policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 type user_tmp_t;
 321         ')
 322
 323         role $1 types user_tmp_t;
 324
 325         files_poly_member_tmp($2, user_tmp_t)
 326
 327         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 330         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 331         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 332         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 333         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 334 ')
 335
 336 #######################################
 337 ## <summary>
 338 ##      Dontaudit search of user bin dirs.
 339 ## </summary>
 340 ## <param name="domain">
 341 ##      <summary>
 342 ##      Domain to not audit.
 343 ##      </summary>
 344 ## </param>
 345 #
 346 interface(`userdom_dontaudit_search_user_bin_dirs',`
 347         gen_require(`
 348                 type home_bin_t;
 349         ')
 350
 351         dontaudit $1 home_bin_t:dir search_dir_perms;
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Execute user bin files.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain allowed access.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_exec_user_bin_files',`
 365         gen_require(`
 366                 attribute user_home_type;
 367                 type home_bin_t, user_home_dir_t;
 368         ')
 369
 370         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 371         files_search_home($1)
 372 ')
 373
 374 #######################################
 375 ## <summary>
 376 ##      The execute access user temporary files.
 377 ## </summary>
 378 ## <param name="domain">
 379 ##      <summary>
 380 ##      Domain allowed access.
 381 ##      </summary>
 382 ## </param>
 383 ## <rolebase/>
 384 #
 385 interface(`userdom_exec_user_tmp_files',`
 386         gen_require(`
 387                 type user_tmp_t;
 388         ')
 389
 390         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 391         dontaudit $1 user_tmp_t:sock_file execute;
 392         files_search_tmp($1)
 393 ')
 394
 395 #######################################
 396 ## <summary>
 397 ##      Role access for the user tmpfs type
 398 ##      that the user has full access.
 399 ## </summary>
 400 ## <desc>
 401 ##      <p>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ##      </p>
 405 ##      <p>
 406 ##      This does not allow execute access.
 407 ##      </p>
 408 ## </desc>
 409 ## <param name="role">
 410 ##      <summary>
 411 ##      Role allowed access.
 412 ##      </summary>
 413 ## </param>
 414 ## <param name="domain">
 415 ##      <summary>
 416 ##      Domain allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <rolecap/>
 420 #
 421 interface(`userdom_manage_tmpfs_role',`
 422         gen_require(`
 423                 type user_tmpfs_t;
 424         ')
 425
 426         role $1 types user_tmpfs_t;
 427
 428         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 432         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 433         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 434 ')
 435
 436 #######################################
 437 ## <summary>
 438 ##      The interface allowing the user basic
 439 ##      network permissions
 440 ## </summary>
 441 ## <param name="userdomain">
 442 ##      <summary>
 443 ##      The user domain
 444 ##      </summary>
 445 ## </param>
 446 ## <rolebase/>
 447 #
 448 interface(`userdom_basic_networking',`
 449
 450         allow $1 self:tcp_socket create_stream_socket_perms;
 451         allow $1 self:udp_socket create_socket_perms;
 452
 453         corenet_all_recvfrom_unlabeled($1)
 454         corenet_all_recvfrom_netlabel($1)
 455         corenet_tcp_sendrecv_generic_if($1)
 456         corenet_udp_sendrecv_generic_if($1)
 457         corenet_tcp_sendrecv_generic_node($1)
 458         corenet_udp_sendrecv_generic_node($1)
 459         corenet_tcp_sendrecv_all_ports($1)
 460         corenet_udp_sendrecv_all_ports($1)
 461         corenet_tcp_connect_all_ports($1)
 462         corenet_sendrecv_all_client_packets($1)
 463
 464         optional_policy(`
 465                 init_tcp_recvfrom_all_daemons($1)
 466                 init_udp_recvfrom_all_daemons($1)
 467         ')
 468
 469         optional_policy(`
 470                 ipsec_match_default_spd($1)
 471         ')
 472
 473 ')
 474
 475 #######################################
 476 ## <summary>
 477 ##      The template for creating a user xwindows client.  (Deprecated)
 478 ## </summary>
 479 ## <param name="userdomain_prefix">
 480 ##      <summary>
 481 ##      The prefix of the user domain (e.g., user
 482 ##      is the prefix for user_t).
 483 ##      </summary>
 484 ## </param>
 485 ## <rolebase/>
 486 #
 487 template(`userdom_xwindows_client_template',`
 488         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 489         gen_require(`
 490                 type $1_t, user_tmpfs_t;
 491         ')
 492
 493         dev_rw_xserver_misc($1_t)
 494         dev_rw_power_management($1_t)
 495         dev_read_input($1_t)
 496         dev_read_misc($1_t)
 497         dev_write_misc($1_t)
 498         # open office is looking for the following
 499         dev_getattr_agp_dev($1_t)
 500         dev_dontaudit_rw_dri($1_t)
 501         # GNOME checks for usb and other devices:
 502         dev_rw_usbfs($1_t)
 503         dev_rw_generic_usb_dev($1_t)
 504
 505         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 506         xserver_xsession_entry_type($1_t)
 507         xserver_dontaudit_write_log($1_t)
 508         xserver_stream_connect_xdm($1_t)
 509         # certain apps want to read xdm.pid file
 510         xserver_read_xdm_pid($1_t)
 511         # gnome-session creates socket under /tmp/.ICE-unix/
 512         xserver_create_xdm_tmp_sockets($1_t)
 513         # Needed for escd, remove if we get escd policy
 514         xserver_manage_xdm_tmp_files($1_t)
 515 ')
 516
 517 #######################################
 518 ## <summary>
 519 ##      The template for allowing the user to change passwords.
 520 ## </summary>
 521 ## <param name="userdomain_prefix">
 522 ##      <summary>
 523 ##      The prefix of the user domain (e.g., user
 524 ##      is the prefix for user_t).
 525 ##      </summary>
 526 ## </param>
 527 ## <rolebase/>
 528 #
 529 template(`userdom_change_password_template',`
 530         gen_require(`
 531                 type $1_t;
 532                 role $1_r;
 533         ')
 534
 535         optional_policy(`
 536                 usermanage_run_chfn($1_t,$1_r)
 537                 usermanage_run_passwd($1_t,$1_r)
 538         ')
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template containing rules common to unprivileged
 544 ##      users and administrative users.
 545 ## </summary>
 546 ## <desc>
 547 ##      <p>
 548 ##      This template creates a user domain, types, and
 549 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 550 ##      </p>
 551 ## </desc>
 552 ## <param name="userdomain_prefix">
 553 ##      <summary>
 554 ##      The prefix of the user domain (e.g., user
 555 ##      is the prefix for user_t).
 556 ##      </summary>
 557 ## </param>
 558 #
 559 template(`userdom_common_user_template',`
 560         gen_require(`
 561                 attribute unpriv_userdomain;
 562         ')
 563
 564         userdom_basic_networking($1_usertype)
 565
 566         ##############################
 567         #
 568         # User domain Local policy
 569         #
 570
 571         # evolution and gnome-session try to create a netlink socket
 572         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 573         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 574         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 575         allow $1_t self:socket create_socket_perms;
 576
 577         allow $1_usertype unpriv_userdomain:fd use;
 578
 579         kernel_read_system_state($1_usertype)
 580         kernel_read_network_state($1_usertype)
 581         kernel_read_software_raid_state($1_usertype)
 582         kernel_read_net_sysctls($1_usertype)
 583         # Very permissive allowing every domain to see every type:
 584         kernel_get_sysvipc_info($1_usertype)
 585         # Find CDROM devices:
 586         kernel_read_device_sysctls($1_usertype)
 587         kernel_request_load_module($1_usertype)
 588
 589         corenet_udp_bind_generic_node($1_usertype)
 590         corenet_udp_bind_generic_port($1_usertype)
 591
 592         dev_read_rand($1_usertype)
 593         dev_write_sound($1_usertype)
 594         dev_read_sound($1_usertype)
 595         dev_read_sound_mixer($1_usertype)
 596         dev_write_sound_mixer($1_usertype)
 597
 598         files_exec_etc_files($1_usertype)
 599         files_search_locks($1_usertype)
 600         # Check to see if cdrom is mounted
 601         files_search_mnt($1_usertype)
 602         # cjp: perhaps should cut back on file reads:
 603         files_read_var_files($1_usertype)
 604         files_read_var_symlinks($1_usertype)
 605         files_read_generic_spool($1_usertype)
 606         files_read_var_lib_files($1_usertype)
 607         # Stat lost+found.
 608         files_getattr_lost_found_dirs($1_usertype)
 609         files_read_config_files($1_usertype)
 610         fs_read_noxattr_fs_files($1_usertype)
 611         fs_read_noxattr_fs_symlinks($1_usertype)
 612         fs_rw_cgroup_files($1_usertype)
 613
 614         application_getattr_socket($1_usertype)
 615
 616         logging_send_syslog_msg($1_usertype)
 617         logging_send_audit_msgs($1_usertype)
 618         selinux_get_enforce_mode($1_usertype)
 619
 620         # cjp: some of this probably can be removed
 621         selinux_get_fs_mount($1_usertype)
 622         selinux_validate_context($1_usertype)
 623         selinux_compute_access_vector($1_usertype)
 624         selinux_compute_create_context($1_usertype)
 625         selinux_compute_relabel_context($1_usertype)
 626         selinux_compute_user_contexts($1_usertype)
 627
 628         # for eject
 629         storage_getattr_fixed_disk_dev($1_usertype)
 630
 631         auth_read_login_records($1_usertype)
 632         auth_run_pam($1_t,$1_r)
 633         auth_run_utempter($1_t,$1_r)
 634
 635         init_read_utmp($1_usertype)
 636
 637         seutil_read_file_contexts($1_usertype)
 638         seutil_read_default_contexts($1_usertype)
 639         seutil_run_newrole($1_t,$1_r)
 640         seutil_exec_checkpolicy($1_t)
 641         seutil_exec_setfiles($1_usertype)
 642         # for when the network connection is killed
 643         # this is needed when a login role can change
 644         # to this one.
 645         seutil_dontaudit_signal_newrole($1_t)
 646
 647         tunable_policy(`user_direct_mouse',`
 648                 dev_read_mouse($1_usertype)
 649         ')
 650
 651         tunable_policy(`user_ttyfile_stat',`
 652                 term_getattr_all_ttys($1_t)
 653         ')
 654
 655         optional_policy(`
 656                 alsa_read_rw_config($1_usertype)
 657                 alsa_manage_home_files($1_t)
 658                 alsa_relabel_home_files($1_t)
 659         ')
 660
 661         optional_policy(`
 662                 # Allow graphical boot to check battery lifespan
 663                 apm_stream_connect($1_usertype)
 664         ')
 665
 666         optional_policy(`
 667                 canna_stream_connect($1_usertype)
 668         ')
 669
 670         optional_policy(`
 671                 chrome_role($1_r, $1_usertype)
 672         ')
 673
 674         optional_policy(`
 675                 colord_read_lib_files($1_usertype)
 676         ')
 677
 678         optional_policy(`
 679                 dbus_system_bus_client($1_usertype)
 680
 681                 allow $1_usertype $1_usertype:dbus  send_msg;
 682
 683                 optional_policy(`
 684                         avahi_dbus_chat($1_usertype)
 685                 ')
 686
 687                 optional_policy(`
 688                         policykit_dbus_chat($1_usertype)
 689                 ')
 690
 691                 optional_policy(`
 692                         bluetooth_dbus_chat($1_usertype)
 693                 ')
 694
 695                 optional_policy(`
 696                         consolekit_dbus_chat($1_usertype)
 697                         consolekit_read_log($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         devicekit_dbus_chat($1_usertype)
 702                         devicekit_dbus_chat_power($1_usertype)
 703                         devicekit_dbus_chat_disk($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         evolution_dbus_chat($1_usertype)
 708                         evolution_alarm_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         gnome_dbus_chat_gconfdefault($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         hal_dbus_chat($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         kde_dbus_chat_backlighthelper($1_usertype)
 721                 ')
 722
 723                 optional_policy(`
 724                         modemmanager_dbus_chat($1_usertype)
 725                 ')
 726
 727                 optional_policy(`
 728                         networkmanager_dbus_chat($1_usertype)
 729                         networkmanager_read_lib_files($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         vpn_dbus_chat($1_usertype)
 734                 ')
 735         ')
 736
 737         optional_policy(`
 738                 git_session_role($1_r, $1_usertype)
 739         ')
 740
 741         optional_policy(`
 742                 inetd_use_fds($1_usertype)
 743                 inetd_rw_tcp_sockets($1_usertype)
 744         ')
 745
 746         optional_policy(`
 747                 inn_read_config($1_usertype)
 748                 inn_read_news_lib($1_usertype)
 749                 inn_read_news_spool($1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 lircd_stream_connect($1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 locate_read_lib_files($1_usertype)
 758         ')
 759
 760         # for running depmod as part of the kernel packaging process
 761         optional_policy(`
 762                 modutils_read_module_config($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 mta_rw_spool($1_usertype)
 767                 mta_manage_queue($1_usertype)
 768                 mta_filetrans_home_content($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 nsplugin_role($1_r, $1_usertype)
 773         ')
 774
 775         optional_policy(`
 776                 tunable_policy(`allow_user_mysql_connect',`
 777                         mysql_stream_connect($1_t)
 778                 ')
 779         ')
 780
 781         optional_policy(`
 782                 oident_manage_user_content($1_t)
 783                 oident_relabel_user_content($1_t)
 784         ')
 785
 786         optional_policy(`
 787                 # to allow monitoring of pcmcia status
 788                 pcmcia_read_pid($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 pcscd_read_pub_files($1_usertype)
 793                 pcscd_stream_connect($1_usertype)
 794         ')
 795
 796         optional_policy(`
 797                 tunable_policy(`allow_user_postgresql_connect',`
 798                         postgresql_stream_connect($1_usertype)
 799                         postgresql_tcp_connect($1_usertype)
 800                 ')
 801         ')
 802
 803         optional_policy(`
 804                 resmgr_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 rpc_dontaudit_getattr_exports($1_usertype)
 809                 rpc_manage_nfs_rw_content($1_usertype)
 810         ')
 811
 812         optional_policy(`
 813                 rpcbind_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 samba_stream_connect_winbind($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 sandbox_transition($1_usertype, $1_r)
 822         ')
 823
 824         optional_policy(`
 825                 seunshare_role_template($1, $1_r, $1_t)
 826         ')
 827
 828         optional_policy(`
 829                 slrnpull_search_spool($1_usertype)
 830         ')
 831
 832 ')
 833
 834 #######################################
 835 ## <summary>
 836 ##      The template for creating a login user.
 837 ## </summary>
 838 ## <desc>
 839 ##      <p>
 840 ##      This template creates a user domain, types, and
 841 ##      rules for the user's tty, pty, home directories,
 842 ##      tmp, and tmpfs files.
 843 ##      </p>
 844 ## </desc>
 845 ## <param name="userdomain_prefix">
 846 ##      <summary>
 847 ##      The prefix of the user domain (e.g., user
 848 ##      is the prefix for user_t).
 849 ##      </summary>
 850 ## </param>
 851 #
 852 template(`userdom_login_user_template', `
 853         gen_require(`
 854                 class context contains;
 855         ')
 856
 857         userdom_base_user_template($1)
 858
 859         userdom_manage_home_role($1_r, $1_usertype)
 860
 861         userdom_manage_tmp_role($1_r, $1_usertype)
 862         userdom_manage_tmpfs_role($1_r, $1_usertype)
 863
 864         ifelse(`$1',`unconfined',`',`
 865                 gen_tunable(allow_$1_exec_content, true)
 866
 867                 tunable_policy(`allow_$1_exec_content',`
 868                         userdom_exec_user_tmp_files($1_usertype)
 869                         userdom_exec_user_home_content_files($1_usertype)
 870                 ')
 871                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 872                         fs_exec_nfs_files($1_usertype)
 873                 ')
 874
 875                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 876                         fs_exec_cifs_files($1_usertype)
 877                 ')
 878         ')
 879
 880         userdom_change_password_template($1)
 881
 882         ##############################
 883         #
 884         # User domain Local policy
 885         #
 886
 887         allow $1_t self:capability { setgid chown fowner };
 888         dontaudit $1_t self:capability { sys_nice fsetid };
 889
 890         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 891         dontaudit $1_t self:process setrlimit;
 892         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 893
 894         allow $1_t self:context contains;
 895
 896         kernel_dontaudit_read_system_state($1_usertype)
 897         kernel_dontaudit_list_all_proc($1_usertype)
 898
 899         dev_read_sysfs($1_usertype)
 900         dev_read_urand($1_usertype)
 901
 902         domain_use_interactive_fds($1_usertype)
 903         # Command completion can fire hundreds of denials
 904         domain_dontaudit_exec_all_entry_files($1_usertype)
 905
 906         files_dontaudit_list_default($1_usertype)
 907         files_dontaudit_read_default_files($1_usertype)
 908         # Stat lost+found.
 909         files_getattr_lost_found_dirs($1_usertype)
 910
 911         fs_get_all_fs_quotas($1_usertype)
 912         fs_getattr_all_fs($1_usertype)
 913         fs_search_all($1_usertype)
 914         fs_list_inotifyfs($1_usertype)
 915         fs_rw_anon_inodefs_files($1_usertype)
 916
 917         auth_dontaudit_write_login_records($1_t)
 918         auth_rw_cache($1_t)
 919
 920         # Stop warnings about access to /dev/console
 921         init_dontaudit_use_fds($1_usertype)
 922         init_dontaudit_use_script_fds($1_usertype)
 923
 924         libs_exec_lib_files($1_usertype)
 925
 926         logging_dontaudit_getattr_all_logs($1_usertype)
 927
 928         # for running TeX programs
 929         miscfiles_read_tetex_data($1_usertype)
 930         miscfiles_exec_tetex_data($1_usertype)
 931
 932         seutil_read_config($1_usertype)
 933
 934         optional_policy(`
 935                 cups_read_config($1_usertype)
 936                 cups_stream_connect($1_usertype)
 937                 cups_stream_connect_ptal($1_usertype)
 938         ')
 939
 940         optional_policy(`
 941                 kerberos_use($1_usertype)
 942                 kerberos_filetrans_home_content($1_usertype)
 943         ')
 944
 945         optional_policy(`
 946                 mta_dontaudit_read_spool_symlinks($1_usertype)
 947         ')
 948
 949         optional_policy(`
 950                 quota_dontaudit_getattr_db($1_usertype)
 951         ')
 952
 953         optional_policy(`
 954                 rpm_read_db($1_usertype)
 955                 rpm_dontaudit_manage_db($1_usertype)
 956                 rpm_read_cache($1_usertype)
 957         ')
 958
 959         optional_policy(`
 960                 oddjob_run_mkhomedir($1_t, $1_r)
 961         ')
 962 ')
 963
 964 #######################################
 965 ## <summary>
 966 ##      The template for creating a unprivileged login user.
 967 ## </summary>
 968 ## <desc>
 969 ##      <p>
 970 ##      This template creates a user domain, types, and
 971 ##      rules for the user's tty, pty, home directories,
 972 ##      tmp, and tmpfs files.
 973 ##      </p>
 974 ## </desc>
 975 ## <param name="userdomain_prefix">
 976 ##      <summary>
 977 ##      The prefix of the user domain (e.g., user
 978 ##      is the prefix for user_t).
 979 ##      </summary>
 980 ## </param>
 981 #
 982 template(`userdom_restricted_user_template',`
 983         gen_require(`
 984                 attribute unpriv_userdomain;
 985         ')
 986
 987         userdom_login_user_template($1)
 988
 989         typeattribute $1_t unpriv_userdomain;
 990         domain_interactive_fd($1_t)
 991
 992         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 993         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 994
 995         ##############################
 996         #
 997         # Local policy
 998         #
 999
1000         optional_policy(`
1001                 loadkeys_run($1_t,$1_r)
1002         ')
1003 ')
1004
1005 #######################################
1006 ## <summary>
1007 ##      The template for creating a unprivileged xwindows login user.
1008 ## </summary>
1009 ## <desc>
1010 ##      <p>
1011 ##      The template for creating a unprivileged xwindows login user.
1012 ##      </p>
1013 ##      <p>
1014 ##      This template creates a user domain, types, and
1015 ##      rules for the user's tty, pty, home directories,
1016 ##      tmp, and tmpfs files.
1017 ##      </p>
1018 ## </desc>
1019 ## <param name="userdomain_prefix">
1020 ##      <summary>
1021 ##      The prefix of the user domain (e.g., user
1022 ##      is the prefix for user_t).
1023 ##      </summary>
1024 ## </param>
1025 #
1026 template(`userdom_restricted_xwindows_user_template',`
1027
1028         userdom_restricted_user_template($1)
1029
1030         ##############################
1031         #
1032         # Local policy
1033         #
1034
1035         auth_role($1_r, $1_t)
1036         auth_search_pam_console_data($1_usertype)
1037         auth_dontaudit_read_login_records($1_usertype)
1038
1039         dev_read_sound($1_usertype)
1040         dev_write_sound($1_usertype)
1041         # gnome keyring wants to read this.
1042         dev_dontaudit_read_rand($1_usertype)
1043         # temporarily allow since openoffice requires this
1044         dev_read_rand($1_usertype)
1045
1046         dev_read_video_dev($1_usertype)
1047         dev_write_video_dev($1_usertype)
1048         dev_rw_wireless($1_usertype)
1049
1050         libs_dontaudit_setattr_lib_files($1_usertype)
1051
1052         tunable_policy(`user_rw_noexattrfile',`
1053                 dev_rw_usbfs($1_t)
1054                 dev_rw_generic_usb_dev($1_usertype)
1055
1056                 fs_manage_noxattr_fs_files($1_usertype)
1057                 fs_manage_noxattr_fs_dirs($1_usertype)
1058                 fs_manage_dos_dirs($1_usertype)
1059                 fs_manage_dos_files($1_usertype)
1060                 storage_raw_read_removable_device($1_usertype)
1061                 storage_raw_write_removable_device($1_usertype)
1062         ')
1063
1064         logging_send_syslog_msg($1_usertype)
1065         logging_dontaudit_send_audit_msgs($1_t)
1066
1067         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1068         logging_send_audit_msgs($1_t)
1069         selinux_get_enforce_mode($1_t)
1070         seutil_exec_restorecond($1_t)
1071         seutil_read_file_contexts($1_t)
1072         seutil_read_default_contexts($1_t)
1073
1074         xserver_restricted_role($1_r, $1_t)
1075
1076         optional_policy(`
1077                 alsa_read_rw_config($1_usertype)
1078         ')
1079
1080          # cjp: needed by KDE apps
1081          # bug: #682499
1082          optional_policy(`
1083                 gnome_read_usr_config($1_usertype)
1084                 gnome_role_gkeyringd($1, $1_r, $1_t)
1085                 # cjp: telepathy F15 bugs
1086                 telepathy_dbus_session_role($1_r, $1_t, $1)
1087         ')
1088
1089         optional_policy(`
1090                 dbus_role_template($1, $1_r, $1_usertype)
1091                 dbus_system_bus_client($1_usertype)
1092                 allow $1_usertype $1_usertype:dbus send_msg;
1093
1094                 optional_policy(`
1095                         abrt_dbus_chat($1_usertype)
1096                         abrt_run_helper($1_usertype, $1_r)
1097                 ')
1098
1099                 optional_policy(`
1100                         consolekit_dontaudit_read_log($1_usertype)
1101                         consolekit_dbus_chat($1_usertype)
1102                 ')
1103
1104                 optional_policy(`
1105                         cups_dbus_chat($1_usertype)
1106                         cups_dbus_chat_config($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         devicekit_dbus_chat($1_usertype)
1111                         devicekit_dbus_chat_disk($1_usertype)
1112                         devicekit_dbus_chat_power($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         fprintd_dbus_chat($1_t)
1117                 ')
1118         ')
1119
1120         optional_policy(`
1121                 openoffice_role_template($1, $1_r, $1_usertype)
1122         ')
1123
1124         optional_policy(`
1125                 policykit_role($1_r, $1_usertype)
1126         ')
1127
1128         optional_policy(`
1129                 pulseaudio_role($1_r, $1_usertype)
1130         ')
1131
1132         optional_policy(`
1133                 rtkit_scheduled($1_usertype)
1134         ')
1135
1136         optional_policy(`
1137                 setroubleshoot_dontaudit_stream_connect($1_t)
1138         ')
1139
1140         optional_policy(`
1141                 udev_read_db($1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 wm_role_template($1, $1_r, $1_t)
1146         ')
1147 ')
1148
1149 #######################################
1150 ## <summary>
1151 ##      The template for creating a unprivileged user roughly
1152 ##      equivalent to a regular linux user.
1153 ## </summary>
1154 ## <desc>
1155 ##      <p>
1156 ##      The template for creating a unprivileged user roughly
1157 ##      equivalent to a regular linux user.
1158 ##      </p>
1159 ##      <p>
1160 ##      This template creates a user domain, types, and
1161 ##      rules for the user's tty, pty, home directories,
1162 ##      tmp, and tmpfs files.
1163 ##      </p>
1164 ## </desc>
1165 ## <param name="userdomain_prefix">
1166 ##      <summary>
1167 ##      The prefix of the user domain (e.g., user
1168 ##      is the prefix for user_t).
1169 ##      </summary>
1170 ## </param>
1171 #
1172 template(`userdom_unpriv_user_template', `
1173
1174         ##############################
1175         #
1176         # Declarations
1177         #
1178
1179         # Inherit rules for ordinary users.
1180         userdom_restricted_xwindows_user_template($1)
1181         userdom_common_user_template($1)
1182
1183         ##############################
1184         #
1185         # Local policy
1186         #
1187
1188         # port access is audited even if dac would not have allowed it, so dontaudit it here
1189 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1190         # Need the following rule to allow users to run vpnc
1191         corenet_tcp_bind_xserver_port($1_t)
1192         corenet_tcp_bind_generic_node($1_usertype)
1193
1194         storage_rw_fuse($1_t)
1195
1196         miscfiles_read_hwdata($1_usertype)
1197
1198         # Allow users to run TCP servers (bind to ports and accept connection from
1199         # the same domain and outside users) disabling this forces FTP passive mode
1200         # and may change other protocols
1201
1202         tunable_policy(`user_share_music',`
1203                 corenet_tcp_bind_daap_port($1_usertype)
1204         ')
1205
1206         tunable_policy(`user_tcp_server',`
1207                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1208         ')
1209
1210         tunable_policy(`user_setrlimit',`
1211                 allow $1_usertype self:process setrlimit;
1212         ')
1213
1214         optional_policy(`
1215                 cdrecord_role($1_r, $1_t)
1216         ')
1217
1218         optional_policy(`
1219                 cron_role($1_r, $1_t)
1220         ')
1221
1222         optional_policy(`
1223                 games_rw_data($1_usertype)
1224         ')
1225
1226         optional_policy(`
1227                 gpg_role($1_r, $1_usertype)
1228         ')
1229
1230         optional_policy(`
1231                 gnomeclock_dbus_chat($1_t)
1232         ')
1233
1234         optional_policy(`
1235                 gpm_stream_connect($1_usertype)
1236         ')
1237
1238         optional_policy(`
1239                 execmem_role_template($1, $1_r, $1_t)
1240         ')
1241
1242         optional_policy(`
1243                 java_role_template($1, $1_r, $1_t)
1244         ')
1245
1246         optional_policy(`
1247                 mono_role_template($1, $1_r, $1_t)
1248         ')
1249
1250         optional_policy(`
1251                 mount_run_fusermount($1_t, $1_r)
1252                 mount_read_pid_files($1_t)
1253         ')
1254
1255         optional_policy(`
1256                 wine_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 postfix_run_postdrop($1_t, $1_r)
1261         ')
1262
1263         # Run pppd in pppd_t by default for user
1264         optional_policy(`
1265                 ppp_run_cond($1_t, $1_r)
1266         ')
1267 ')
1268
1269 #######################################
1270 ## <summary>
1271 ##      The template for creating an administrative user.
1272 ## </summary>
1273 ## <desc>
1274 ##      <p>
1275 ##      This template creates a user domain, types, and
1276 ##      rules for the user's tty, pty, home directories,
1277 ##      tmp, and tmpfs files.
1278 ##      </p>
1279 ##      <p>
1280 ##      The privileges given to administrative users are:
1281 ##      <ul>
1282 ##              <li>Raw disk access</li>
1283 ##              <li>Set all sysctls</li>
1284 ##              <li>All kernel ring buffer controls</li>
1285 ##              <li>Create, read, write, and delete all files but shadow</li>
1286 ##              <li>Manage source and binary format SELinux policy</li>
1287 ##              <li>Run insmod</li>
1288 ##      </ul>
1289 ##      </p>
1290 ## </desc>
1291 ## <param name="userdomain_prefix">
1292 ##      <summary>
1293 ##      The prefix of the user domain (e.g., sysadm
1294 ##      is the prefix for sysadm_t).
1295 ##      </summary>
1296 ## </param>
1297 #
1298 template(`userdom_admin_user_template',`
1299         gen_require(`
1300                 attribute admindomain;
1301                 class passwd { passwd chfn chsh rootok crontab };
1302         ')
1303
1304         ##############################
1305         #
1306         # Declarations
1307         #
1308
1309         # Inherit rules for ordinary users.
1310         userdom_login_user_template($1)
1311         userdom_common_user_template($1)
1312
1313         domain_obj_id_change_exemption($1_t)
1314         role system_r types $1_t;
1315
1316         typeattribute $1_t admindomain;
1317
1318         ifdef(`direct_sysadm_daemon',`
1319                 domain_system_change_exemption($1_t)
1320         ')
1321
1322         ##############################
1323         #
1324         # $1_t local policy
1325         #
1326
1327         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1328         allow $1_t self:capability2 syslog;
1329         allow $1_t self:process { setexec setfscreate };
1330         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1331         allow $1_t self:tun_socket create;
1332         # Set password information for other users.
1333         allow $1_t self:passwd { passwd chfn chsh };
1334         # Skip authentication when pam_rootok is specified.
1335         allow $1_t self:passwd rootok;
1336
1337         # Manipulate other users crontab.
1338         allow $1_t self:passwd crontab;
1339
1340         kernel_read_software_raid_state($1_t)
1341         kernel_getattr_core_if($1_t)
1342         kernel_getattr_message_if($1_t)
1343         kernel_change_ring_buffer_level($1_t)
1344         kernel_clear_ring_buffer($1_t)
1345         kernel_read_ring_buffer($1_t)
1346         kernel_get_sysvipc_info($1_t)
1347         kernel_rw_all_sysctls($1_t)
1348         # signal unlabeled processes:
1349         kernel_kill_unlabeled($1_t)
1350         kernel_signal_unlabeled($1_t)
1351         kernel_sigstop_unlabeled($1_t)
1352         kernel_signull_unlabeled($1_t)
1353         kernel_sigchld_unlabeled($1_t)
1354         kernel_signal($1_t)
1355
1356         corenet_tcp_bind_generic_port($1_t)
1357         # allow setting up tunnels
1358         corenet_rw_tun_tap_dev($1_t)
1359
1360         dev_getattr_generic_blk_files($1_t)
1361         dev_getattr_generic_chr_files($1_t)
1362         # for lsof
1363         dev_getattr_mtrr_dev($1_t)
1364         # Allow MAKEDEV to work
1365         dev_create_all_blk_files($1_t)
1366         dev_create_all_chr_files($1_t)
1367         dev_delete_all_blk_files($1_t)
1368         dev_delete_all_chr_files($1_t)
1369         dev_rename_all_blk_files($1_t)
1370         dev_rename_all_chr_files($1_t)
1371         dev_create_generic_symlinks($1_t)
1372         dev_rw_generic_usb_dev($1_t)
1373         dev_rw_usbfs($1_t)
1374
1375         domain_setpriority_all_domains($1_t)
1376         domain_read_all_domains_state($1_t)
1377         domain_getattr_all_domains($1_t)
1378         domain_getcap_all_domains($1_t)
1379         domain_dontaudit_ptrace_all_domains($1_t)
1380         # signal all domains:
1381         domain_kill_all_domains($1_t)
1382         domain_signal_all_domains($1_t)
1383         domain_signull_all_domains($1_t)
1384         domain_sigstop_all_domains($1_t)
1385         domain_sigstop_all_domains($1_t)
1386         domain_sigchld_all_domains($1_t)
1387         # for lsof
1388         domain_getattr_all_sockets($1_t)
1389         domain_dontaudit_getattr_all_sockets($1_t)
1390
1391         files_exec_usr_src_files($1_t)
1392
1393         fs_getattr_all_fs($1_t)
1394         fs_getattr_all_files($1_t)
1395         fs_list_all($1_t)
1396         fs_set_all_quotas($1_t)
1397         fs_exec_noxattr($1_t)
1398
1399         storage_raw_read_removable_device($1_t)
1400         storage_raw_write_removable_device($1_t)
1401         storage_dontaudit_read_fixed_disk($1_t)
1402
1403         term_use_all_inherited_terms($1_t)
1404         term_use_unallocated_ttys($1_t)
1405
1406         auth_getattr_shadow($1_t)
1407         # Manage almost all files
1408         auth_manage_all_files_except_shadow($1_t)
1409         # Relabel almost all files
1410         auth_relabel_all_files_except_shadow($1_t)
1411
1412         init_telinit($1_t)
1413
1414         logging_send_syslog_msg($1_t)
1415
1416         optional_policy(`
1417                 modutils_domtrans_insmod($1_t)
1418                 modutils_domtrans_depmod($1_t)
1419         ')
1420
1421         # The following rule is temporary until such time that a complete
1422         # policy management infrastructure is in place so that an administrator
1423         # cannot directly manipulate policy files with arbitrary programs.
1424         seutil_manage_src_policy($1_t)
1425         # Violates the goal of limiting write access to checkpolicy.
1426         # But presently necessary for installing the file_contexts file.
1427         seutil_manage_bin_policy($1_t)
1428
1429         userdom_manage_user_home_content_dirs($1_t)
1430         userdom_manage_user_home_content_files($1_t)
1431         userdom_manage_user_home_content_symlinks($1_t)
1432         userdom_manage_user_home_content_pipes($1_t)
1433         userdom_manage_user_home_content_sockets($1_t)
1434         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1435
1436         tunable_policy(`user_rw_noexattrfile',`
1437                 fs_manage_noxattr_fs_files($1_t)
1438                 fs_manage_noxattr_fs_dirs($1_t)
1439         ',`
1440                 fs_read_noxattr_fs_files($1_t)
1441         ')
1442
1443         optional_policy(`
1444                 postgresql_unconfined($1_t)
1445         ')
1446
1447         optional_policy(`
1448                 userhelper_exec($1_t)
1449         ')
1450 ')
1451
1452 ########################################
1453 ## <summary>
1454 ##      Allow user to run as a secadm
1455 ## </summary>
1456 ## <desc>
1457 ##      <p>
1458 ##      Create objects in a user home directory
1459 ##      with an automatic type transition to
1460 ##      a specified private type.
1461 ##      </p>
1462 ##      <p>
1463 ##      This is a templated interface, and should only
1464 ##      be called from a per-userdomain template.
1465 ##      </p>
1466 ## </desc>
1467 ## <param name="domain">
1468 ##      <summary>
1469 ##      Domain allowed access.
1470 ##      </summary>
1471 ## </param>
1472 ## <param name="role">
1473 ##      <summary>
1474 ##      The role  of the object to create.
1475 ##      </summary>
1476 ## </param>
1477 #
1478 template(`userdom_security_admin_template',`
1479         allow $1 self:capability { dac_read_search dac_override };
1480
1481         corecmd_exec_shell($1)
1482
1483         domain_obj_id_change_exemption($1)
1484
1485         dev_relabel_all_dev_nodes($1)
1486
1487         files_create_boot_flag($1)
1488         files_create_default_dir($1)
1489         files_root_filetrans_default($1, dir)
1490
1491         # Necessary for managing /boot/efi
1492         fs_manage_dos_files($1)
1493
1494         mls_process_read_up($1)
1495         mls_file_read_all_levels($1)
1496         mls_file_upgrade($1)
1497         mls_file_downgrade($1)
1498
1499         selinux_set_enforce_mode($1)
1500         selinux_set_all_booleans($1)
1501         selinux_set_parameters($1)
1502         selinux_read_policy($1)
1503
1504         auth_relabel_all_files_except_shadow($1)
1505         auth_relabel_shadow($1)
1506
1507         init_exec($1)
1508
1509         logging_send_syslog_msg($1)
1510         logging_read_audit_log($1)
1511         logging_read_generic_logs($1)
1512         logging_read_audit_config($1)
1513
1514         seutil_manage_bin_policy($1)
1515         seutil_manage_default_contexts($1)
1516         seutil_manage_file_contexts($1)
1517         seutil_manage_module_store($1)
1518         seutil_manage_config($1)
1519         seutil_run_checkpolicy($1,$2)
1520         seutil_run_loadpolicy($1,$2)
1521         seutil_run_semanage($1,$2)
1522         seutil_run_setsebool($1,$2)
1523         seutil_run_setfiles($1, $2)
1524
1525         optional_policy(`
1526                 aide_run($1,$2)
1527         ')
1528
1529         optional_policy(`
1530                 consoletype_exec($1)
1531         ')
1532
1533         optional_policy(`
1534                 dmesg_exec($1)
1535         ')
1536
1537         optional_policy(`
1538                 ipsec_run_setkey($1,$2)
1539         ')
1540
1541         optional_policy(`
1542                 netlabel_run_mgmt($1,$2)
1543         ')
1544
1545         optional_policy(`
1546                 samhain_run($1, $2)
1547         ')
1548 ')
1549
1550 ########################################
1551 ## <summary>
1552 ##      Make the specified type usable in a
1553 ##      user home directory.
1554 ## </summary>
1555 ## <param name="type">
1556 ##      <summary>
1557 ##      Type to be used as a file in the
1558 ##      user home directory.
1559 ##      </summary>
1560 ## </param>
1561 #
1562 interface(`userdom_user_home_content',`
1563         gen_require(`
1564                 type user_home_t;
1565                 attribute user_home_type;
1566         ')
1567
1568         allow $1 user_home_t:filesystem associate;
1569         files_type($1)
1570         ubac_constrained($1)
1571
1572         files_poly_member($1)
1573         typeattribute $1  user_home_type;
1574 ')
1575
1576 ########################################
1577 ## <summary>
1578 ##      Make the specified type usable in a
1579 ##      generic temporary directory.
1580 ## </summary>
1581 ## <param name="type">
1582 ##      <summary>
1583 ##      Type to be used as a file in the
1584 ##      generic temporary directory.
1585 ##      </summary>
1586 ## </param>
1587 #
1588 interface(`userdom_user_tmp_content',`
1589         gen_require(`
1590                 attribute user_tmp_type;
1591         ')
1592
1593         typeattribute $1 user_tmp_type;
1594
1595         files_tmp_file($1)
1596         ubac_constrained($1)
1597 ')
1598
1599 ########################################
1600 ## <summary>
1601 ##      Allow domain to attach to TUN devices created by administrative users.
1602 ## </summary>
1603 ## <param name="domain">
1604 ##      <summary>
1605 ##      Domain allowed access.
1606 ##      </summary>
1607 ## </param>
1608 #
1609 interface(`userdom_attach_admin_tun_iface',`
1610         gen_require(`
1611                 attribute admindomain;
1612         ')
1613
1614         allow $1 admindomain:tun_socket relabelfrom;
1615         allow $1 self:tun_socket relabelto;
1616 ')
1617
1618 ########################################
1619 ## <summary>
1620 ##      Set the attributes of a user pty.
1621 ## </summary>
1622 ## <param name="domain">
1623 ##      <summary>
1624 ##      Domain allowed access.
1625 ##      </summary>
1626 ## </param>
1627 #
1628 interface(`userdom_setattr_user_ptys',`
1629         gen_require(`
1630                 type user_devpts_t;
1631         ')
1632
1633         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1634 ')
1635
1636 ########################################
1637 ## <summary>
1638 ##      Create a user pty.
1639 ## </summary>
1640 ## <param name="domain">
1641 ##      <summary>
1642 ##      Domain allowed access.
1643 ##      </summary>
1644 ## </param>
1645 #
1646 interface(`userdom_create_user_pty',`
1647         gen_require(`
1648                 type user_devpts_t;
1649         ')
1650
1651         term_create_pty($1, user_devpts_t)
1652 ')
1653
1654 ########################################
1655 ## <summary>
1656 ##      Get the attributes of user home directories.
1657 ## </summary>
1658 ## <param name="domain">
1659 ##      <summary>
1660 ##      Domain allowed access.
1661 ##      </summary>
1662 ## </param>
1663 #
1664 interface(`userdom_getattr_user_home_dirs',`
1665         gen_require(`
1666                 type user_home_dir_t;
1667         ')
1668
1669         allow $1 user_home_dir_t:dir getattr_dir_perms;
1670         files_search_home($1)
1671 ')
1672
1673 ########################################
1674 ## <summary>
1675 ##      Do not audit attempts to get the attributes of user home directories.
1676 ## </summary>
1677 ## <param name="domain">
1678 ##      <summary>
1679 ##      Domain to not audit.
1680 ##      </summary>
1681 ## </param>
1682 #
1683 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1684         gen_require(`
1685                 type user_home_dir_t;
1686         ')
1687
1688         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1689 ')
1690
1691 ########################################
1692 ## <summary>
1693 ##      Search user home directories.
1694 ## </summary>
1695 ## <param name="domain">
1696 ##      <summary>
1697 ##      Domain allowed access.
1698 ##      </summary>
1699 ## </param>
1700 #
1701 interface(`userdom_search_user_home_dirs',`
1702         gen_require(`
1703                 type user_home_dir_t;
1704         ')
1705
1706         allow $1 user_home_dir_t:dir search_dir_perms;
1707         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1708         files_search_home($1)
1709 ')
1710
1711 ########################################
1712 ## <summary>
1713 ##      Do not audit attempts to search user home directories.
1714 ## </summary>
1715 ## <desc>
1716 ##      <p>
1717 ##      Do not audit attempts to search user home directories.
1718 ##      This will supress SELinux denial messages when the specified
1719 ##      domain is denied the permission to search these directories.
1720 ##      </p>
1721 ## </desc>
1722 ## <param name="domain">
1723 ##      <summary>
1724 ##      Domain to not audit.
1725 ##      </summary>
1726 ## </param>
1727 ## <infoflow type="none"/>
1728 #
1729 interface(`userdom_dontaudit_search_user_home_dirs',`
1730         gen_require(`
1731                 type user_home_dir_t;
1732         ')
1733
1734         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1735 ')
1736
1737 ########################################
1738 ## <summary>
1739 ##      List user home directories.
1740 ## </summary>
1741 ## <param name="domain">
1742 ##      <summary>
1743 ##      Domain allowed access.
1744 ##      </summary>
1745 ## </param>
1746 #
1747 interface(`userdom_list_user_home_dirs',`
1748         gen_require(`
1749                 type user_home_dir_t;
1750         ')
1751
1752         allow $1 user_home_dir_t:dir list_dir_perms;
1753         files_search_home($1)
1754
1755         tunable_policy(`use_nfs_home_dirs',`
1756                 fs_list_nfs($1)
1757         ')
1758
1759         tunable_policy(`use_samba_home_dirs',`
1760                 fs_list_cifs($1)
1761         ')
1762 ')
1763
1764 ########################################
1765 ## <summary>
1766 ##      Do not audit attempts to list user home subdirectories.
1767 ## </summary>
1768 ## <param name="domain">
1769 ##      <summary>
1770 ##      Domain to not audit.
1771 ##      </summary>
1772 ## </param>
1773 #
1774 interface(`userdom_dontaudit_list_user_home_dirs',`
1775         gen_require(`
1776                 type user_home_dir_t;
1777                 type user_home_t;
1778         ')
1779
1780         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1781         dontaudit $1 user_home_t:dir list_dir_perms;
1782 ')
1783
1784 ########################################
1785 ## <summary>
1786 ##      Create user home directories.
1787 ## </summary>
1788 ## <param name="domain">
1789 ##      <summary>
1790 ##      Domain allowed access.
1791 ##      </summary>
1792 ## </param>
1793 #
1794 interface(`userdom_create_user_home_dirs',`
1795         gen_require(`
1796                 type user_home_dir_t;
1797         ')
1798
1799         allow $1 user_home_dir_t:dir create_dir_perms;
1800 ')
1801
1802 ########################################
1803 ## <summary>
1804 ##      Create user home directories.
1805 ## </summary>
1806 ## <param name="domain">
1807 ##      <summary>
1808 ##      Domain allowed access.
1809 ##      </summary>
1810 ## </param>
1811 #
1812 interface(`userdom_manage_user_home_dirs',`
1813         gen_require(`
1814                 type user_home_dir_t;
1815         ')
1816
1817         allow $1 user_home_dir_t:dir manage_dir_perms;
1818 ')
1819
1820 ########################################
1821 ## <summary>
1822 ##      Relabel to user home directories.
1823 ## </summary>
1824 ## <param name="domain">
1825 ##      <summary>
1826 ##      Domain allowed access.
1827 ##      </summary>
1828 ## </param>
1829 #
1830 interface(`userdom_relabelto_user_home_dirs',`
1831         gen_require(`
1832                 type user_home_dir_t;
1833         ')
1834
1835         allow $1 user_home_dir_t:dir relabelto;
1836 ')
1837
1838
1839 ########################################
1840 ## <summary>
1841 ##      Relabel to user home files.
1842 ## </summary>
1843 ## <param name="domain">
1844 ##      <summary>
1845 ##      Domain allowed access.
1846 ##      </summary>
1847 ## </param>
1848 #
1849 interface(`userdom_relabelto_user_home_files',`
1850         gen_require(`
1851                 type user_home_t;
1852         ')
1853
1854         allow $1 user_home_t:file relabelto;
1855 ')
1856 ########################################
1857 ## <summary>
1858 ##      Relabel user home files.
1859 ## </summary>
1860 ## <param name="domain">
1861 ##      <summary>
1862 ##      Domain allowed access.
1863 ##      </summary>
1864 ## </param>
1865 #
1866 interface(`userdom_relabel_user_home_files',`
1867         gen_require(`
1868                 type user_home_t;
1869         ')
1870
1871         allow $1 user_home_t:file relabel_file_perms;
1872 ')
1873
1874 ########################################
1875 ## <summary>
1876 ##      Create directories in the home dir root with
1877 ##      the user home directory type.
1878 ## </summary>
1879 ## <param name="domain">
1880 ##      <summary>
1881 ##      Domain allowed access.
1882 ##      </summary>
1883 ## </param>
1884 #
1885 interface(`userdom_home_filetrans_user_home_dir',`
1886         gen_require(`
1887                 type user_home_dir_t;
1888         ')
1889
1890         files_home_filetrans($1, user_home_dir_t, dir)
1891 ')
1892
1893 ########################################
1894 ## <summary>
1895 ##      Do a domain transition to the specified
1896 ##      domain when executing a program in the
1897 ##      user home directory.
1898 ## </summary>
1899 ## <desc>
1900 ##      <p>
1901 ##      Do a domain transition to the specified
1902 ##      domain when executing a program in the
1903 ##      user home directory.
1904 ##      </p>
1905 ##      <p>
1906 ##      No interprocess communication (signals, pipes,
1907 ##      etc.) is provided by this interface since
1908 ##      the domains are not owned by this module.
1909 ##      </p>
1910 ## </desc>
1911 ## <param name="source_domain">
1912 ##      <summary>
1913 ##      Domain allowed to transition.
1914 ##      </summary>
1915 ## </param>
1916 ## <param name="target_domain">
1917 ##      <summary>
1918 ##      Domain to transition to.
1919 ##      </summary>
1920 ## </param>
1921 #
1922 interface(`userdom_user_home_domtrans',`
1923         gen_require(`
1924                 type user_home_dir_t, user_home_t;
1925         ')
1926
1927         domain_auto_trans($1, user_home_t, $2)
1928         allow $1 user_home_dir_t:dir search_dir_perms;
1929         files_search_home($1)
1930 ')
1931
1932 ########################################
1933 ## <summary>
1934 ##      Do not audit attempts to search user home content directories.
1935 ## </summary>
1936 ## <param name="domain">
1937 ##      <summary>
1938 ##      Domain to not audit.
1939 ##      </summary>
1940 ## </param>
1941 #
1942 interface(`userdom_dontaudit_search_user_home_content',`
1943         gen_require(`
1944                 type user_home_t;
1945         ')
1946
1947         dontaudit $1 user_home_t:dir search_dir_perms;
1948         fs_dontaudit_list_nfs($1)
1949         fs_dontaudit_list_cifs($1)
1950 ')
1951
1952 ########################################
1953 ## <summary>
1954 ##      List contents of users home directory.
1955 ## </summary>
1956 ## <param name="domain">
1957 ##      <summary>
1958 ##      Domain allowed access.
1959 ##      </summary>
1960 ## </param>
1961 #
1962 interface(`userdom_list_user_home_content',`
1963         gen_require(`
1964                 type user_home_dir_t;
1965                 attribute user_home_type;
1966         ')
1967
1968         files_list_home($1)
1969         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1970 ')
1971
1972 ########################################
1973 ## <summary>
1974 ##      Create, read, write, and delete directories
1975 ##      in a user home subdirectory.
1976 ## </summary>
1977 ## <param name="domain">
1978 ##      <summary>
1979 ##      Domain allowed access.
1980 ##      </summary>
1981 ## </param>
1982 #
1983 interface(`userdom_manage_user_home_content_dirs',`
1984         gen_require(`
1985                 type user_home_dir_t, user_home_t;
1986         ')
1987
1988         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1989         files_search_home($1)
1990 ')
1991
1992 ########################################
1993 ## <summary>
1994 ##      Delete directories in a user home subdirectory.
1995 ## </summary>
1996 ## <param name="domain">
1997 ##      <summary>
1998 ##      Domain allowed access.
1999 ##      </summary>
2000 ## </param>
2001 #
2002 interface(`userdom_delete_user_home_content_dirs',`
2003         gen_require(`
2004                 type user_home_t;
2005         ')
2006
2007         allow $1 user_home_t:dir delete_dir_perms;
2008 ')
2009
2010 ########################################
2011 ## <summary>
2012 ##      Set the attributes of user home files.
2013 ## </summary>
2014 ## <param name="domain">
2015 ##      <summary>
2016 ##      Domain allowed access.
2017 ##      </summary>
2018 ## </param>
2019 ## <rolecap/>
2020 #
2021 interface(`userdom_setattr_user_home_content_files',`
2022         gen_require(`
2023                 type user_home_t;
2024         ')
2025
2026         allow $1 user_home_t:file setattr;
2027 ')
2028
2029 ########################################
2030 ## <summary>
2031 ##      Do not audit attempts to set the
2032 ##      attributes of user home files.
2033 ## </summary>
2034 ## <param name="domain">
2035 ##      <summary>
2036 ##      Domain to not audit.
2037 ##      </summary>
2038 ## </param>
2039 #
2040 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2041         gen_require(`
2042                 type user_home_t;
2043         ')
2044
2045         dontaudit $1 user_home_t:file setattr_file_perms;
2046 ')
2047
2048 ########################################
2049 ## <summary>
2050 ##      Mmap user home files.
2051 ## </summary>
2052 ## <param name="domain">
2053 ##      <summary>
2054 ##      Domain allowed access.
2055 ##      </summary>
2056 ## </param>
2057 #
2058 interface(`userdom_mmap_user_home_content_files',`
2059         gen_require(`
2060                 type user_home_dir_t, user_home_t;
2061         ')
2062
2063         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2064         files_search_home($1)
2065 ')
2066
2067 ########################################
2068 ## <summary>
2069 ##      Read user home files.
2070 ## </summary>
2071 ## <param name="domain">
2072 ##      <summary>
2073 ##      Domain allowed access.
2074 ##      </summary>
2075 ## </param>
2076 #
2077 interface(`userdom_read_user_home_content_files',`
2078         gen_require(`
2079                 type user_home_dir_t, user_home_t;
2080         ')
2081
2082         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2083         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2084         files_search_home($1)
2085 ')
2086
2087 ########################################
2088 ## <summary>
2089 ##      Do not audit attempts to getattr user home files.
2090 ## </summary>
2091 ## <param name="domain">
2092 ##      <summary>
2093 ##      Domain to not audit.
2094 ##      </summary>
2095 ## </param>
2096 #
2097 interface(`userdom_dontaudit_getattr_user_home_content',`
2098         gen_require(`
2099                 attribute user_home_type;
2100         ')
2101
2102         dontaudit $1 user_home_type:dir getattr;
2103         dontaudit $1 user_home_type:file getattr;
2104 ')
2105
2106 ########################################
2107 ## <summary>
2108 ##      Do not audit attempts to read user home files.
2109 ## </summary>
2110 ## <param name="domain">
2111 ##      <summary>
2112 ##      Domain to not audit.
2113 ##      </summary>
2114 ## </param>
2115 #
2116 interface(`userdom_dontaudit_read_user_home_content_files',`
2117         gen_require(`
2118                 attribute user_home_type;
2119                 type user_home_dir_t;
2120         ')
2121
2122         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2123         dontaudit $1 user_home_type:dir list_dir_perms;
2124         dontaudit $1 user_home_type:file read_file_perms;
2125         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2126 ')
2127
2128 ########################################
2129 ## <summary>
2130 ##      Do not audit attempts to append user home files.
2131 ## </summary>
2132 ## <param name="domain">
2133 ##      <summary>
2134 ##      Domain to not audit.
2135 ##      </summary>
2136 ## </param>
2137 #
2138 interface(`userdom_dontaudit_append_user_home_content_files',`
2139         gen_require(`
2140                 type user_home_t;
2141         ')
2142
2143         dontaudit $1 user_home_t:file append_file_perms;
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Do not audit attempts to write user home files.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain to not audit.
2153 ##      </summary>
2154 ## </param>
2155 #
2156 interface(`userdom_dontaudit_write_user_home_content_files',`
2157         gen_require(`
2158                 type user_home_t;
2159         ')
2160
2161         dontaudit $1 user_home_t:file write_file_perms;
2162 ')
2163
2164 ########################################
2165 ## <summary>
2166 ##      Delete files in a user home subdirectory.
2167 ## </summary>
2168 ## <param name="domain">
2169 ##      <summary>
2170 ##      Domain allowed access.
2171 ##      </summary>
2172 ## </param>
2173 #
2174 interface(`userdom_delete_user_home_content_files',`
2175         gen_require(`
2176                 type user_home_t;
2177         ')
2178
2179         allow $1 user_home_t:file delete_file_perms;
2180 ')
2181
2182 ########################################
2183 ## <summary>
2184 ##      Delete sock files in a user home subdirectory.
2185 ## </summary>
2186 ## <param name="domain">
2187 ##      <summary>
2188 ##      Domain allowed access.
2189 ##      </summary>
2190 ## </param>
2191 #
2192 interface(`userdom_delete_user_home_content_sock_files',`
2193         gen_require(`
2194                 type user_home_t;
2195         ')
2196
2197         allow $1 user_home_t:sock_file delete_file_perms;
2198 ')
2199
2200 ########################################
2201 ## <summary>
2202 ##      Do not audit attempts to write user home files.
2203 ## </summary>
2204 ## <param name="domain">
2205 ##      <summary>
2206 ##      Domain to not audit.
2207 ##      </summary>
2208 ## </param>
2209 #
2210 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2211         gen_require(`
2212                 type user_home_t;
2213         ')
2214
2215         dontaudit $1 user_home_t:file relabel_file_perms;
2216 ')
2217
2218 ########################################
2219 ## <summary>
2220 ##      Read user home subdirectory symbolic links.
2221 ## </summary>
2222 ## <param name="domain">
2223 ##      <summary>
2224 ##      Domain allowed access.
2225 ##      </summary>
2226 ## </param>
2227 #
2228 interface(`userdom_read_user_home_content_symlinks',`
2229         gen_require(`
2230                 type user_home_dir_t, user_home_t;
2231         ')
2232
2233         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2234 ')
2235
2236 ########################################
2237 ## <summary>
2238 ##      Execute user home files.
2239 ## </summary>
2240 ## <param name="domain">
2241 ##      <summary>
2242 ##      Domain allowed access.
2243 ##      </summary>
2244 ## </param>
2245 ## <rolecap/>
2246 #
2247 interface(`userdom_exec_user_home_content_files',`
2248         gen_require(`
2249                 type user_home_dir_t;
2250                 attribute user_home_type;
2251         ')
2252
2253         files_search_home($1)
2254         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2255         dontaudit $1 user_home_type:sock_file execute;
2256         ')
2257
2258 ########################################
2259 ## <summary>
2260 ##      Do not audit attempts to execute user home files.
2261 ## </summary>
2262 ## <param name="domain">
2263 ##      <summary>
2264 ##      Domain to not audit.
2265 ##      </summary>
2266 ## </param>
2267 #
2268 interface(`userdom_dontaudit_exec_user_home_content_files',`
2269         gen_require(`
2270                 type user_home_t;
2271         ')
2272
2273         dontaudit $1 user_home_t:file exec_file_perms;
2274 ')
2275
2276 ########################################
2277 ## <summary>
2278 ##      Create, read, write, and delete files
2279 ##      in a user home subdirectory.
2280 ## </summary>
2281 ## <param name="domain">
2282 ##      <summary>
2283 ##      Domain allowed access.
2284 ##      </summary>
2285 ## </param>
2286 #
2287 interface(`userdom_manage_user_home_content_files',`
2288         gen_require(`
2289                 type user_home_dir_t, user_home_t;
2290         ')
2291
2292         manage_files_pattern($1, user_home_t, user_home_t)
2293         allow $1 user_home_dir_t:dir search_dir_perms;
2294         files_search_home($1)
2295 ')
2296
2297 ########################################
2298 ## <summary>
2299 ##      Do not audit attempts to create, read, write, and delete directories
2300 ##      in a user home subdirectory.
2301 ## </summary>
2302 ## <param name="domain">
2303 ##      <summary>
2304 ##      Domain to not audit.
2305 ##      </summary>
2306 ## </param>
2307 #
2308 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2309         gen_require(`
2310                 type user_home_dir_t, user_home_t;
2311         ')
2312
2313         dontaudit $1 user_home_t:dir manage_dir_perms;
2314 ')
2315
2316 ########################################
2317 ## <summary>
2318 ##      Create, read, write, and delete symbolic links
2319 ##      in a user home subdirectory.
2320 ## </summary>
2321 ## <param name="domain">
2322 ##      <summary>
2323 ##      Domain allowed access.
2324 ##      </summary>
2325 ## </param>
2326 #
2327 interface(`userdom_manage_user_home_content_symlinks',`
2328         gen_require(`
2329                 type user_home_dir_t, user_home_t;
2330         ')
2331
2332         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2333         allow $1 user_home_dir_t:dir search_dir_perms;
2334         files_search_home($1)
2335 ')
2336
2337 ########################################
2338 ## <summary>
2339 ##      Delete symbolic links in a user home directory.
2340 ## </summary>
2341 ## <param name="domain">
2342 ##      <summary>
2343 ##      Domain allowed access.
2344 ##      </summary>
2345 ## </param>
2346 #
2347 interface(`userdom_delete_user_home_content_symlinks',`
2348         gen_require(`
2349                 type user_home_t;
2350         ')
2351
2352         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2353 ')
2354
2355 ########################################
2356 ## <summary>
2357 ##      Create, read, write, and delete named pipes
2358 ##      in a user home subdirectory.
2359 ## </summary>
2360 ## <param name="domain">
2361 ##      <summary>
2362 ##      Domain allowed access.
2363 ##      </summary>
2364 ## </param>
2365 #
2366 interface(`userdom_manage_user_home_content_pipes',`
2367         gen_require(`
2368                 type user_home_dir_t, user_home_t;
2369         ')
2370
2371         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2372         allow $1 user_home_dir_t:dir search_dir_perms;
2373         files_search_home($1)
2374 ')
2375
2376 ########################################
2377 ## <summary>
2378 ##      Create, read, write, and delete named sockets
2379 ##      in a user home subdirectory.
2380 ## </summary>
2381 ## <param name="domain">
2382 ##      <summary>
2383 ##      Domain allowed access.
2384 ##      </summary>
2385 ## </param>
2386 #
2387 interface(`userdom_manage_user_home_content_sockets',`
2388         gen_require(`
2389                 type user_home_dir_t, user_home_t;
2390         ')
2391
2392         allow $1 user_home_dir_t:dir search_dir_perms;
2393         manage_sock_files_pattern($1, user_home_t, user_home_t)
2394         files_search_home($1)
2395 ')
2396
2397 ########################################
2398 ## <summary>
2399 ##      Create objects in a user home directory
2400 ##      with an automatic type transition to
2401 ##      a specified private type.
2402 ## </summary>
2403 ## <param name="domain">
2404 ##      <summary>
2405 ##      Domain allowed access.
2406 ##      </summary>
2407 ## </param>
2408 ## <param name="private_type">
2409 ##      <summary>
2410 ##      The type of the object to create.
2411 ##      </summary>
2412 ## </param>
2413 ## <param name="object_class">
2414 ##      <summary>
2415 ##      The class of the object to be created.
2416 ##      </summary>
2417 ## </param>
2418 #
2419 interface(`userdom_user_home_dir_filetrans',`
2420         gen_require(`
2421                 type user_home_dir_t;
2422         ')
2423
2424         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2425         files_search_home($1)
2426 ')
2427
2428 ########################################
2429 ## <summary>
2430 ##      Create objects in a user home directory
2431 ##      with an automatic type transition to
2432 ##      a specified private type.
2433 ## </summary>
2434 ## <param name="domain">
2435 ##      <summary>
2436 ##      Domain allowed access.
2437 ##      </summary>
2438 ## </param>
2439 ## <param name="private_type">
2440 ##      <summary>
2441 ##      The type of the object to create.
2442 ##      </summary>
2443 ## </param>
2444 ## <param name="object_class">
2445 ##      <summary>
2446 ##      The class of the object to be created.
2447 ##      </summary>
2448 ## </param>
2449 #
2450 interface(`userdom_user_home_content_filetrans',`
2451         gen_require(`
2452                 type user_home_dir_t, user_home_t;
2453         ')
2454
2455         filetrans_pattern($1, user_home_t, $2, $3)
2456         allow $1 user_home_dir_t:dir search_dir_perms;
2457         files_search_home($1)
2458 ')
2459
2460 ########################################
2461 ## <summary>
2462 ##      Create objects in a user home directory
2463 ##      with an automatic type transition to
2464 ##      the user home file type.
2465 ## </summary>
2466 ## <param name="domain">
2467 ##      <summary>
2468 ##      Domain allowed access.
2469 ##      </summary>
2470 ## </param>
2471 ## <param name="object_class">
2472 ##      <summary>
2473 ##      The class of the object to be created.
2474 ##      </summary>
2475 ## </param>
2476 #
2477 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2478         gen_require(`
2479                 type user_home_dir_t, user_home_t;
2480         ')
2481
2482         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2483         files_search_home($1)
2484 ')
2485
2486 ########################################
2487 ## <summary>
2488 ##      Write to user temporary named sockets.
2489 ## </summary>
2490 ## <param name="domain">
2491 ##      <summary>
2492 ##      Domain allowed access.
2493 ##      </summary>
2494 ## </param>
2495 #
2496 interface(`userdom_write_user_tmp_sockets',`
2497         gen_require(`
2498                 type user_tmp_t;
2499         ')
2500
2501         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2502         files_search_tmp($1)
2503 ')
2504
2505 ########################################
2506 ## <summary>
2507 ##      List user temporary directories.
2508 ## </summary>
2509 ## <param name="domain">
2510 ##      <summary>
2511 ##      Domain allowed access.
2512 ##      </summary>
2513 ## </param>
2514 #
2515 interface(`userdom_list_user_tmp',`
2516         gen_require(`
2517                 type user_tmp_t;
2518         ')
2519
2520         allow $1 user_tmp_t:dir list_dir_perms;
2521         files_search_tmp($1)
2522 ')
2523
2524 ########################################
2525 ## <summary>
2526 ##      Do not audit attempts to list user
2527 ##      temporary directories.
2528 ## </summary>
2529 ## <param name="domain">
2530 ##      <summary>
2531 ##      Domain to not audit.
2532 ##      </summary>
2533 ## </param>
2534 #
2535 interface(`userdom_dontaudit_list_user_tmp',`
2536         gen_require(`
2537                 type user_tmp_t;
2538         ')
2539
2540         dontaudit $1 user_tmp_t:dir list_dir_perms;
2541 ')
2542
2543 ########################################
2544 ## <summary>
2545 ##      Do not audit attempts to manage users
2546 ##      temporary directories.
2547 ## </summary>
2548 ## <param name="domain">
2549 ##      <summary>
2550 ##      Domain to not audit.
2551 ##      </summary>
2552 ## </param>
2553 #
2554 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2555         gen_require(`
2556                 type user_tmp_t;
2557         ')
2558
2559         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2560 ')
2561
2562 ########################################
2563 ## <summary>
2564 ##      Read user temporary files.
2565 ## </summary>
2566 ## <param name="domain">
2567 ##      <summary>
2568 ##      Domain allowed access.
2569 ##      </summary>
2570 ## </param>
2571 #
2572 interface(`userdom_read_user_tmp_files',`
2573         gen_require(`
2574                 type user_tmp_t;
2575         ')
2576
2577         read_files_pattern($1, user_tmp_t, user_tmp_t)
2578         allow $1 user_tmp_t:dir list_dir_perms;
2579         files_search_tmp($1)
2580 ')
2581
2582 ########################################
2583 ## <summary>
2584 ##      Do not audit attempts to read users
2585 ##      temporary files.
2586 ## </summary>
2587 ## <param name="domain">
2588 ##      <summary>
2589 ##      Domain to not audit.
2590 ##      </summary>
2591 ## </param>
2592 #
2593 interface(`userdom_dontaudit_read_user_tmp_files',`
2594         gen_require(`
2595                 type user_tmp_t;
2596         ')
2597
2598         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2599 ')
2600
2601 ########################################
2602 ## <summary>
2603 ##      Do not audit attempts to append users
2604 ##      temporary files.
2605 ## </summary>
2606 ## <param name="domain">
2607 ##      <summary>
2608 ##      Domain to not audit.
2609 ##      </summary>
2610 ## </param>
2611 #
2612 interface(`userdom_dontaudit_append_user_tmp_files',`
2613         gen_require(`
2614                 type user_tmp_t;
2615         ')
2616
2617         dontaudit $1 user_tmp_t:file append_file_perms;
2618 ')
2619
2620 ########################################
2621 ## <summary>
2622 ##      Read and write user temporary files.
2623 ## </summary>
2624 ## <param name="domain">
2625 ##      <summary>
2626 ##      Domain allowed access.
2627 ##      </summary>
2628 ## </param>
2629 #
2630 interface(`userdom_rw_user_tmp_files',`
2631         gen_require(`
2632                 type user_tmp_t;
2633         ')
2634
2635         allow $1 user_tmp_t:dir list_dir_perms;
2636         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2637         files_search_tmp($1)
2638 ')
2639
2640 ########################################
2641 ## <summary>
2642 ##      Do not audit attempts to manage users
2643 ##      temporary files.
2644 ## </summary>
2645 ## <param name="domain">
2646 ##      <summary>
2647 ##      Domain to not audit.
2648 ##      </summary>
2649 ## </param>
2650 #
2651 interface(`userdom_dontaudit_manage_user_tmp_files',`
2652         gen_require(`
2653                 type user_tmp_t;
2654         ')
2655
2656         dontaudit $1 user_tmp_t:file manage_file_perms;
2657 ')
2658
2659 ########################################
2660 ## <summary>
2661 ##      Read user temporary symbolic links.
2662 ## </summary>
2663 ## <param name="domain">
2664 ##      <summary>
2665 ##      Domain allowed access.
2666 ##      </summary>
2667 ## </param>
2668 #
2669 interface(`userdom_read_user_tmp_symlinks',`
2670         gen_require(`
2671                 type user_tmp_t;
2672         ')
2673
2674         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2675         allow $1 user_tmp_t:dir list_dir_perms;
2676         files_search_tmp($1)
2677 ')
2678
2679 ########################################
2680 ## <summary>
2681 ##      Create, read, write, and delete user
2682 ##      temporary directories.
2683 ## </summary>
2684 ## <param name="domain">
2685 ##      <summary>
2686 ##      Domain allowed access.
2687 ##      </summary>
2688 ## </param>
2689 #
2690 interface(`userdom_manage_user_tmp_dirs',`
2691         gen_require(`
2692                 type user_tmp_t;
2693         ')
2694
2695         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2696         files_search_tmp($1)
2697 ')
2698
2699 ########################################
2700 ## <summary>
2701 ##      Create, read, write, and delete user
2702 ##      temporary files.
2703 ## </summary>
2704 ## <param name="domain">
2705 ##      <summary>
2706 ##      Domain allowed access.
2707 ##      </summary>
2708 ## </param>
2709 #
2710 interface(`userdom_manage_user_tmp_files',`
2711         gen_require(`
2712                 type user_tmp_t;
2713         ')
2714
2715         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2716         files_search_tmp($1)
2717 ')
2718
2719 ########################################
2720 ## <summary>
2721 ##      Create, read, write, and delete user
2722 ##      temporary symbolic links.
2723 ## </summary>
2724 ## <param name="domain">
2725 ##      <summary>
2726 ##      Domain allowed access.
2727 ##      </summary>
2728 ## </param>
2729 #
2730 interface(`userdom_manage_user_tmp_symlinks',`
2731         gen_require(`
2732                 type user_tmp_t;
2733         ')
2734
2735         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2736         files_search_tmp($1)
2737 ')
2738
2739 ########################################
2740 ## <summary>
2741 ##      Create, read, write, and delete user
2742 ##      temporary named pipes.
2743 ## </summary>
2744 ## <param name="domain">
2745 ##      <summary>
2746 ##      Domain allowed access.
2747 ##      </summary>
2748 ## </param>
2749 #
2750 interface(`userdom_manage_user_tmp_pipes',`
2751         gen_require(`
2752                 type user_tmp_t;
2753         ')
2754
2755         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2756         files_search_tmp($1)
2757 ')
2758
2759 ########################################
2760 ## <summary>
2761 ##      Create, read, write, and delete user
2762 ##      temporary named sockets.
2763 ## </summary>
2764 ## <param name="domain">
2765 ##      <summary>
2766 ##      Domain allowed access.
2767 ##      </summary>
2768 ## </param>
2769 #
2770 interface(`userdom_manage_user_tmp_sockets',`
2771         gen_require(`
2772                 type user_tmp_t;
2773         ')
2774
2775         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2776         files_search_tmp($1)
2777 ')
2778
2779 ########################################
2780 ## <summary>
2781 ##      Create objects in a user temporary directory
2782 ##      with an automatic type transition to
2783 ##      a specified private type.
2784 ## </summary>
2785 ## <param name="domain">
2786 ##      <summary>
2787 ##      Domain allowed access.
2788 ##      </summary>
2789 ## </param>
2790 ## <param name="private_type">
2791 ##      <summary>
2792 ##      The type of the object to create.
2793 ##      </summary>
2794 ## </param>
2795 ## <param name="object_class">
2796 ##      <summary>
2797 ##      The class of the object to be created.
2798 ##      </summary>
2799 ## </param>
2800 #
2801 interface(`userdom_user_tmp_filetrans',`
2802         gen_require(`
2803                 type user_tmp_t;
2804         ')
2805
2806         filetrans_pattern($1, user_tmp_t, $2, $3)
2807         files_search_tmp($1)
2808 ')
2809
2810 ########################################
2811 ## <summary>
2812 ##      Create objects in the temporary directory
2813 ##      with an automatic type transition to
2814 ##      the user temporary type.
2815 ## </summary>
2816 ## <param name="domain">
2817 ##      <summary>
2818 ##      Domain allowed access.
2819 ##      </summary>
2820 ## </param>
2821 ## <param name="object_class">
2822 ##      <summary>
2823 ##      The class of the object to be created.
2824 ##      </summary>
2825 ## </param>
2826 #
2827 interface(`userdom_tmp_filetrans_user_tmp',`
2828         gen_require(`
2829                 type user_tmp_t;
2830         ')
2831
2832         files_tmp_filetrans($1, user_tmp_t, $2)
2833 ')
2834
2835 ########################################
2836 ## <summary>
2837 ##      Read user tmpfs files.
2838 ## </summary>
2839 ## <param name="domain">
2840 ##      <summary>
2841 ##      Domain allowed access.
2842 ##      </summary>
2843 ## </param>
2844 #
2845 interface(`userdom_read_user_tmpfs_files',`
2846         gen_require(`
2847                 type user_tmpfs_t;
2848         ')
2849
2850         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2851         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2852         allow $1 user_tmpfs_t:dir list_dir_perms;
2853         fs_search_tmpfs($1)
2854 ')
2855
2856 ########################################
2857 ## <summary>
2858 ##      Read/Write user tmpfs files.
2859 ## </summary>
2860 ## <param name="domain">
2861 ##      <summary>
2862 ##      Domain allowed access.
2863 ##      </summary>
2864 ## </param>
2865 #
2866 interface(`userdom_rw_user_tmpfs_files',`
2867         gen_require(`
2868                 type user_tmpfs_t;
2869         ')
2870
2871         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2872         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2873         allow $1 user_tmpfs_t:dir list_dir_perms;
2874         fs_search_tmpfs($1)
2875 ')
2876
2877 ########################################
2878 ## <summary>
2879 ##      Get the attributes of a user domain tty.
2880 ## </summary>
2881 ## <param name="domain">
2882 ##      <summary>
2883 ##      Domain allowed access.
2884 ##      </summary>
2885 ## </param>
2886 #
2887 interface(`userdom_getattr_user_ttys',`
2888         gen_require(`
2889                 type user_tty_device_t;
2890         ')
2891
2892         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2893 ')
2894
2895 ########################################
2896 ## <summary>
2897 ##      Do not audit attempts to get the attributes of a user domain tty.
2898 ## </summary>
2899 ## <param name="domain">
2900 ##      <summary>
2901 ##      Domain to not audit.
2902 ##      </summary>
2903 ## </param>
2904 #
2905 interface(`userdom_dontaudit_getattr_user_ttys',`
2906         gen_require(`
2907                 type user_tty_device_t;
2908         ')
2909
2910         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2911 ')
2912
2913 ########################################
2914 ## <summary>
2915 ##      Set the attributes of a user domain tty.
2916 ## </summary>
2917 ## <param name="domain">
2918 ##      <summary>
2919 ##      Domain allowed access.
2920 ##      </summary>
2921 ## </param>
2922 #
2923 interface(`userdom_setattr_user_ttys',`
2924         gen_require(`
2925                 type user_tty_device_t;
2926         ')
2927
2928         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2929 ')
2930
2931 ########################################
2932 ## <summary>
2933 ##      Do not audit attempts to set the attributes of a user domain tty.
2934 ## </summary>
2935 ## <param name="domain">
2936 ##      <summary>
2937 ##      Domain to not audit.
2938 ##      </summary>
2939 ## </param>
2940 #
2941 interface(`userdom_dontaudit_setattr_user_ttys',`
2942         gen_require(`
2943                 type user_tty_device_t;
2944         ')
2945
2946         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2947 ')
2948
2949 ########################################
2950 ## <summary>
2951 ##      Read and write a user domain tty.
2952 ## </summary>
2953 ## <param name="domain">
2954 ##      <summary>
2955 ##      Domain allowed access.
2956 ##      </summary>
2957 ## </param>
2958 #
2959 interface(`userdom_use_user_ttys',`
2960         gen_require(`
2961                 type user_tty_device_t;
2962         ')
2963
2964         allow $1 user_tty_device_t:chr_file rw_term_perms;
2965 ')
2966
2967 ########################################
2968 ## <summary>
2969 ##      Read and write a inherited user domain tty.
2970 ## </summary>
2971 ## <param name="domain">
2972 ##      <summary>
2973 ##      Domain allowed access.
2974 ##      </summary>
2975 ## </param>
2976 #
2977 interface(`userdom_use_inherited_user_ttys',`
2978         gen_require(`
2979                 type user_tty_device_t;
2980         ')
2981
2982         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2983 ')
2984
2985 ########################################
2986 ## <summary>
2987 ##      Read and write a user domain pty.
2988 ## </summary>
2989 ## <param name="domain">
2990 ##      <summary>
2991 ##      Domain allowed access.
2992 ##      </summary>
2993 ## </param>
2994 #
2995 interface(`userdom_use_user_ptys',`
2996         gen_require(`
2997                 type user_devpts_t;
2998         ')
2999
3000         allow $1 user_devpts_t:chr_file rw_term_perms;
3001 ')
3002
3003 ########################################
3004 ## <summary>
3005 ##      Read and write a inherited user domain pty.
3006 ## </summary>
3007 ## <param name="domain">
3008 ##      <summary>
3009 ##      Domain allowed access.
3010 ##      </summary>
3011 ## </param>
3012 #
3013 interface(`userdom_use_inherited_user_ptys',`
3014         gen_require(`
3015                 type user_devpts_t;
3016         ')
3017
3018         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3019 ')
3020
3021 ########################################
3022 ## <summary>
3023 ##      Read and write a inherited user TTYs and PTYs.
3024 ## </summary>
3025 ## <desc>
3026 ##      <p>
3027 ##      Allow the specified domain to read and write inherited user
3028 ##      TTYs and PTYs. This will allow the domain to
3029 ##      interact with the user via the terminal. Typically
3030 ##      all interactive applications will require this
3031 ##      access.
3032 ##      </p>
3033 ## </desc>
3034 ## <param name="domain">
3035 ##      <summary>
3036 ##      Domain allowed access.
3037 ##      </summary>
3038 ## </param>
3039 ## <infoflow type="both" weight="10"/>
3040 #
3041 interface(`userdom_use_inherited_user_terminals',`
3042         gen_require(`
3043                 type user_tty_device_t, user_devpts_t;
3044         ')
3045
3046         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3047         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3048 ')
3049
3050 #######################################
3051 ## <summary>
3052 ##  Allow attempts to read and write
3053 ##  a user domain tty and pty.
3054 ## </summary>
3055 ## <param name="domain">
3056 ##  <summary>
3057 ##  Domain to not audit.
3058 ##  </summary>
3059 ## </param>
3060 #
3061 interface(`userdom_use_user_terminals',`
3062     gen_require(`
3063         type user_tty_device_t, user_devpts_t;
3064     ')
3065
3066     allow $1 user_tty_device_t:chr_file rw_term_perms;
3067     allow $1 user_devpts_t:chr_file rw_term_perms;
3068 ')
3069
3070 ########################################
3071 ## <summary>
3072 ##      Do not audit attempts to read and write
3073 ##      a user domain tty and pty.
3074 ## </summary>
3075 ## <param name="domain">
3076 ##      <summary>
3077 ##      Domain to not audit.
3078 ##      </summary>
3079 ## </param>
3080 #
3081 interface(`userdom_dontaudit_use_user_terminals',`
3082         gen_require(`
3083                 type user_tty_device_t, user_devpts_t;
3084         ')
3085
3086         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3087         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3088 ')
3089
3090 ########################################
3091 ## <summary>
3092 ##      Execute a shell in all user domains.  This
3093 ##      is an explicit transition, requiring the
3094 ##      caller to use setexeccon().
3095 ## </summary>
3096 ## <param name="domain">
3097 ##      <summary>
3098 ##      Domain allowed to transition.
3099 ##      </summary>
3100 ## </param>
3101 #
3102 interface(`userdom_spec_domtrans_all_users',`
3103         gen_require(`
3104                 attribute userdomain;
3105         ')
3106
3107         corecmd_shell_spec_domtrans($1, userdomain)
3108         allow userdomain $1:fd use;
3109         allow userdomain $1:fifo_file rw_file_perms;
3110         allow userdomain $1:process sigchld;
3111 ')
3112
3113 ########################################
3114 ## <summary>
3115 ##      Execute an Xserver session in all unprivileged user domains.  This
3116 ##      is an explicit transition, requiring the
3117 ##      caller to use setexeccon().
3118 ## </summary>
3119 ## <param name="domain">
3120 ##      <summary>
3121 ##      Domain allowed to transition.
3122 ##      </summary>
3123 ## </param>
3124 #
3125 interface(`userdom_xsession_spec_domtrans_all_users',`
3126         gen_require(`
3127                 attribute userdomain;
3128         ')
3129
3130         xserver_xsession_spec_domtrans($1, userdomain)
3131         allow userdomain $1:fd use;
3132         allow userdomain $1:fifo_file rw_file_perms;
3133         allow userdomain $1:process sigchld;
3134 ')
3135
3136 ########################################
3137 ## <summary>
3138 ##      Execute a shell in all unprivileged user domains.  This
3139 ##      is an explicit transition, requiring the
3140 ##      caller to use setexeccon().
3141 ## </summary>
3142 ## <param name="domain">
3143 ##      <summary>
3144 ##      Domain allowed to transition.
3145 ##      </summary>
3146 ## </param>
3147 #
3148 interface(`userdom_spec_domtrans_unpriv_users',`
3149         gen_require(`
3150                 attribute unpriv_userdomain;
3151         ')
3152
3153         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3154         allow unpriv_userdomain $1:fd use;
3155         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3156         allow unpriv_userdomain $1:process sigchld;
3157 ')
3158
3159 ########################################
3160 ## <summary>
3161 ##      Execute an Xserver session in all unprivileged user domains.  This
3162 ##      is an explicit transition, requiring the
3163 ##      caller to use setexeccon().
3164 ## </summary>
3165 ## <param name="domain">
3166 ##      <summary>
3167 ##      Domain allowed to transition.
3168 ##      </summary>
3169 ## </param>
3170 #
3171 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3172         gen_require(`
3173                 attribute unpriv_userdomain;
3174         ')
3175
3176         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3177         allow unpriv_userdomain $1:fd use;
3178         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3179         allow unpriv_userdomain $1:process sigchld;
3180 ')
3181
3182 ########################################
3183 ## <summary>
3184 ##      Manage unpriviledged user SysV sempaphores.
3185 ## </summary>
3186 ## <param name="domain">
3187 ##      <summary>
3188 ##      Domain allowed access.
3189 ##      </summary>
3190 ## </param>
3191 #
3192 interface(`userdom_manage_unpriv_user_semaphores',`
3193         gen_require(`
3194                 attribute unpriv_userdomain;
3195         ')
3196
3197         allow $1 unpriv_userdomain:sem create_sem_perms;
3198 ')
3199
3200 ########################################
3201 ## <summary>
3202 ##      Manage unpriviledged user SysV shared
3203 ##      memory segments.
3204 ## </summary>
3205 ## <param name="domain">
3206 ##      <summary>
3207 ##      Domain allowed access.
3208 ##      </summary>
3209 ## </param>
3210 #
3211 interface(`userdom_manage_unpriv_user_shared_mem',`
3212         gen_require(`
3213                 attribute unpriv_userdomain;
3214         ')
3215
3216         allow $1 unpriv_userdomain:shm create_shm_perms;
3217 ')
3218
3219 ########################################
3220 ## <summary>
3221 ##      Execute bin_t in the unprivileged user domains. This
3222 ##      is an explicit transition, requiring the
3223 ##      caller to use setexeccon().
3224 ## </summary>
3225 ## <param name="domain">
3226 ##      <summary>
3227 ##      Domain allowed to transition.
3228 ##      </summary>
3229 ## </param>
3230 #
3231 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3232         gen_require(`
3233                 attribute unpriv_userdomain;
3234         ')
3235
3236         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3237         allow unpriv_userdomain $1:fd use;
3238         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3239         allow unpriv_userdomain $1:process sigchld;
3240 ')
3241
3242 ########################################
3243 ## <summary>
3244 ##      Execute all entrypoint files in unprivileged user
3245 ##      domains. This is an explicit transition, requiring the
3246 ##      caller to use setexeccon().
3247 ## </summary>
3248 ## <param name="domain">
3249 ##      <summary>
3250 ##      Domain allowed access.
3251 ##      </summary>
3252 ## </param>
3253 #
3254 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3255         gen_require(`
3256                 attribute unpriv_userdomain;
3257         ')
3258
3259         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3260         allow unpriv_userdomain $1:fd use;
3261         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3262         allow unpriv_userdomain $1:process sigchld;
3263 ')
3264
3265 ########################################
3266 ## <summary>
3267 ##      Search users home directories.
3268 ## </summary>
3269 ## <param name="domain">
3270 ##      <summary>
3271 ##      Domain allowed access.
3272 ##      </summary>
3273 ## </param>
3274 #
3275 interface(`userdom_search_user_home_content',`
3276         gen_require(`
3277                 type user_home_dir_t;
3278                 attribute user_home_type;
3279         ')
3280
3281         files_list_home($1)
3282         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3283         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3284 ')
3285
3286 ########################################
3287 ## <summary>
3288 ##      Send general signals to unprivileged user domains.
3289 ## </summary>
3290 ## <param name="domain">
3291 ##      <summary>
3292 ##      Domain allowed access.
3293 ##      </summary>
3294 ## </param>
3295 #
3296 interface(`userdom_signal_unpriv_users',`
3297         gen_require(`
3298                 attribute unpriv_userdomain;
3299         ')
3300
3301         allow $1 unpriv_userdomain:process signal;
3302 ')
3303
3304 ########################################
3305 ## <summary>
3306 ##      Inherit the file descriptors from unprivileged user domains.
3307 ## </summary>
3308 ## <param name="domain">
3309 ##      <summary>
3310 ##      Domain allowed access.
3311 ##      </summary>
3312 ## </param>
3313 #
3314 interface(`userdom_use_unpriv_users_fds',`
3315         gen_require(`
3316                 attribute unpriv_userdomain;
3317         ')
3318
3319         allow $1 unpriv_userdomain:fd use;
3320 ')
3321
3322 ########################################
3323 ## <summary>
3324 ##      Do not audit attempts to inherit the file descriptors
3325 ##      from unprivileged user domains.
3326 ## </summary>
3327 ## <desc>
3328 ##      <p>
3329 ##      Do not audit attempts to inherit the file descriptors
3330 ##      from unprivileged user domains. This will supress
3331 ##      SELinux denial messages when the specified domain is denied
3332 ##      the permission to inherit these file descriptors.
3333 ##      </p>
3334 ## </desc>
3335 ## <param name="domain">
3336 ##      <summary>
3337 ##      Domain to not audit.
3338 ##      </summary>
3339 ## </param>
3340 ## <infoflow type="none"/>
3341 #
3342 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3343         gen_require(`
3344                 attribute unpriv_userdomain;
3345         ')
3346
3347         dontaudit $1 unpriv_userdomain:fd use;
3348 ')
3349
3350 ########################################
3351 ## <summary>
3352 ##      Do not audit attempts to use user ptys.
3353 ## </summary>
3354 ## <param name="domain">
3355 ##      <summary>
3356 ##      Domain to not audit.
3357 ##      </summary>
3358 ## </param>
3359 #
3360 interface(`userdom_dontaudit_use_user_ptys',`
3361         gen_require(`
3362                 type user_devpts_t;
3363         ')
3364
3365         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3366 ')
3367
3368 ########################################
3369 ## <summary>
3370 ##      Relabel files to unprivileged user pty types.
3371 ## </summary>
3372 ## <param name="domain">
3373 ##      <summary>
3374 ##      Domain allowed access.
3375 ##      </summary>
3376 ## </param>
3377 #
3378 interface(`userdom_relabelto_user_ptys',`
3379         gen_require(`
3380                 type user_devpts_t;
3381         ')
3382
3383         allow $1 user_devpts_t:chr_file relabelto;
3384 ')
3385
3386 ########################################
3387 ## <summary>
3388 ##      Do not audit attempts to relabel files from
3389 ##      user pty types.
3390 ## </summary>
3391 ## <param name="domain">
3392 ##      <summary>
3393 ##      Domain to not audit.
3394 ##      </summary>
3395 ## </param>
3396 #
3397 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3398         gen_require(`
3399                 type user_devpts_t;
3400         ')
3401
3402         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3403 ')
3404
3405 ########################################
3406 ## <summary>
3407 ##      Write all users files in /tmp
3408 ## </summary>
3409 ## <param name="domain">
3410 ##      <summary>
3411 ##      Domain allowed access.
3412 ##      </summary>
3413 ## </param>
3414 #
3415 interface(`userdom_write_user_tmp_files',`
3416         gen_require(`
3417                 type user_tmp_t;
3418         ')
3419
3420         write_files_pattern($1, user_tmp_t, user_tmp_t)
3421 ')
3422
3423 ########################################
3424 ## <summary>
3425 ##      Do not audit attempts to write users
3426 ##      temporary files.
3427 ## </summary>
3428 ## <param name="domain">
3429 ##      <summary>
3430 ##      Domain to not audit.
3431 ##      </summary>
3432 ## </param>
3433 #
3434 interface(`userdom_dontaudit_write_user_tmp_files',`
3435         gen_require(`
3436                 type user_tmp_t;
3437         ')
3438
3439         dontaudit $1 user_tmp_t:file write;
3440 ')
3441
3442 ########################################
3443 ## <summary>
3444 ##      Do not audit attempts to read/write users
3445 ##      temporary fifo files.
3446 ## </summary>
3447 ## <param name="domain">
3448 ##      <summary>
3449 ##      Domain to not audit.
3450 ##      </summary>
3451 ## </param>
3452 #
3453 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3454         gen_require(`
3455                 type user_tmp_t;
3456         ')
3457
3458         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3459 ')
3460
3461 ########################################
3462 ## <summary>
3463 ##      Do not audit attempts to use user ttys.
3464 ## </summary>
3465 ## <param name="domain">
3466 ##      <summary>
3467 ##      Domain to not audit.
3468 ##      </summary>
3469 ## </param>
3470 #
3471 interface(`userdom_dontaudit_use_user_ttys',`
3472         gen_require(`
3473                 type user_tty_device_t;
3474         ')
3475
3476         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3477 ')
3478
3479 ########################################
3480 ## <summary>
3481 ##      Read the process state of all user domains.
3482 ## </summary>
3483 ## <param name="domain">
3484 ##      <summary>
3485 ##      Domain allowed access.
3486 ##      </summary>
3487 ## </param>
3488 #
3489 interface(`userdom_read_all_users_state',`
3490         gen_require(`
3491                 attribute userdomain;
3492         ')
3493
3494         read_files_pattern($1, userdomain, userdomain)
3495         read_lnk_files_pattern($1,userdomain,userdomain)
3496         kernel_search_proc($1)
3497 ')
3498
3499 ########################################
3500 ## <summary>
3501 ##      Get the attributes of all user domains.
3502 ## </summary>
3503 ## <param name="domain">
3504 ##      <summary>
3505 ##      Domain allowed access.
3506 ##      </summary>
3507 ## </param>
3508 #
3509 interface(`userdom_getattr_all_users',`
3510         gen_require(`
3511                 attribute userdomain;
3512         ')
3513
3514         allow $1 userdomain:process getattr;
3515 ')
3516
3517 ########################################
3518 ## <summary>
3519 ##      Inherit the file descriptors from all user domains
3520 ## </summary>
3521 ## <param name="domain">
3522 ##      <summary>
3523 ##      Domain allowed access.
3524 ##      </summary>
3525 ## </param>
3526 #
3527 interface(`userdom_use_all_users_fds',`
3528         gen_require(`
3529                 attribute userdomain;
3530         ')
3531
3532         allow $1 userdomain:fd use;
3533 ')
3534
3535 ########################################
3536 ## <summary>
3537 ##      Do not audit attempts to inherit the file
3538 ##      descriptors from any user domains.
3539 ## </summary>
3540 ## <param name="domain">
3541 ##      <summary>
3542 ##      Domain to not audit.
3543 ##      </summary>
3544 ## </param>
3545 #
3546 interface(`userdom_dontaudit_use_all_users_fds',`
3547         gen_require(`
3548                 attribute userdomain;
3549         ')
3550
3551         dontaudit $1 userdomain:fd use;
3552 ')
3553
3554 ########################################
3555 ## <summary>
3556 ##      Send general signals to all user domains.
3557 ## </summary>
3558 ## <param name="domain">
3559 ##      <summary>
3560 ##      Domain allowed access.
3561 ##      </summary>
3562 ## </param>
3563 #
3564 interface(`userdom_signal_all_users',`
3565         gen_require(`
3566                 attribute userdomain;
3567         ')
3568
3569         allow $1 userdomain:process signal;
3570 ')
3571
3572 ########################################
3573 ## <summary>
3574 ##      Send kill signals to all user domains.
3575 ## </summary>
3576 ## <param name="domain">
3577 ##      <summary>
3578 ##      Domain allowed access.
3579 ##      </summary>
3580 ## </param>
3581 #
3582 interface(`userdom_kill_all_users',`
3583         gen_require(`
3584                 attribute userdomain;
3585         ')
3586
3587         allow $1 userdomain:process sigkill;
3588 ')
3589
3590 ########################################
3591 ## <summary>
3592 ##      Send a SIGCHLD signal to all user domains.
3593 ## </summary>
3594 ## <param name="domain">
3595 ##      <summary>
3596 ##      Domain allowed access.
3597 ##      </summary>
3598 ## </param>
3599 #
3600 interface(`userdom_sigchld_all_users',`
3601         gen_require(`
3602                 attribute userdomain;
3603         ')
3604
3605         allow $1 userdomain:process sigchld;
3606 ')
3607
3608 ########################################
3609 ## <summary>
3610 ##      Create keys for all user domains.
3611 ## </summary>
3612 ## <param name="domain">
3613 ##      <summary>
3614 ##      Domain allowed access.
3615 ##      </summary>
3616 ## </param>
3617 #
3618 interface(`userdom_create_all_users_keys',`
3619         gen_require(`
3620                 attribute userdomain;
3621         ')
3622
3623         allow $1 userdomain:key create;
3624 ')
3625
3626 ########################################
3627 ## <summary>
3628 ##      Send a dbus message to all user domains.
3629 ## </summary>
3630 ## <param name="domain">
3631 ##      <summary>
3632 ##      Domain allowed access.
3633 ##      </summary>
3634 ## </param>
3635 #
3636 interface(`userdom_dbus_send_all_users',`
3637         gen_require(`
3638                 attribute userdomain;
3639                 class dbus send_msg;
3640         ')
3641
3642         allow $1 userdomain:dbus send_msg;
3643 ')
3644
3645 ########################################
3646 ## <summary>
3647 ##      Allow apps to set rlimits on userdomain
3648 ## </summary>
3649 ## <param name="domain">
3650 ##      <summary>
3651 ##      Domain allowed access.
3652 ##      </summary>
3653 ## </param>
3654 #
3655 interface(`userdom_set_rlimitnh',`
3656         gen_require(`
3657                 attribute userdomain;
3658         ')
3659
3660         allow $1 userdomain:process rlimitinh;
3661 ')
3662
3663 ########################################
3664 ## <summary>
3665 ##      Define this type as a Allow apps to set rlimits on userdomain
3666 ## </summary>
3667 ## <param name="domain">
3668 ##      <summary>
3669 ##      Domain allowed access.
3670 ##      </summary>
3671 ## </param>
3672 ## <param name="userdomain_prefix">
3673 ##      <summary>
3674 ##      The prefix of the user domain (e.g., user
3675 ##      is the prefix for user_t).
3676 ## </summary>
3677 ## </param>
3678 ## <param name="domain">
3679 ##      <summary>
3680 ##      Domain allowed access.
3681 ##      </summary>
3682 ## </param>
3683 #
3684 template(`userdom_unpriv_usertype',`
3685         gen_require(`
3686                 attribute unpriv_userdomain, userdomain;
3687                 attribute $1_usertype;
3688         ')
3689         typeattribute $2  $1_usertype;
3690         typeattribute $2  unpriv_userdomain;
3691         typeattribute $2  userdomain;
3692
3693         ubac_constrained($2)
3694 ')
3695
3696 ########################################
3697 ## <summary>
3698 ##      Connect to users over an unix stream socket.
3699 ## </summary>
3700 ## <param name="domain">
3701 ##      <summary>
3702 ##      Domain allowed access.
3703 ##      </summary>
3704 ## </param>
3705 #
3706 interface(`userdom_stream_connect',`
3707         gen_require(`
3708                 type user_tmp_t;
3709                 attribute userdomain;
3710         ')
3711
3712         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3713 ')
3714
3715 ########################################
3716 ## <summary>
3717 ##      Ptrace user domains.
3718 ## </summary>
3719 ## <param name="domain">
3720 ##      <summary>
3721 ##      Domain allowed access.
3722 ##      </summary>
3723 ## </param>
3724 #
3725 interface(`userdom_ptrace_all_users',`
3726         gen_require(`
3727                 attribute userdomain;
3728         ')
3729
3730         allow $1 userdomain:process ptrace;
3731 ')
3732
3733 ########################################
3734 ## <summary>
3735 ##      dontaudit Search /root
3736 ## </summary>
3737 ## <param name="domain">
3738 ##      <summary>
3739 ##      Domain to not audit.
3740 ##      </summary>
3741 ## </param>
3742 #
3743 interface(`userdom_dontaudit_search_admin_dir',`
3744         gen_require(`
3745                 type admin_home_t;
3746         ')
3747
3748         dontaudit $1 admin_home_t:dir search_dir_perms;
3749 ')
3750
3751 ########################################
3752 ## <summary>
3753 ##      dontaudit list /root
3754 ## </summary>
3755 ## <param name="domain">
3756 ##      <summary>
3757 ##      Domain to not audit.
3758 ##      </summary>
3759 ## </param>
3760 #
3761 interface(`userdom_dontaudit_list_admin_dir',`
3762         gen_require(`
3763                 type admin_home_t;
3764         ')
3765
3766         dontaudit $1 admin_home_t:dir list_dir_perms;
3767 ')
3768
3769 ########################################
3770 ## <summary>
3771 ##      Allow domain to  list /root
3772 ## </summary>
3773 ## <param name="domain">
3774 ##      <summary>
3775 ##      Domain allowed access.
3776 ##      </summary>
3777 ## </param>
3778 #
3779 interface(`userdom_list_admin_dir',`
3780         gen_require(`
3781                 type admin_home_t;
3782         ')
3783
3784         allow $1 admin_home_t:dir list_dir_perms;
3785 ')
3786
3787 ########################################
3788 ## <summary>
3789 ##      Allow Search /root
3790 ## </summary>
3791 ## <param name="domain">
3792 ##      <summary>
3793 ##      Domain allowed access.
3794 ##      </summary>
3795 ## </param>
3796 #
3797 interface(`userdom_search_admin_dir',`
3798         gen_require(`
3799                 type admin_home_t;
3800         ')
3801
3802         allow $1 admin_home_t:dir search_dir_perms;
3803 ')
3804
3805 ########################################
3806 ## <summary>
3807 ##      RW unpriviledged user SysV sempaphores.
3808 ## </summary>
3809 ## <param name="domain">
3810 ##      <summary>
3811 ##      Domain allowed access.
3812 ##      </summary>
3813 ## </param>
3814 #
3815 interface(`userdom_rw_semaphores',`
3816         gen_require(`
3817                 attribute unpriv_userdomain;
3818         ')
3819
3820         allow $1 unpriv_userdomain:sem rw_sem_perms;
3821 ')
3822
3823 ########################################
3824 ## <summary>
3825 ##      Send a message to unpriv users over a unix domain
3826 ##      datagram socket.
3827 ## </summary>
3828 ## <param name="domain">
3829 ##      <summary>
3830 ##      Domain allowed access.
3831 ##      </summary>
3832 ## </param>
3833 #
3834 interface(`userdom_dgram_send',`
3835         gen_require(`
3836                 attribute unpriv_userdomain;
3837         ')
3838
3839         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3840 ')
3841
3842 ######################################
3843 ## <summary>
3844 ##      Send a message to users over a unix domain
3845 ##      datagram socket.
3846 ## </summary>
3847 ## <param name="domain">
3848 ##      <summary>
3849 ##      Domain allowed access.
3850 ##      </summary>
3851 ## </param>
3852 #
3853 interface(`userdom_users_dgram_send',`
3854         gen_require(`
3855                  attribute userdomain;
3856       ')
3857
3858        allow $1 userdomain:unix_dgram_socket sendto;
3859 ')
3860
3861 #######################################
3862 ## <summary>
3863 ##      Allow execmod on files in homedirectory
3864 ## </summary>
3865 ## <param name="domain">
3866 ##      <summary>
3867 ##      Domain allowed access.
3868 ##      </summary>
3869 ## </param>
3870 ## <rolebase/>
3871 #
3872 interface(`userdom_execmod_user_home_files',`
3873         gen_require(`
3874                 type user_home_type;
3875         ')
3876
3877         allow $1 user_home_type:file execmod;
3878 ')
3879
3880 ########################################
3881 ## <summary>
3882 ##      Read admin home files.
3883 ## </summary>
3884 ## <param name="domain">
3885 ##      <summary>
3886 ##      Domain allowed access.
3887 ##      </summary>
3888 ## </param>
3889 ## <rolecap/>
3890 #
3891 interface(`userdom_read_admin_home_files',`
3892         gen_require(`
3893                 type admin_home_t;
3894         ')
3895
3896         read_files_pattern($1, admin_home_t, admin_home_t)
3897 ')
3898
3899 ########################################
3900 ## <summary>
3901 ##      Execute admin home files.
3902 ## </summary>
3903 ## <param name="domain">
3904 ##      <summary>
3905 ##      Domain allowed access.
3906 ##      </summary>
3907 ## </param>
3908 ## <rolecap/>
3909 #
3910 interface(`userdom_exec_admin_home_files',`
3911         gen_require(`
3912                 type admin_home_t;
3913         ')
3914
3915         exec_files_pattern($1, admin_home_t, admin_home_t)
3916 ')
3917
3918 ########################################
3919 ## <summary>
3920 ##      Append files inherited
3921 ##      in the /root directory.
3922 ## </summary>
3923 ## <param name="domain">
3924 ##      <summary>
3925 ##      Domain allowed access.
3926 ##      </summary>
3927 ## </param>
3928 #
3929 interface(`userdom_inherit_append_admin_home_files',`
3930         gen_require(`
3931                 type admin_home_t;
3932         ')
3933
3934         allow $1 admin_home_t:file { getattr append };
3935 ')
3936
3937
3938 #######################################
3939 ## <summary>
3940 ##      Manage all files/directories in the homedir
3941 ## </summary>
3942 ## <param name="userdomain">
3943 ##      <summary>
3944 ##      The user domain
3945 ##      </summary>
3946 ## </param>
3947 ## <rolebase/>
3948 #
3949 interface(`userdom_manage_user_home_content',`
3950         gen_require(`
3951                 type user_home_dir_t, user_home_t;
3952                 attribute user_home_type;
3953         ')
3954
3955         files_list_home($1)
3956         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3957         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3958         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3959         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3960         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3961         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3962
3963 ')
3964
3965
3966 ########################################
3967 ## <summary>
3968 ##      Create objects in a user home directory
3969 ##      with an automatic type transition to
3970 ##      the user home file type.
3971 ## </summary>
3972 ## <param name="domain">
3973 ##      <summary>
3974 ##      Domain allowed access.
3975 ##      </summary>
3976 ## </param>
3977 ## <param name="object_class">
3978 ##      <summary>
3979 ##      The class of the object to be created.
3980 ##      </summary>
3981 ## </param>
3982 #
3983 interface(`userdom_user_home_dir_filetrans_pattern',`
3984         gen_require(`
3985                 type user_home_dir_t, user_home_t;
3986         ')
3987
3988         type_transition $1 user_home_dir_t:$2 user_home_t;
3989 ')
3990
3991 ########################################
3992 ## <summary>
3993 ##      Create objects in the /root directory
3994 ##      with an automatic type transition to
3995 ##      a specified private type.
3996 ## </summary>
3997 ## <param name="domain">
3998 ##      <summary>
3999 ##      Domain allowed access.
4000 ##      </summary>
4001 ## </param>
4002 ## <param name="private_type">
4003 ##      <summary>
4004 ##      The type of the object to create.
4005 ##      </summary>
4006 ## </param>
4007 ## <param name="object_class">
4008 ##      <summary>
4009 ##      The class of the object to be created.
4010 ##      </summary>
4011 ## </param>
4012 #
4013 interface(`userdom_admin_home_dir_filetrans',`
4014         gen_require(`
4015                 type admin_home_t;
4016         ')
4017
4018         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4019 ')
4020
4021 ########################################
4022 ## <summary>
4023 ##      Send signull to unprivileged user domains.
4024 ## </summary>
4025 ## <param name="domain">
4026 ##      <summary>
4027 ##      Domain allowed access.
4028 ##      </summary>
4029 ## </param>
4030 #
4031 interface(`userdom_signull_unpriv_users',`
4032         gen_require(`
4033                 attribute unpriv_userdomain;
4034         ')
4035
4036         allow $1 unpriv_userdomain:process signull;
4037 ')
4038
4039 ########################################
4040 ## <summary>
4041 ##      Write all users files in /tmp
4042 ## </summary>
4043 ## <param name="domain">
4044 ##      <summary>
4045 ##      Domain allowed access.
4046 ##      </summary>
4047 ## </param>
4048 #
4049 interface(`userdom_write_user_tmp_dirs',`
4050         gen_require(`
4051                 type user_tmp_t;
4052         ')
4053
4054         write_files_pattern($1, user_tmp_t, user_tmp_t)
4055 ')
4056
4057 ########################################
4058 ## <summary>
4059 ##      Manage keys for all user domains.
4060 ## </summary>
4061 ## <param name="domain">
4062 ##      <summary>
4063 ##      Domain allowed access.
4064 ##      </summary>
4065 ## </param>
4066 #
4067 interface(`userdom_manage_all_users_keys',`
4068         gen_require(`
4069                 attribute userdomain;
4070         ')
4071
4072         allow $1 userdomain:key manage_key_perms;
4073 ')
4074
4075
4076 ########################################
4077 ## <summary>
4078 ##      Do not audit attempts to read and write
4079 ##      unserdomain stream.
4080 ## </summary>
4081 ## <param name="domain">
4082 ##      <summary>
4083 ##      Domain to not audit.
4084 ##      </summary>
4085 ## </param>
4086 #
4087 interface(`userdom_dontaudit_rw_stream',`
4088         gen_require(`
4089                 attribute userdomain;
4090         ')
4091
4092         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4093 ')
4094
4095 ########################################
4096 ## <summary>
4097 ##      Do not audit attempts to read and write
4098 ##      unserdomain datagram socket.
4099 ## </summary>
4100 ## <param name="domain">
4101 ##      <summary>
4102 ##      Domain to not audit.
4103 ##      </summary>
4104 ## </param>
4105 #
4106 interface(`userdom_dontaudit_rw_dgram_socket',`
4107         gen_require(`
4108                 attribute userdomain;
4109         ')
4110
4111         dontaudit $1 userdomain:unix_dgram_socket { read write };
4112 ')
4113
4114 ########################################
4115 ## <summary>
4116 ##      Append files
4117 ##      in a user home subdirectory.
4118 ## </summary>
4119 ## <param name="domain">
4120 ##      <summary>
4121 ##      Domain allowed access.
4122 ##      </summary>
4123 ## </param>
4124 #
4125 interface(`userdom_append_user_home_content_files',`
4126         gen_require(`
4127                 type user_home_dir_t, user_home_t;
4128         ')
4129
4130         append_files_pattern($1, user_home_t, user_home_t)
4131         allow $1 user_home_dir_t:dir search_dir_perms;
4132         files_search_home($1)
4133 ')
4134
4135 ########################################
4136 ## <summary>
4137 ##      Read files inherited
4138 ##      in a user home subdirectory.
4139 ## </summary>
4140 ## <param name="domain">
4141 ##      <summary>
4142 ##      Domain allowed access.
4143 ##      </summary>
4144 ## </param>
4145 #
4146 interface(`userdom_read_inherited_user_home_content_files',`
4147         gen_require(`
4148                 attribute user_home_type;
4149         ')
4150
4151         allow $1 user_home_type:file { getattr read };
4152 ')
4153
4154 ########################################
4155 ## <summary>
4156 ##      Append files inherited
4157 ##      in a user home subdirectory.
4158 ## </summary>
4159 ## <param name="domain">
4160 ##      <summary>
4161 ##      Domain allowed access.
4162 ##      </summary>
4163 ## </param>
4164 #
4165 interface(`userdom_inherit_append_user_home_content_files',`
4166         gen_require(`
4167                 type user_home_t;
4168         ')
4169
4170         allow $1 user_home_t:file { getattr append };
4171 ')
4172
4173 ########################################
4174 ## <summary>
4175 ##      Append files inherited
4176 ##      in a user tmp files.
4177 ## </summary>
4178 ## <param name="domain">
4179 ##      <summary>
4180 ##      Domain allowed access.
4181 ##      </summary>
4182 ## </param>
4183 #
4184 interface(`userdom_inherit_append_user_tmp_files',`
4185         gen_require(`
4186                 type user_tmp_t;
4187         ')
4188
4189         allow $1 user_tmp_t:file { getattr append };
4190 ')
4191
4192 ######################################
4193 ## <summary>
4194 ##      Read audio files in the users homedir.
4195 ## </summary>
4196 ## <param name="domain">
4197 ##      <summary>
4198 ##      Domain allowed access.
4199 ##      </summary>
4200 ## </param>
4201 ## <rolecap/>
4202 #
4203 interface(`userdom_read_home_audio_files',`
4204         gen_require(`
4205                 type audio_home_t;
4206         ')
4207
4208         userdom_search_user_home_dirs($1)
4209         allow $1 audio_home_t:dir list_dir_perms;
4210         read_files_pattern($1, audio_home_t, audio_home_t)
4211         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4212 ')
4213
4214 ########################################
4215 ## <summary>
4216 ##      Do not audit attempts to write all user home content files.
4217 ## </summary>
4218 ## <param name="domain">
4219 ##      <summary>
4220 ##      Domain to not audit.
4221 ##      </summary>
4222 ## </param>
4223 #
4224 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4225         gen_require(`
4226                 attribute user_home_type;
4227         ')
4228
4229         dontaudit $1 user_home_type:file write_file_perms;
4230 ')
4231
4232 ########################################
4233 ## <summary>
4234 ##      Do not audit attempts to write all user tmp content files.
4235 ## </summary>
4236 ## <param name="domain">
4237 ##      <summary>
4238 ##      Domain to not audit.
4239 ##      </summary>
4240 ## </param>
4241 #
4242 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4243         gen_require(`
4244                 attribute user_tmp_type;
4245         ')
4246
4247         dontaudit $1 user_tmp_type:file write_file_perms;
4248 ')
4249
4250 ########################################
4251 ## <summary>
4252 ##      Manage all user temporary content.
4253 ## </summary>
4254 ## <param name="domain">
4255 ##      <summary>
4256 ##      Domain allowed access.
4257 ##      </summary>
4258 ## </param>
4259 #
4260 interface(`userdom_manage_all_user_tmp_content',`
4261         gen_require(`
4262                 attribute user_tmp_type;
4263         ')
4264
4265         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4266         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4267         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4268         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4269         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4270         files_search_tmp($1)
4271 ')
4272
4273 ########################################
4274 ## <summary>
4275 ##      List all user temporary content.
4276 ## </summary>
4277 ## <param name="domain">
4278 ##      <summary>
4279 ##      Domain allowed access.
4280 ##      </summary>
4281 ## </param>
4282 #
4283 interface(`userdom_list_all_user_tmp_content',`
4284         gen_require(`
4285                 attribute user_tmp_type;
4286         ')
4287
4288         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4289         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4290         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4291         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4292         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4293         files_search_var($1)
4294         files_search_tmp($1)
4295 ')
4296
4297 ########################################
4298 ## <summary>
4299 ##      Manage all user tmpfs content.
4300 ## </summary>
4301 ## <param name="domain">
4302 ##      <summary>
4303 ##      Domain allowed access.
4304 ##      </summary>
4305 ## </param>
4306 #
4307 interface(`userdom_manage_all_user_tmpfs_content',`
4308         gen_require(`
4309                 attribute user_tmpfs_type;
4310         ')
4311
4312         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4313         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4314         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4315         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4316         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4317         fs_search_tmpfs($1)
4318 ')
4319
4320 ########################################
4321 ## <summary>
4322 ##      Delete all user temporary content.
4323 ## </summary>
4324 ## <param name="domain">
4325 ##      <summary>
4326 ##      Domain allowed access.
4327 ##      </summary>
4328 ## </param>
4329 #
4330 interface(`userdom_delete_all_user_tmp_content',`
4331         gen_require(`
4332                 attribute user_tmp_type;
4333         ')
4334
4335         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4336         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4337         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4338         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4339         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4340         # /var/tmp
4341         files_search_var($1)
4342         files_delete_tmp_dir_entry($1)
4343 ')
4344
4345 ########################################
4346 ## <summary>
4347 ##      Read system SSL certificates in the users homedir.
4348 ## </summary>
4349 ## <param name="domain">
4350 ##      <summary>
4351 ##      Domain allowed access.
4352 ##      </summary>
4353 ## </param>
4354 #
4355 interface(`userdom_read_home_certs',`
4356         gen_require(`
4357                 type home_cert_t;
4358         ')
4359
4360         userdom_search_user_home_content($1)
4361         allow $1 home_cert_t:dir list_dir_perms;
4362         read_files_pattern($1, home_cert_t, home_cert_t)
4363         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4364 ')
4365
4366 #######################################
4367 ## <summary>
4368 ##  Dontaudit Write system SSL certificates in the users homedir.
4369 ## </summary>
4370 ## <param name="domain">
4371 ##  <summary>
4372 ##      Domain to not audit.
4373 ##  </summary>
4374 ## </param>
4375 #
4376 interface(`userdom_dontaudit_write_home_certs',`
4377     gen_require(`
4378         type home_cert_t;
4379     ')
4380
4381     dontaudit $1 home_cert_t:file write;
4382 ')
4383
4384 ########################################
4385 ## <summary>
4386 ##      dontaudit Search getatrr /root files
4387 ## </summary>
4388 ## <param name="domain">
4389 ##      <summary>
4390 ##      Domain to not audit.
4391 ##      </summary>
4392 ## </param>
4393 #
4394 interface(`userdom_dontaudit_getattr_admin_home_files',`
4395         gen_require(`
4396                 type admin_home_t;
4397         ')
4398
4399         dontaudit $1 admin_home_t:file getattr;
4400 ')
4401
4402 ########################################
4403 ## <summary>
4404 ##      dontaudit read /root lnk files
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain to not audit.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4413         gen_require(`
4414                 type admin_home_t;
4415         ')
4416
4417         dontaudit $1 admin_home_t:lnk_file read;
4418 ')
4419
4420 ########################################
4421 ## <summary>
4422 ##      dontaudit read /root files
4423 ## </summary>
4424 ## <param name="domain">
4425 ##      <summary>
4426 ##      Domain to not audit.
4427 ##      </summary>
4428 ## </param>
4429 #
4430 interface(`userdom_dontaudit_read_admin_home_files',`
4431         gen_require(`
4432                 type admin_home_t;
4433         ')
4434
4435         dontaudit $1 admin_home_t:file read_file_perms;
4436 ')
4437
4438 ########################################
4439 ## <summary>
4440 ##      Create, read, write, and delete user
4441 ##      temporary chr files.
4442 ## </summary>
4443 ## <param name="domain">
4444 ##      <summary>
4445 ##      Domain allowed access.
4446 ##      </summary>
4447 ## </param>
4448 #
4449 interface(`userdom_manage_user_tmp_chr_files',`
4450         gen_require(`
4451                 type user_tmp_t;
4452         ')
4453
4454         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4455         files_search_tmp($1)
4456 ')
4457
4458 ########################################
4459 ## <summary>
4460 ##      Create, read, write, and delete user
4461 ##      temporary blk files.
4462 ## </summary>
4463 ## <param name="domain">
4464 ##      <summary>
4465 ##      Domain allowed access.
4466 ##      </summary>
4467 ## </param>
4468 #
4469 interface(`userdom_manage_user_tmp_blk_files',`
4470         gen_require(`
4471                 type user_tmp_t;
4472         ')
4473
4474         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4475         files_search_tmp($1)
4476 ')
4477
4478 ########################################
4479 ## <summary>
4480 ##      Dontaudit attempt to set attributes on  user temporary directories.
4481 ## </summary>
4482 ## <param name="domain">
4483 ##      <summary>
4484 ##      Domain to not audit.
4485 ##      </summary>
4486 ## </param>
4487 #
4488 interface(`userdom_dontaudit_setattr_user_tmp',`
4489         gen_require(`
4490                 type user_tmp_t;
4491         ')
4492
4493         dontaudit $1 user_tmp_t:dir setattr;
4494 ')
4495
4496 ########################################
4497 ## <summary>
4498 ##      Write all inherited users files in /tmp
4499 ## </summary>
4500 ## <param name="domain">
4501 ##      <summary>
4502 ##      Domain allowed access.
4503 ##      </summary>
4504 ## </param>
4505 #
4506 interface(`userdom_write_inherited_user_tmp_files',`
4507         gen_require(`
4508                 type user_tmp_t;
4509         ')
4510
4511         allow $1 user_tmp_t:file write;
4512 ')
4513
4514 ########################################
4515 ## <summary>
4516 ##      Delete all users files in /tmp
4517 ## </summary>
4518 ## <param name="domain">
4519 ##      <summary>
4520 ##      Domain allowed access.
4521 ##      </summary>
4522 ## </param>
4523 #
4524 interface(`userdom_delete_user_tmp_files',`
4525         gen_require(`
4526                 type user_tmp_t;
4527         ')
4528
4529         allow $1 user_tmp_t:file delete_file_perms;
4530 ')
4531
4532 ########################################
4533 ## <summary>
4534 ##      Delete user tmpfs files.
4535 ## </summary>
4536 ## <param name="domain">
4537 ##      <summary>
4538 ##      Domain allowed access.
4539 ##      </summary>
4540 ## </param>
4541 #
4542 interface(`userdom_delete_user_tmpfs_files',`
4543         gen_require(`
4544                 type user_tmpfs_t;
4545         ')
4546
4547         allow $1 user_tmpfs_t:file delete_file_perms;
4548 ')
4549
4550 ########################################
4551 ## <summary>
4552 ##      Read/Write unpriviledged user SysV shared
4553 ##      memory segments.
4554 ## </summary>
4555 ## <param name="domain">
4556 ##      <summary>
4557 ##      Domain allowed access.
4558 ##      </summary>
4559 ## </param>
4560 #
4561 interface(`userdom_rw_unpriv_user_shared_mem',`
4562         gen_require(`
4563                 attribute unpriv_userdomain;
4564         ')
4565
4566         allow $1 unpriv_userdomain:shm rw_shm_perms;
4567 ')
4568
4569 ########################################
4570 ## <summary>
4571 ##      Do not audit attempts to search user
4572 ##      temporary directories.
4573 ## </summary>
4574 ## <param name="domain">
4575 ##      <summary>
4576 ##      Domain to not audit.
4577 ##      </summary>
4578 ## </param>
4579 #
4580 interface(`userdom_dontaudit_search_user_tmp',`
4581         gen_require(`
4582                 type user_tmp_t;
4583         ')
4584
4585         dontaudit $1 user_tmp_t:dir search_dir_perms;
4586 ')
4587
4588 ########################################
4589 ## <summary>
4590 ##      Execute a file in a user home directory
4591 ##      in the specified domain.
4592 ## </summary>
4593 ## <desc>
4594 ##      <p>
4595 ##      Execute a file in a user home directory
4596 ##      in the specified domain.
4597 ##      </p>
4598 ##      <p>
4599 ##      No interprocess communication (signals, pipes,
4600 ##      etc.) is provided by this interface since
4601 ##      the domains are not owned by this module.
4602 ##      </p>
4603 ## </desc>
4604 ## <param name="domain">
4605 ##      <summary>
4606 ##      Domain allowed access.
4607 ##      </summary>
4608 ## </param>
4609 ## <param name="target_domain">
4610 ##      <summary>
4611 ##      The type of the new process.
4612 ##      </summary>
4613 ## </param>
4614 #
4615 interface(`userdom_domtrans_user_home',`
4616         gen_require(`
4617                 type user_home_t;
4618         ')
4619
4620         read_lnk_files_pattern($1, user_home_t, user_home_t)
4621         domain_transition_pattern($1, user_home_t, $2)
4622         type_transition $1 user_home_t:process $2;
4623 ')
4624
4625 ########################################
4626 ## <summary>
4627 ##      Execute a file in a user tmp directory
4628 ##      in the specified domain.
4629 ## </summary>
4630 ## <desc>
4631 ##      <p>
4632 ##      Execute a file in a user tmp directory
4633 ##      in the specified domain.
4634 ##      </p>
4635 ##      <p>
4636 ##      No interprocess communication (signals, pipes,
4637 ##      etc.) is provided by this interface since
4638 ##      the domains are not owned by this module.
4639 ##      </p>
4640 ## </desc>
4641 ## <param name="domain">
4642 ##      <summary>
4643 ##      Domain allowed access.
4644 ##      </summary>
4645 ## </param>
4646 ## <param name="target_domain">
4647 ##      <summary>
4648 ##      The type of the new process.
4649 ##      </summary>
4650 ## </param>
4651 #
4652 interface(`userdom_domtrans_user_tmp',`
4653         gen_require(`
4654                 type user_tmp_t;
4655         ')
4656
4657         files_search_tmp($1)
4658         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4659         domain_transition_pattern($1, user_tmp_t, $2)
4660         type_transition $1 user_tmp_t:process $2;
4661 ')
4662
4663 ########################################
4664 ## <summary>
4665 ##      Do not audit attempts to read all user home content files.
4666 ## </summary>
4667 ## <param name="domain">
4668 ##      <summary>
4669 ##      Domain to not audit.
4670 ##      </summary>
4671 ## </param>
4672 #
4673 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4674         gen_require(`
4675                 attribute user_home_type;
4676         ')
4677
4678         dontaudit $1 user_home_type:file read_file_perms;
4679 ')
4680
4681 ########################################
4682 ## <summary>
4683 ##      Do not audit attempts to read all user tmp content files.
4684 ## </summary>
4685 ## <param name="domain">
4686 ##      <summary>
4687 ##      Domain to not audit.
4688 ##      </summary>
4689 ## </param>
4690 #
4691 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4692         gen_require(`
4693                 attribute user_tmp_type;
4694         ')
4695
4696         dontaudit $1 user_tmp_type:file read_file_perms;
4697 ')
4698