_require(`
3913                 attribute userdomain;
3914         ')
3915
3916         allow $1 userdomain:process ptrace;
3917 ')
3918
3919 ########################################
3920 ## <summary>
3921 ##      dontaudit Search /root
3922 ## </summary>
3923 ## <param name="domain">
3924 ##      <summary>
3925 ##      Domain to not audit.
3926 ##      </summary>
3927 ## </param>
3928 #
3929 interface(`userdom_dontaudit_search_admin_dir',`
3930         gen_require(`
3931                 type admin_home_t;
3932         ')
3933
3934         dontaudit $1 admin_home_t:dir search_dir_perms;
3935 ')
3936
3937 ########################################
3938 ## <summary>
3939 ##      dontaudit list /root
3940 ## </summary>
3941 ## <param name="domain">
3942 ##      <summary>
3943 ##      Domain to not audit.
3944 ##      </summary>
3945 ## </param>
3946 #
3947 interface(`userdom_dontaudit_list_admin_dir',`
3948         gen_require(`
3949                 type admin_home_t;
3950         ')
3951
3952         dontaudit $1 admin_home_t:dir list_dir_perms;
3953 ')
3954
3955 ########################################
3956 ## <summary>
3957 ##      Allow domain to  list /root
3958 ## </summary>
3959 ## <param name="domain">
3960 ##      <summary>
3961 ##      Domain allowed access.
3962 ##      </summary>
3963 ## </param>
3964 #
3965 interface(`userdom_list_admin_dir',`
3966         gen_require(`
3967                 type admin_home_t;
3968         ')
3969
3970         allow $1 admin_home_t:dir list_dir_perms;
3971 ')
3972
3973 ########################################
3974 ## <summary>
3975 ##      Allow Search /root
3976 ## </summary>
3977 ## <param name="domain">
3978 ##      <summary>
3979 ##      Domain allowed access.
3980 ##      </summary>
3981 ## </param>
3982 #
3983 interface(`userdom_search_admin_dir',`
3984         gen_require(`
3985                 type admin_home_t;
3986         ')
3987
3988         allow $1 admin_home_t:dir search_dir_perms;
3989 ')
3990
3991 ########################################
3992 ## <summary>
3993 ##      RW unpriviledged user SysV sempaphores.
3994 ## </summary>
3995 ## <param name="domain">
3996 ##      <summary>
3997 ##      Domain allowed access.
3998 ##      </summary>
3999 ## </param>
4000 #
4001 interface(`userdom_rw_semaphores',`
4002         gen_require(`
4003                 attribute unpriv_userdomain;
4004         ')
4005
4006         allow $1 unpriv_userdomain:sem rw_sem_perms;
4007 ')
4008
4009 ########################################
4010 ## <summary>
4011 ##      Send a message to unpriv users over a unix domain
4012 ##      datagram socket.
4013 ## </summary>
4014 ## <param name="domain">
4015 ##      <summary>
4016 ##      Domain allowed access.
4017 ##      </summary>
4018 ## </param>
4019 #
4020 interface(`userdom_dgram_send',`
4021         gen_require(`
4022                 attribute unpriv_userdomain;
4023         ')
4024
4025         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4026 ')
4027
4028 ######################################
4029 ## <summary>
4030 ##      Send a message to users over a unix domain
4031 ##      datagram socket.
4032 ## </summary>
4033 ## <param name="domain">
4034 ##      <summary>
4035 ##      Domain allowed access.
4036 ##      </summary>
4037 ## </param>
4038 #
4039 interface(`userdom_users_dgram_send',`
4040         gen_require(`
4041                  attribute userdomain;
4042       ')
4043
4044        allow $1 userdomain:unix_dgram_socket sendto;
4045 ')
4046
4047 #######################################
4048 ## <summary>
4049 ##      Allow execmod on files in homedirectory
4050 ## </summary>
4051 ## <param name="domain">
4052 ##      <summary>
4053 ##      Domain allowed access.
4054 ##      </summary>
4055 ## </param>
4056 ## <rolebase/>
4057 #
4058 interface(`userdom_execmod_user_home_files',`
4059         gen_require(`
4060                 type user_home_type;
4061         ')
4062
4063         allow $1 user_home_type:file execmod;
4064 ')
4065
4066 ########################################
4067 ## <summary>
4068 ##      Read admin home files.
4069 ## </summary>
4070 ## <param name="domain">
4071 ##      <summary>
4072 ##      Domain allowed access.
4073 ##      </summary>
4074 ## </param>
4075 ## <rolecap/>
4076 #
4077 interface(`userdom_read_admin_home_files',`
4078         gen_require(`
4079                 type admin_home_t;
4080         ')
4081
4082         read_files_pattern($1, admin_home_t, admin_home_t)
4083 ')
4084
4085 ########################################
4086 ## <summary>
4087 ##      Execute admin home files.
4088 ## </summary>
4089 ## <param name="domain">
4090 ##      <summary>
4091 ##      Domain allowed access.
4092 ##      </summary>
4093 ## </param>
4094 ## <rolecap/>
4095 #
4096 interface(`userdom_exec_admin_home_files',`
4097         gen_require(`
4098                 type admin_home_t;
4099         ')
4100
4101         exec_files_pattern($1, admin_home_t, admin_home_t)
4102 ')
4103
4104 ########################################
4105 ## <summary>
4106 ##      Append files inherited
4107 ##      in the /root directory.
4108 ## </summary>
4109 ## <param name="domain">
4110 ##      <summary>
4111 ##      Domain allowed access.
4112 ##      </summary>
4113 ## </param>
4114 #
4115 interface(`userdom_inherit_append_admin_home_files',`
4116         gen_require(`
4117                 type admin_home_t;
4118         ')
4119
4120         allow $1 admin_home_t:file { getattr append };
4121 ')
4122
4123
4124 #######################################
4125 ## <summary>
4126 ##      Manage all files/directories in the homedir
4127 ## </summary>
4128 ## <param name="userdomain">
4129 ##      <summary>
4130 ##      The user domain
4131 ##      </summary>
4132 ## </param>
4133 ## <rolebase/>
4134 #
4135 interface(`userdom_manage_user_home_content',`
4136         gen_require(`
4137                 type user_home_dir_t, user_home_t;
4138                 attribute user_home_type;
4139         ')
4140
4141         files_list_home($1)
4142         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4143         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4144         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4145         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4146         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4147         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4148
4149 ')
4150
4151
4152 ########################################
4153 ## <summary>
4154 ##      Create objects in a user home directory
4155 ##      with an automatic type transition to
4156 ##      the user home file type.
4157 ## </summary>
4158 ## <param name="domain">
4159 ##      <summary>
4160 ##      Domain allowed access.
4161 ##      </summary>
4162 ## </param>
4163 ## <param name="object_class">
4164 ##      <summary>
4165 ##      The class of the object to be created.
4166 ##      </summary>
4167 ## </param>
4168 #
4169 interface(`userdom_user_home_dir_filetrans_pattern',`
4170         gen_require(`
4171                 type user_home_dir_t, user_home_t;
4172         ')
4173
4174         type_transition $1 user_home_dir_t:$2 user_home_t;
4175 ')
4176
4177 ########################################
4178 ## <summary>
4179 ##      Create objects in the /root directory
4180 ##      with an automatic type transition to
4181 ##      a specified private type.
4182 ## </summary>
4183 ## <param name="domain">
4184 ##      <summary>
4185 ##      Domain allowed access.
4186 ##      </summary>
4187 ## </param>
4188 ## <param name="private_type">
4189 ##      <summary>
4190 ##      The type of the object to create.
4191 ##      </summary>
4192 ## </param>
4193 ## <param name="object_class">
4194 ##      <summary>
4195 ##      The class of the object to be created.
4196 ##      </summary>
4197 ## </param>
4198 #
4199 interface(`userdom_admin_home_dir_filetrans',`
4200         gen_require(`
4201                 type admin_home_t;
4202         ')
4203
4204         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4205 ')
4206
4207 ########################################
4208 ## <summary>
4209 ##      Send signull to unprivileged user domains.
4210 ## </summary>
4211 ## <param name="domain">
4212 ##      <summary>
4213 ##      Domain allowed access.
4214 ##      </summary>
4215 ## </param>
4216 #
4217 interface(`userdom_signull_unpriv_users',`
4218         gen_require(`
4219                 attribute unpriv_userdomain;
4220         ')
4221
4222         allow $1 unpriv_userdomain:process signull;
4223 ')
4224
4225 ########################################
4226 ## <summary>
4227 ##      Write all users files in /tmp
4228 ## </summary>
4229 ## <param name="domain">
4230 ##      <summary>
4231 ##      Domain allowed access.
4232 ##      </summary>
4233 ## </param>
4234 #
4235 interface(`userdom_write_user_tmp_dirs',`
4236         gen_require(`
4237                 type user_tmp_t;
4238         ')
4239
4240         write_files_pattern($1, user_tmp_t, user_tmp_t)
4241 ')
4242
4243 ########################################
4244 ## <summary>
4245 ##      Manage keys for all user domains.
4246 ## </summary>
4247 ## <param name="domain">
4248 ##      <summary>
4249 ##      Domain allowed access.
4250 ##      </summary>
4251 ## </param>
4252 #
4253 interface(`userdom_manage_all_users_keys',`
4254         gen_require(`
4255                 attribute userdomain;
4256         ')
4257
4258         allow $1 userdomain:key manage_key_perms;
4259 ')
4260
4261
4262 ########################################
4263 ## <summary>
4264 ##      Do not audit attempts to read and write
4265 ##      unserdomain stream.
4266 ## </summary>
4267 ## <param name="domain">
4268 ##      <summary>
4269 ##      Domain to not audit.
4270 ##      </summary>
4271 ## </param>
4272 #
4273 interface(`userdom_dontaudit_rw_stream',`
4274         gen_require(`
4275                 attribute userdomain;
4276         ')
4277
4278         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4279 ')
4280
4281 ########################################
4282 ## <summary>
4283 ##      Do not audit attempts to read and write
4284 ##      unserdomain datagram socket.
4285 ## </summary>
4286 ## <param name="domain">
4287 ##      <summary>
4288 ##      Domain to not audit.
4289 ##      </summary>
4290 ## </param>
4291 #
4292 interface(`userdom_dontaudit_rw_dgram_socket',`
4293         gen_require(`
4294                 attribute userdomain;
4295         ')
4296
4297         dontaudit $1 userdomain:unix_dgram_socket { read write };
4298 ')
4299
4300 ########################################
4301 ## <summary>
4302 ##      Append files
4303 ##      in a user home subdirectory.
4304 ## </summary>
4305 ## <param name="domain">
4306 ##      <summary>
4307 ##      Domain allowed access.
4308 ##      </summary>
4309 ## </param>
4310 #
4311 interface(`userdom_append_user_home_content_files',`
4312         gen_require(`
4313                 type user_home_dir_t, user_home_t;
4314         ')
4315
4316         append_files_pattern($1, user_home_t, user_home_t)
4317         allow $1 user_home_dir_t:dir search_dir_perms;
4318         files_search_home($1)
4319 ')
4320
4321 ########################################
4322 ## <summary>
4323 ##      Read files inherited
4324 ##      in a user home subdirectory.
4325 ## </summary>
4326 ## <param name="domain">
4327 ##      <summary>
4328 ##      Domain allowed access.
4329 ##      </summary>
4330 ## </param>
4331 #
4332 interface(`userdom_read_inherited_user_home_content_files',`
4333         gen_require(`
4334                 attribute user_home_type;
4335         ')
4336
4337         allow $1 user_home_type:file { getattr read };
4338 ')
4339
4340 ########################################
4341 ## <summary>
4342 ##      Append files inherited
4343 ##      in a user home subdirectory.
4344 ## </summary>
4345 ## <param name="domain">
4346 ##      <summary>
4347 ##      Domain allowed access.
4348 ##      </summary>
4349 ## </param>
4350 #
4351 interface(`userdom_inherit_append_user_home_content_files',`
4352         gen_require(`
4353                 type user_home_t;
4354         ')
4355
4356         allow $1 user_home_t:file { getattr append };
4357 ')
4358
4359 ########################################
4360 ## <summary>
4361 ##      Append files inherited
4362 ##      in a user tmp files.
4363 ## </summary>
4364 ## <param name="domain">
4365 ##      <summary>
4366 ##      Domain allowed access.
4367 ##      </summary>
4368 ## </param>
4369 #
4370 interface(`userdom_inherit_append_user_tmp_files',`
4371         gen_require(`
4372                 type user_tmp_t;
4373         ')
4374
4375         allow $1 user_tmp_t:file { getattr append };
4376 ')
4377
4378 ######################################
4379 ## <summary>
4380 ##      Read audio files in the users homedir.
4381 ## </summary>
4382 ## <param name="domain">
4383 ##      <summary>
4384 ##      Domain allowed access.
4385 ##      </summary>
4386 ## </param>
4387 ## <rolecap/>
4388 #
4389 interface(`userdom_read_home_audio_files',`
4390         gen_require(`
4391                 type audio_home_t;
4392         ')
4393
4394         userdom_search_user_home_dirs($1)
4395         allow $1 audio_home_t:dir list_dir_perms;
4396         read_files_pattern($1, audio_home_t, audio_home_t)
4397         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4398 ')
4399
4400 ########################################
4401 ## <summary>
4402 ##      Do not audit attempts to write all user home content files.
4403 ## </summary>
4404 ## <param name="domain">
4405 ##      <summary>
4406 ##      Domain to not audit.
4407 ##      </summary>
4408 ## </param>
4409 #
4410 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4411         gen_require(`
4412                 attribute user_home_type;
4413         ')
4414
4415         dontaudit $1 user_home_type:file write_file_perms;
4416 ')
4417
4418 ########################################
4419 ## <summary>
4420 ##      Do not audit attempts to write all user tmp content files.
4421 ## </summary>
4422 ## <param name="domain">
4423 ##      <summary>
4424 ##      Domain to not audit.
4425 ##      </summary>
4426 ## </param>
4427 #
4428 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4429         gen_require(`
4430                 attribute user_tmp_type;
4431         ')
4432
4433         dontaudit $1 user_tmp_type:file write_file_perms;
4434 ')
4435
4436 ########################################
4437 ## <summary>
4438 ##      Manage all user temporary content.
4439 ## </summary>
4440 ## <param name="domain">
4441 ##      <summary>
4442 ##      Domain allowed access.
4443 ##      </summary>
4444 ## </param>
4445 #
4446 interface(`userdom_manage_all_user_tmp_content',`
4447         gen_require(`
4448                 attribute user_tmp_type;
4449         ')
4450
4451         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4452         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4453         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4454         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4455         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4456         files_search_tmp($1)
4457 ')
4458
4459 ########################################
4460 ## <summary>
4461 ##      List all user temporary content.
4462 ## </summary>
4463 ## <param name="domain">
4464 ##      <summary>
4465 ##      Domain allowed access.
4466 ##      </summary>
4467 ## </param>
4468 #
4469 interface(`userdom_list_all_user_tmp_content',`
4470         gen_require(`
4471                 attribute user_tmp_type;
4472         ')
4473
4474         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4475         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4476         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4477         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4478         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4479         files_search_var($1)
4480         files_search_tmp($1)
4481 ')
4482
4483 ########################################
4484 ## <summary>
4485 ##      Manage all user tmpfs content.
4486 ## </summary>
4487 ## <param name="domain">
4488 ##      <summary>
4489 ##      Domain allowed access.
4490 ##      </summary>
4491 ## </param>
4492 #
4493 interface(`userdom_manage_all_user_tmpfs_content',`
4494         gen_require(`
4495                 attribute user_tmpfs_type;
4496         ')
4497
4498         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4499         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4500         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4501         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4502         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4503         fs_search_tmpfs($1)
4504 ')
4505
4506 ########################################
4507 ## <summary>
4508 ##      Delete all user temporary content.
4509 ## </summary>
4510 ## <param name="domain">
4511 ##      <summary>
4512 ##      Domain allowed access.
4513 ##      </summary>
4514 ## </param>
4515 #
4516 interface(`userdom_delete_all_user_tmp_content',`
4517         gen_require(`
4518                 attribute user_tmp_type;
4519         ')
4520
4521         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4522         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4523         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4524         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4525         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4526         # /var/tmp
4527         files_search_var($1)
4528         files_delete_tmp_dir_entry($1)
4529 ')
4530
4531 ########################################
4532 ## <summary>
4533 ##      Read system SSL certificates in the users homedir.
4534 ## </summary>
4535 ## <param name="domain">
4536 ##      <summary>
4537 ##      Domain allowed access.
4538 ##      </summary>
4539 ## </param>
4540 #
4541 interface(`userdom_read_home_certs',`
4542         gen_require(`
4543                 type home_cert_t;
4544         ')
4545
4546         userdom_search_user_home_content($1)
4547         allow $1 home_cert_t:dir list_dir_perms;
4548         read_files_pattern($1, home_cert_t, home_cert_t)
4549         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4550 ')
4551
4552 #######################################
4553 ## <summary>
4554 ##  Dontaudit Write system SSL certificates in the users homedir.
4555 ## </summary>
4556 ## <param name="domain">
4557 ##  <summary>
4558 ##      Domain to not audit.
4559 ##  </summary>
4560 ## </param>
4561 #
4562 interface(`userdom_dontaudit_write_home_certs',`
4563     gen_require(`
4564         type home_cert_t;
4565     ')
4566
4567     dontaudit $1 home_cert_t:file write;
4568 ')
4569
4570 ########################################
4571 ## <summary>
4572 ##      dontaudit Search getatrr /root files
4573 ## </summary>
4574 ## <param name="domain">
4575 ##      <summary>
4576 ##      Domain to not audit.
4577 ##      </summary>
4578 ## </param>
4579 #
4580 interface(`userdom_dontaudit_getattr_admin_home_files',`
4581         gen_require(`
4582                 type admin_home_t;
4583         ')
4584
4585         dontaudit $1 admin_home_t:file getattr;
4586 ')
4587
4588 ########################################
4589 ## <summary>
4590 ##      dontaudit read /root lnk files
4591 ## </summary>
4592 ## <param name="domain">
4593 ##      <summary>
4594 ##      Domain to not audit.
4595 ##      </summary>
4596 ## </param>
4597 #
4598 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4599         gen_require(`
4600                 type admin_home_t;
4601         ')
4602
4603         dontaudit $1 admin_home_t:lnk_file read;
4604 ')
4605
4606 ########################################
4607 ## <summary>
4608 ##      dontaudit read /root files
4609 ## </summary>
4610 ## <param name="domain">
4611 ##      <summary>
4612 ##      Domain to not audit.
4613 ##      </summary>
4614 ## </param>
4615 #
4616 interface(`userdom_dontaudit_read_admin_home_files',`
4617         gen_require(`
4618                 type admin_home_t;
4619         ')
4620
4621         dontaudit $1 admin_home_t:file read_file_perms;
4622 ')
4623
4624 ########################################
4625 ## <summary>
4626 ##      Create, read, write, and delete user
4627 ##      temporary chr files.
4628 ## </summary>
4629 ## <param name="domain">
4630 ##      <summary>
4631 ##      Domain allowed access.
4632 ##      </summary>
4633 ## </param>
4634 #
4635 interface(`userdom_manage_user_tmp_chr_files',`
4636         gen_require(`
4637                 type user_tmp_t;
4638         ')
4639
4640         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4641         files_search_tmp($1)
4642 ')
4643
4644 ########################################
4645 ## <summary>
4646 ##      Create, read, write, and delete user
4647 ##      temporary blk files.
4648 ## </summary>
4649 ## <param name="domain">
4650 ##      <summary>
4651 ##      Domain allowed access.
4652 ##      </summary>
4653 ## </param>
4654 #
4655 interface(`userdom_manage_user_tmp_blk_files',`
4656         gen_require(`
4657                 type user_tmp_t;
4658         ')
4659
4660         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4661         files_search_tmp($1)
4662 ')
4663
4664 ########################################
4665 ## <summary>
4666 ##      Dontaudit attempt to set attributes on  user temporary directories.
4667 ## </summary>
4668 ## <param name="domain">
4669 ##      <summary>
4670 ##      Domain to not audit.
4671 ##      </summary>
4672 ## </param>
4673 #
4674 interface(`userdom_dontaudit_setattr_user_tmp',`
4675         gen_require(`
4676                 type user_tmp_t;
4677         ')
4678
4679         dontaudit $1 user_tmp_t:dir setattr;
4680 ')
4681
4682 ########################################
4683 ## <summary>
4684 ##      Write all inherited users files in /tmp
4685 ## </summary>
4686 ## <param name="domain">
4687 ##      <summary>
4688 ##      Domain allowed access.
4689 ##      </summary>
4690 ## </param>
4691 #
4692 interface(`userdom_write_inherited_user_tmp_files',`
4693         gen_require(`
4694                 type user_tmp_t;
4695         ')
4696
4697         allow $1 user_tmp_t:file write;
4698 ')
4699
4700 ########################################
4701 ## <summary>
4702 ##      Delete all users files in /tmp
4703 ## </summary>
4704 ## <param name="domain">
4705 ##      <summary>
4706 ##      Domain allowed access.
4707 ##      </summary>
4708 ## </param>
4709 #
4710 interface(`userdom_delete_user_tmp_files',`
4711         gen_require(`
4712                 type user_tmp_t;
4713         ')
4714
4715         allow $1 user_tmp_t:file delete_file_perms;
4716 ')
4717
4718 ########################################
4719 ## <summary>
4720 ##      Delete user tmpfs files.
4721 ## </summary>
4722 ## <param name="domain">
4723 ##      <summary>
4724 ##      Domain allowed access.
4725 ##      </summary>
4726 ## </param>
4727 #
4728 interface(`userdom_delete_user_tmpfs_files',`
4729         gen_require(`
4730                 type user_tmpfs_t;
4731         ')
4732
4733         allow $1 user_tmpfs_t:file delete_file_perms;
4734 ')
4735
4736 ########################################
4737 ## <summary>
4738 ##      Read/Write unpriviledged user SysV shared
4739 ##      memory segments.
4740 ## </summary>
4741 ## <param name="domain">
4742 ##      <summary>
4743 ##      Domain allowed access.
4744 ##      </summary>
4745 ## </param>
4746 #
4747 interface(`userdom_rw_unpriv_user_shared_mem',`
4748         gen_require(`
4749                 attribute unpriv_userdomain;
4750         ')
4751
4752         allow $1 unpriv_userdomain:shm rw_shm_perms;
4753 ')
4754
4755 ########################################
4756 ## <summary>
4757 ##      Do not audit attempts to search user
4758 ##      temporary directories.
4759 ## </summary>
4760 ## <param name="domain">
4761 ##      <summary>
4762 ##      Domain to not audit.
4763 ##      </summary>
4764 ## </param>
4765 #
4766 interface(`userdom_dontaudit_search_user_tmp',`
4767         gen_require(`
4768                 type user_tmp_t;
4769         ')
4770
4771         dontaudit $1 user_tmp_t:dir search_dir_perms;
4772 ')
4773
4774 ########################################
4775 ## <summary>
4776 ##      Execute a file in a user home directory
4777 ##      in the specified domain.
4778 ## </summary>
4779 ## <desc>
4780 ##      <p>
4781 ##      Execute a file in a user home directory
4782 ##      in the specified domain.
4783 ##      </p>
4784 ##      <p>
4785 ##      No interprocess communication (signals, pipes,
4786 ##      etc.) is provided by this interface since
4787 ##      the domains are not owned by this module.
4788 ##      </p>
4789 ## </desc>
4790 ## <param name="domain">
4791 ##      <summary>
4792 ##      Domain allowed access.
4793 ##      </summary>
4794 ## </param>
4795 ## <param name="target_domain">
4796 ##      <summary>
4797 ##      The type of the new process.
4798 ##      </summary>
4799 ## </param>
4800 #
4801 interface(`userdom_domtrans_user_home',`
4802         gen_require(`
4803                 type user_home_t;
4804         ')
4805
4806         read_lnk_files_pattern($1, user_home_t, user_home_t)
4807         domain_transition_pattern($1, user_home_t, $2)
4808         type_transition $1 user_home_t:process $2;
4809 ')
4810
4811 ########################################
4812 ## <summary>
4813 ##      Execute a file in a user tmp directory
4814 ##      in the specified domain.
4815 ## </summary>
4816 ## <desc>
4817 ##      <p>
4818 ##      Execute a file in a user tmp directory
4819 ##      in the specified domain.
4820 ##      </p>
4821 ##      <p>
4822 ##      No interprocess communication (signals, pipes,
4823 ##      etc.) is provided by this interface since
4824 ##      the domains are not owned by this module.
4825 ##      </p>
4826 ## </desc>
4827 ## <param name="domain">
4828 ##      <summary>
4829 ##      Domain allowed access.
4830 ##      </summary>
4831 ## </param>
4832 ## <param name="target_domain">
4833 ##      <summary>
4834 ##      The type of the new process.
4835 ##      </summary>
4836 ## </param>
4837 #
4838 interface(`userdom_domtrans_user_tmp',`
4839         gen_require(`
4840                 type user_tmp_t;
4841         ')
4842
4843         files_search_tmp($1)
4844         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4845         domain_transition_pattern($1, user_tmp_t, $2)
4846         type_transition $1 user_tmp_t:process $2;
4847 ')
4848
4849 ########################################
4850 ## <summary>
4851 ##      Do not audit attempts to read all user home content files.
4852 ## </summary>
4853 ## <param name="domain">
4854 ##      <summary>
4855 ##      Domain to not audit.
4856 ##      </summary>
4857 ## </param>
4858 #
4859 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4860         gen_require(`
4861                 attribute user_home_type;
4862         ')
4863
4864         dontaudit $1 user_home_type:file read_file_perms;
4865 ')
4866
4867 ########################################
4868 ## <summary>
4869 ##      Do not audit attempts to read all user tmp content files.
4870 ## </summary>
4871 ## <param name="domain">
4872 ##      <summary>
4873 ##      Domain to not audit.
4874 ##      </summary>
4875 ## </param>
4876 #
4877 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4878         gen_require(`
4879                 attribute user_tmp_type;
4880         ')
4881
4882         dontaudit $1 user_tmp_type:file read_file_perms;
4883 ')
4884
4885 #######################################
4886 ## <summary>
4887 ## Read and write unpriviledged user SysV sempaphores.
4888 ## </summary>
4889 ## <param name="domain">
4890 ## <summary>
4891 ## Domain allowed access.
4892 ## </summary>
4893 ## </param>
4894 #
4895 interface(`userdom_rw_unpriv_user_semaphores',`
4896    gen_require(`
4897        attribute unpriv_userdomain;
4898    ')
4899
4900    allow $1 unpriv_userdomain:sem rw_sem_perms;
4901 ')