policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 attribute user_tmp_type;
 321                 type user_tmp_t;
 322         ')
 323
 324         role $1 types user_tmp_t;
 325
 326         files_poly_member_tmp($2, user_tmp_t)
 327
 328         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 329         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 330         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 331         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 332         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 333         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 334         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 335         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 336         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 337         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 338         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 339 ')
 340
 341 #######################################
 342 ## <summary>
 343 ##      Dontaudit search of user bin dirs.
 344 ## </summary>
 345 ## <param name="domain">
 346 ##      <summary>
 347 ##      Domain to not audit.
 348 ##      </summary>
 349 ## </param>
 350 #
 351 interface(`userdom_dontaudit_search_user_bin_dirs',`
 352         gen_require(`
 353                 type home_bin_t;
 354         ')
 355
 356         dontaudit $1 home_bin_t:dir search_dir_perms;
 357 ')
 358
 359 #######################################
 360 ## <summary>
 361 ##      Execute user bin files.
 362 ## </summary>
 363 ## <param name="domain">
 364 ##      <summary>
 365 ##      Domain allowed access.
 366 ##      </summary>
 367 ## </param>
 368 #
 369 interface(`userdom_exec_user_bin_files',`
 370         gen_require(`
 371                 attribute user_home_type;
 372                 type home_bin_t, user_home_dir_t;
 373         ')
 374
 375         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 376         files_search_home($1)
 377 ')
 378
 379 #######################################
 380 ## <summary>
 381 ##      The execute access user temporary files.
 382 ## </summary>
 383 ## <param name="domain">
 384 ##      <summary>
 385 ##      Domain allowed access.
 386 ##      </summary>
 387 ## </param>
 388 ## <rolebase/>
 389 #
 390 interface(`userdom_exec_user_tmp_files',`
 391         gen_require(`
 392                 type user_tmp_t;
 393         ')
 394
 395         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 396         dontaudit $1 user_tmp_t:sock_file execute;
 397         files_search_tmp($1)
 398 ')
 399
 400 #######################################
 401 ## <summary>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ## </summary>
 405 ## <desc>
 406 ##      <p>
 407 ##      Role access for the user tmpfs type
 408 ##      that the user has full access.
 409 ##      </p>
 410 ##      <p>
 411 ##      This does not allow execute access.
 412 ##      </p>
 413 ## </desc>
 414 ## <param name="role">
 415 ##      <summary>
 416 ##      Role allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <param name="domain">
 420 ##      <summary>
 421 ##      Domain allowed access.
 422 ##      </summary>
 423 ## </param>
 424 ## <rolecap/>
 425 #
 426 interface(`userdom_manage_tmpfs_role',`
 427         gen_require(`
 428                 attribute user_tmpfs_type;
 429                 type user_tmpfs_t;
 430         ')
 431
 432         role $1 types user_tmpfs_t;
 433
 434         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 435         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 436         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 437         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 438         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 439         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 440         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 441         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445 ')
 446
 447 #######################################
 448 ## <summary>
 449 ##      The interface allowing the user basic
 450 ##      network permissions
 451 ## </summary>
 452 ## <param name="userdomain">
 453 ##      <summary>
 454 ##      The user domain
 455 ##      </summary>
 456 ## </param>
 457 ## <rolebase/>
 458 #
 459 interface(`userdom_basic_networking',`
 460
 461         allow $1 self:tcp_socket create_stream_socket_perms;
 462         allow $1 self:udp_socket create_socket_perms;
 463
 464         corenet_all_recvfrom_unlabeled($1)
 465         corenet_all_recvfrom_netlabel($1)
 466         corenet_tcp_sendrecv_generic_if($1)
 467         corenet_udp_sendrecv_generic_if($1)
 468         corenet_tcp_sendrecv_generic_node($1)
 469         corenet_udp_sendrecv_generic_node($1)
 470         corenet_tcp_sendrecv_all_ports($1)
 471         corenet_udp_sendrecv_all_ports($1)
 472         corenet_tcp_connect_all_ports($1)
 473         corenet_sendrecv_all_client_packets($1)
 474
 475         optional_policy(`
 476                 init_tcp_recvfrom_all_daemons($1)
 477                 init_udp_recvfrom_all_daemons($1)
 478         ')
 479
 480         optional_policy(`
 481                 ipsec_match_default_spd($1)
 482         ')
 483
 484 ')
 485
 486 #######################################
 487 ## <summary>
 488 ##      The template for creating a user xwindows client.  (Deprecated)
 489 ## </summary>
 490 ## <param name="userdomain_prefix">
 491 ##      <summary>
 492 ##      The prefix of the user domain (e.g., user
 493 ##      is the prefix for user_t).
 494 ##      </summary>
 495 ## </param>
 496 ## <rolebase/>
 497 #
 498 template(`userdom_xwindows_client_template',`
 499         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 500         gen_require(`
 501                 type $1_t, user_tmpfs_t;
 502         ')
 503
 504         dev_rw_xserver_misc($1_t)
 505         dev_rw_power_management($1_t)
 506         dev_read_input($1_t)
 507         dev_read_misc($1_t)
 508         dev_write_misc($1_t)
 509         # open office is looking for the following
 510         dev_getattr_agp_dev($1_t)
 511         dev_dontaudit_rw_dri($1_t)
 512         # GNOME checks for usb and other devices:
 513         dev_rw_usbfs($1_t)
 514         dev_rw_generic_usb_dev($1_t)
 515
 516         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 517         xserver_xsession_entry_type($1_t)
 518         xserver_dontaudit_write_log($1_t)
 519         xserver_stream_connect_xdm($1_t)
 520         # certain apps want to read xdm.pid file
 521         xserver_read_xdm_pid($1_t)
 522         # gnome-session creates socket under /tmp/.ICE-unix/
 523         xserver_create_xdm_tmp_sockets($1_t)
 524         # Needed for escd, remove if we get escd policy
 525         xserver_manage_xdm_tmp_files($1_t)
 526 ')
 527
 528 #######################################
 529 ## <summary>
 530 ##      The template for allowing the user to change passwords.
 531 ## </summary>
 532 ## <param name="userdomain_prefix">
 533 ##      <summary>
 534 ##      The prefix of the user domain (e.g., user
 535 ##      is the prefix for user_t).
 536 ##      </summary>
 537 ## </param>
 538 ## <rolebase/>
 539 #
 540 template(`userdom_change_password_template',`
 541         gen_require(`
 542                 type $1_t;
 543                 role $1_r;
 544         ')
 545
 546         optional_policy(`
 547                 usermanage_run_chfn($1_t,$1_r)
 548                 usermanage_run_passwd($1_t,$1_r)
 549         ')
 550 ')
 551
 552 #######################################
 553 ## <summary>
 554 ##      The template containing rules common to unprivileged
 555 ##      users and administrative users.
 556 ## </summary>
 557 ## <desc>
 558 ##      <p>
 559 ##      This template creates a user domain, types, and
 560 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 561 ##      </p>
 562 ## </desc>
 563 ## <param name="userdomain_prefix">
 564 ##      <summary>
 565 ##      The prefix of the user domain (e.g., user
 566 ##      is the prefix for user_t).
 567 ##      </summary>
 568 ## </param>
 569 #
 570 template(`userdom_common_user_template',`
 571         gen_require(`
 572                 attribute unpriv_userdomain;
 573         ')
 574
 575         userdom_basic_networking($1_usertype)
 576
 577         ##############################
 578         #
 579         # User domain Local policy
 580         #
 581
 582         # evolution and gnome-session try to create a netlink socket
 583         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 584         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 585         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 586         allow $1_t self:socket create_socket_perms;
 587
 588         allow $1_usertype unpriv_userdomain:fd use;
 589
 590         kernel_read_system_state($1_usertype)
 591         kernel_read_network_state($1_usertype)
 592         kernel_read_software_raid_state($1_usertype)
 593         kernel_read_net_sysctls($1_usertype)
 594         # Very permissive allowing every domain to see every type:
 595         kernel_get_sysvipc_info($1_usertype)
 596         # Find CDROM devices:
 597         kernel_read_device_sysctls($1_usertype)
 598         kernel_request_load_module($1_usertype)
 599
 600         corenet_udp_bind_generic_node($1_usertype)
 601         corenet_udp_bind_generic_port($1_usertype)
 602
 603         dev_read_rand($1_usertype)
 604         dev_write_sound($1_usertype)
 605         dev_read_sound($1_usertype)
 606         dev_read_sound_mixer($1_usertype)
 607         dev_write_sound_mixer($1_usertype)
 608
 609         files_exec_etc_files($1_usertype)
 610         files_search_locks($1_usertype)
 611         # Check to see if cdrom is mounted
 612         files_search_mnt($1_usertype)
 613         # cjp: perhaps should cut back on file reads:
 614         files_read_var_files($1_usertype)
 615         files_read_var_symlinks($1_usertype)
 616         files_read_generic_spool($1_usertype)
 617         files_read_var_lib_files($1_usertype)
 618         # Stat lost+found.
 619         files_getattr_lost_found_dirs($1_usertype)
 620         files_read_config_files($1_usertype)
 621         fs_read_noxattr_fs_files($1_usertype)
 622         fs_read_noxattr_fs_symlinks($1_usertype)
 623         fs_rw_cgroup_files($1_usertype)
 624
 625         application_getattr_socket($1_usertype)
 626
 627         logging_send_syslog_msg($1_usertype)
 628         logging_send_audit_msgs($1_usertype)
 629         selinux_get_enforce_mode($1_usertype)
 630
 631         # cjp: some of this probably can be removed
 632         selinux_get_fs_mount($1_usertype)
 633         selinux_validate_context($1_usertype)
 634         selinux_compute_access_vector($1_usertype)
 635         selinux_compute_create_context($1_usertype)
 636         selinux_compute_relabel_context($1_usertype)
 637         selinux_compute_user_contexts($1_usertype)
 638
 639         # for eject
 640         storage_getattr_fixed_disk_dev($1_usertype)
 641
 642         auth_read_login_records($1_usertype)
 643         auth_run_pam($1_t,$1_r)
 644         auth_run_utempter($1_t,$1_r)
 645
 646         init_read_utmp($1_usertype)
 647
 648         seutil_read_file_contexts($1_usertype)
 649         seutil_read_default_contexts($1_usertype)
 650         seutil_run_newrole($1_t,$1_r)
 651         seutil_exec_checkpolicy($1_t)
 652         seutil_exec_setfiles($1_usertype)
 653         # for when the network connection is killed
 654         # this is needed when a login role can change
 655         # to this one.
 656         seutil_dontaudit_signal_newrole($1_t)
 657
 658         tunable_policy(`user_direct_mouse',`
 659                 dev_read_mouse($1_usertype)
 660         ')
 661
 662         tunable_policy(`user_ttyfile_stat',`
 663                 term_getattr_all_ttys($1_t)
 664         ')
 665
 666         optional_policy(`
 667                 alsa_read_rw_config($1_usertype)
 668                 alsa_manage_home_files($1_t)
 669                 alsa_relabel_home_files($1_t)
 670         ')
 671
 672         optional_policy(`
 673                 # Allow graphical boot to check battery lifespan
 674                 apm_stream_connect($1_usertype)
 675         ')
 676
 677         optional_policy(`
 678                 canna_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 chrome_role($1_r, $1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 colord_read_lib_files($1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 dbus_system_bus_client($1_usertype)
 691
 692                 allow $1_usertype $1_usertype:dbus  send_msg;
 693
 694                 optional_policy(`
 695                         avahi_dbus_chat($1_usertype)
 696                 ')
 697
 698                 optional_policy(`
 699                         policykit_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         bluetooth_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         consolekit_dbus_chat($1_usertype)
 708                         consolekit_read_log($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         devicekit_dbus_chat($1_usertype)
 713                         devicekit_dbus_chat_power($1_usertype)
 714                         devicekit_dbus_chat_disk($1_usertype)
 715                 ')
 716
 717                 optional_policy(`
 718                         evolution_dbus_chat($1_usertype)
 719                         evolution_alarm_dbus_chat($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 nsplugin_role($1_r, $1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 tunable_policy(`allow_user_mysql_connect',`
 788                         mysql_stream_connect($1_t)
 789                 ')
 790         ')
 791
 792         optional_policy(`
 793                 oident_manage_user_content($1_t)
 794                 oident_relabel_user_content($1_t)
 795         ')
 796
 797         optional_policy(`
 798                 # to allow monitoring of pcmcia status
 799                 pcmcia_read_pid($1_usertype)
 800         ')
 801
 802         optional_policy(`
 803                 pcscd_read_pub_files($1_usertype)
 804                 pcscd_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 tunable_policy(`allow_user_postgresql_connect',`
 809                         postgresql_stream_connect($1_usertype)
 810                         postgresql_tcp_connect($1_usertype)
 811                 ')
 812         ')
 813
 814         optional_policy(`
 815                 resmgr_stream_connect($1_usertype)
 816         ')
 817
 818         optional_policy(`
 819                 rpc_dontaudit_getattr_exports($1_usertype)
 820                 rpc_manage_nfs_rw_content($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 rpcbind_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 samba_stream_connect_winbind($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 sandbox_transition($1_usertype, $1_r)
 833         ')
 834
 835         optional_policy(`
 836                 seunshare_role_template($1, $1_r, $1_t)
 837         ')
 838
 839         optional_policy(`
 840                 slrnpull_search_spool($1_usertype)
 841         ')
 842
 843 ')
 844
 845 #######################################
 846 ## <summary>
 847 ##      The template for creating a login user.
 848 ## </summary>
 849 ## <desc>
 850 ##      <p>
 851 ##      This template creates a user domain, types, and
 852 ##      rules for the user's tty, pty, home directories,
 853 ##      tmp, and tmpfs files.
 854 ##      </p>
 855 ## </desc>
 856 ## <param name="userdomain_prefix">
 857 ##      <summary>
 858 ##      The prefix of the user domain (e.g., user
 859 ##      is the prefix for user_t).
 860 ##      </summary>
 861 ## </param>
 862 #
 863 template(`userdom_login_user_template', `
 864         gen_require(`
 865                 class context contains;
 866         ')
 867
 868         userdom_base_user_template($1)
 869
 870         userdom_manage_home_role($1_r, $1_usertype)
 871
 872         userdom_manage_tmp_role($1_r, $1_usertype)
 873         userdom_manage_tmpfs_role($1_r, $1_usertype)
 874
 875         ifelse(`$1',`unconfined',`',`
 876                 gen_tunable(allow_$1_exec_content, true)
 877
 878                 tunable_policy(`allow_$1_exec_content',`
 879                         userdom_exec_user_tmp_files($1_usertype)
 880                         userdom_exec_user_home_content_files($1_usertype)
 881                 ')
 882                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 883                         fs_exec_nfs_files($1_usertype)
 884                 ')
 885
 886                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 887                         fs_exec_cifs_files($1_usertype)
 888                 ')
 889         ')
 890
 891         userdom_change_password_template($1)
 892
 893         ##############################
 894         #
 895         # User domain Local policy
 896         #
 897
 898         allow $1_t self:capability { setgid chown fowner };
 899         dontaudit $1_t self:capability { sys_nice fsetid };
 900
 901         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 902         dontaudit $1_t self:process setrlimit;
 903         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 904
 905         allow $1_t self:context contains;
 906
 907         kernel_dontaudit_read_system_state($1_usertype)
 908         kernel_dontaudit_list_all_proc($1_usertype)
 909
 910         dev_read_sysfs($1_usertype)
 911         dev_read_urand($1_usertype)
 912
 913         domain_use_interactive_fds($1_usertype)
 914         # Command completion can fire hundreds of denials
 915         domain_dontaudit_exec_all_entry_files($1_usertype)
 916
 917         files_dontaudit_list_default($1_usertype)
 918         files_dontaudit_read_default_files($1_usertype)
 919         # Stat lost+found.
 920         files_getattr_lost_found_dirs($1_usertype)
 921
 922         fs_get_all_fs_quotas($1_usertype)
 923         fs_getattr_all_fs($1_usertype)
 924         fs_search_all($1_usertype)
 925         fs_list_inotifyfs($1_usertype)
 926         fs_rw_anon_inodefs_files($1_usertype)
 927
 928         auth_dontaudit_write_login_records($1_t)
 929         auth_rw_cache($1_t)
 930
 931         # Stop warnings about access to /dev/console
 932         init_dontaudit_use_fds($1_usertype)
 933         init_dontaudit_use_script_fds($1_usertype)
 934
 935         libs_exec_lib_files($1_usertype)
 936
 937         logging_dontaudit_getattr_all_logs($1_usertype)
 938
 939         # for running TeX programs
 940         miscfiles_read_tetex_data($1_usertype)
 941         miscfiles_exec_tetex_data($1_usertype)
 942
 943         seutil_read_config($1_usertype)
 944
 945         optional_policy(`
 946                 cups_read_config($1_usertype)
 947                 cups_stream_connect($1_usertype)
 948                 cups_stream_connect_ptal($1_usertype)
 949         ')
 950
 951         optional_policy(`
 952                 kerberos_use($1_usertype)
 953                 kerberos_filetrans_home_content($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 mta_dontaudit_read_spool_symlinks($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 quota_dontaudit_getattr_db($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 rpm_read_db($1_usertype)
 966                 rpm_dontaudit_manage_db($1_usertype)
 967                 rpm_read_cache($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 oddjob_run_mkhomedir($1_t, $1_r)
 972         ')
 973 ')
 974
 975 #######################################
 976 ## <summary>
 977 ##      The template for creating a unprivileged login user.
 978 ## </summary>
 979 ## <desc>
 980 ##      <p>
 981 ##      This template creates a user domain, types, and
 982 ##      rules for the user's tty, pty, home directories,
 983 ##      tmp, and tmpfs files.
 984 ##      </p>
 985 ## </desc>
 986 ## <param name="userdomain_prefix">
 987 ##      <summary>
 988 ##      The prefix of the user domain (e.g., user
 989 ##      is the prefix for user_t).
 990 ##      </summary>
 991 ## </param>
 992 #
 993 template(`userdom_restricted_user_template',`
 994         gen_require(`
 995                 attribute unpriv_userdomain;
 996         ')
 997
 998         userdom_login_user_template($1)
 999
1000         typeattribute $1_t unpriv_userdomain;
1001         domain_interactive_fd($1_t)
1002
1003         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1004         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1005
1006         ##############################
1007         #
1008         # Local policy
1009         #
1010
1011         optional_policy(`
1012                 loadkeys_run($1_t,$1_r)
1013         ')
1014 ')
1015
1016 #######################################
1017 ## <summary>
1018 ##      The template for creating a unprivileged xwindows login user.
1019 ## </summary>
1020 ## <desc>
1021 ##      <p>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ##      </p>
1024 ##      <p>
1025 ##      This template creates a user domain, types, and
1026 ##      rules for the user's tty, pty, home directories,
1027 ##      tmp, and tmpfs files.
1028 ##      </p>
1029 ## </desc>
1030 ## <param name="userdomain_prefix">
1031 ##      <summary>
1032 ##      The prefix of the user domain (e.g., user
1033 ##      is the prefix for user_t).
1034 ##      </summary>
1035 ## </param>
1036 #
1037 template(`userdom_restricted_xwindows_user_template',`
1038
1039         userdom_restricted_user_template($1)
1040
1041         ##############################
1042         #
1043         # Local policy
1044         #
1045
1046         auth_role($1_r, $1_t)
1047         auth_search_pam_console_data($1_usertype)
1048         auth_dontaudit_read_login_records($1_usertype)
1049
1050         dev_read_sound($1_usertype)
1051         dev_write_sound($1_usertype)
1052         # gnome keyring wants to read this.
1053         dev_dontaudit_read_rand($1_usertype)
1054         # temporarily allow since openoffice requires this
1055         dev_read_rand($1_usertype)
1056
1057         dev_read_video_dev($1_usertype)
1058         dev_write_video_dev($1_usertype)
1059         dev_rw_wireless($1_usertype)
1060
1061         libs_dontaudit_setattr_lib_files($1_usertype)
1062
1063         tunable_policy(`user_rw_noexattrfile',`
1064                 dev_rw_usbfs($1_t)
1065                 dev_rw_generic_usb_dev($1_usertype)
1066
1067                 fs_manage_noxattr_fs_files($1_usertype)
1068                 fs_manage_noxattr_fs_dirs($1_usertype)
1069                 fs_manage_dos_dirs($1_usertype)
1070                 fs_manage_dos_files($1_usertype)
1071                 storage_raw_read_removable_device($1_usertype)
1072                 storage_raw_write_removable_device($1_usertype)
1073         ')
1074
1075         logging_send_syslog_msg($1_usertype)
1076         logging_dontaudit_send_audit_msgs($1_t)
1077
1078         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1079         logging_send_audit_msgs($1_t)
1080         selinux_get_enforce_mode($1_t)
1081         seutil_exec_restorecond($1_t)
1082         seutil_read_file_contexts($1_t)
1083         seutil_read_default_contexts($1_t)
1084
1085         xserver_restricted_role($1_r, $1_t)
1086
1087         optional_policy(`
1088                 alsa_read_rw_config($1_usertype)
1089         ')
1090
1091          # cjp: needed by KDE apps
1092          # bug: #682499
1093          optional_policy(`
1094                 gnome_read_usr_config($1_usertype)
1095                 gnome_role_gkeyringd($1, $1_r, $1_t)
1096                 # cjp: telepathy F15 bugs
1097                 telepathy_dbus_session_role($1_r, $1_t, $1)
1098         ')
1099
1100         optional_policy(`
1101                 dbus_role_template($1, $1_r, $1_usertype)
1102                 dbus_system_bus_client($1_usertype)
1103                 allow $1_usertype $1_usertype:dbus send_msg;
1104
1105                 optional_policy(`
1106                         abrt_dbus_chat($1_usertype)
1107                         abrt_run_helper($1_usertype, $1_r)
1108                 ')
1109
1110                 optional_policy(`
1111                         consolekit_dontaudit_read_log($1_usertype)
1112                         consolekit_dbus_chat($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         cups_dbus_chat($1_usertype)
1117                         cups_dbus_chat_config($1_usertype)
1118                 ')
1119
1120                 optional_policy(`
1121                         devicekit_dbus_chat($1_usertype)
1122                         devicekit_dbus_chat_disk($1_usertype)
1123                         devicekit_dbus_chat_power($1_usertype)
1124                 ')
1125
1126                 optional_policy(`
1127                         fprintd_dbus_chat($1_t)
1128                 ')
1129         ')
1130
1131         optional_policy(`
1132                 openoffice_role_template($1, $1_r, $1_usertype)
1133         ')
1134
1135         optional_policy(`
1136                 policykit_role($1_r, $1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 pulseaudio_role($1_r, $1_usertype)
1141                 pulseaudio_filetrans_admin_home_content($1_usertype)
1142                 pulseaudio_filetrans_home_content($1_usertype)
1143         ')
1144
1145         optional_policy(`
1146                 rtkit_scheduled($1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 setroubleshoot_dontaudit_stream_connect($1_t)
1151         ')
1152
1153         optional_policy(`
1154                 udev_read_db($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 wm_role_template($1, $1_r, $1_t)
1159         ')
1160 ')
1161
1162 #######################################
1163 ## <summary>
1164 ##      The template for creating a unprivileged user roughly
1165 ##      equivalent to a regular linux user.
1166 ## </summary>
1167 ## <desc>
1168 ##      <p>
1169 ##      The template for creating a unprivileged user roughly
1170 ##      equivalent to a regular linux user.
1171 ##      </p>
1172 ##      <p>
1173 ##      This template creates a user domain, types, and
1174 ##      rules for the user's tty, pty, home directories,
1175 ##      tmp, and tmpfs files.
1176 ##      </p>
1177 ## </desc>
1178 ## <param name="userdomain_prefix">
1179 ##      <summary>
1180 ##      The prefix of the user domain (e.g., user
1181 ##      is the prefix for user_t).
1182 ##      </summary>
1183 ## </param>
1184 #
1185 template(`userdom_unpriv_user_template', `
1186
1187         ##############################
1188         #
1189         # Declarations
1190         #
1191
1192         # Inherit rules for ordinary users.
1193         userdom_restricted_xwindows_user_template($1)
1194         userdom_common_user_template($1)
1195
1196         ##############################
1197         #
1198         # Local policy
1199         #
1200
1201         # port access is audited even if dac would not have allowed it, so dontaudit it here
1202 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1203         # Need the following rule to allow users to run vpnc
1204         corenet_tcp_bind_xserver_port($1_t)
1205         corenet_tcp_bind_generic_node($1_usertype)
1206
1207         storage_rw_fuse($1_t)
1208
1209         miscfiles_read_hwdata($1_usertype)
1210
1211         # Allow users to run TCP servers (bind to ports and accept connection from
1212         # the same domain and outside users) disabling this forces FTP passive mode
1213         # and may change other protocols
1214
1215         tunable_policy(`user_share_music',`
1216                 corenet_tcp_bind_daap_port($1_usertype)
1217         ')
1218
1219         tunable_policy(`user_tcp_server',`
1220                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1221         ')
1222
1223         tunable_policy(`user_setrlimit',`
1224                 allow $1_usertype self:process setrlimit;
1225         ')
1226
1227         optional_policy(`
1228                 cdrecord_role($1_r, $1_t)
1229         ')
1230
1231         optional_policy(`
1232                 cron_role($1_r, $1_t)
1233         ')
1234
1235         optional_policy(`
1236                 games_rw_data($1_usertype)
1237         ')
1238
1239         optional_policy(`
1240                 gpg_role($1_r, $1_usertype)
1241         ')
1242
1243         optional_policy(`
1244                 gnomeclock_dbus_chat($1_t)
1245         ')
1246
1247         optional_policy(`
1248                 gpm_stream_connect($1_usertype)
1249         ')
1250
1251         optional_policy(`
1252                 execmem_role_template($1, $1_r, $1_t)
1253         ')
1254
1255         optional_policy(`
1256                 java_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 mono_role_template($1, $1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 mount_run_fusermount($1_t, $1_r)
1265                 mount_read_pid_files($1_t)
1266         ')
1267
1268         optional_policy(`
1269                 wine_role_template($1, $1_r, $1_t)
1270         ')
1271
1272         optional_policy(`
1273                 postfix_run_postdrop($1_t, $1_r)
1274         ')
1275
1276         # Run pppd in pppd_t by default for user
1277         optional_policy(`
1278                 ppp_run_cond($1_t, $1_r)
1279         ')
1280 ')
1281
1282 #######################################
1283 ## <summary>
1284 ##      The template for creating an administrative user.
1285 ## </summary>
1286 ## <desc>
1287 ##      <p>
1288 ##      This template creates a user domain, types, and
1289 ##      rules for the user's tty, pty, home directories,
1290 ##      tmp, and tmpfs files.
1291 ##      </p>
1292 ##      <p>
1293 ##      The privileges given to administrative users are:
1294 ##      <ul>
1295 ##              <li>Raw disk access</li>
1296 ##              <li>Set all sysctls</li>
1297 ##              <li>All kernel ring buffer controls</li>
1298 ##              <li>Create, read, write, and delete all files but shadow</li>
1299 ##              <li>Manage source and binary format SELinux policy</li>
1300 ##              <li>Run insmod</li>
1301 ##      </ul>
1302 ##      </p>
1303 ## </desc>
1304 ## <param name="userdomain_prefix">
1305 ##      <summary>
1306 ##      The prefix of the user domain (e.g., sysadm
1307 ##      is the prefix for sysadm_t).
1308 ##      </summary>
1309 ## </param>
1310 #
1311 template(`userdom_admin_user_template',`
1312         gen_require(`
1313                 attribute admindomain;
1314                 class passwd { passwd chfn chsh rootok crontab };
1315         ')
1316
1317         ##############################
1318         #
1319         # Declarations
1320         #
1321
1322         # Inherit rules for ordinary users.
1323         userdom_login_user_template($1)
1324         userdom_common_user_template($1)
1325
1326         domain_obj_id_change_exemption($1_t)
1327         role system_r types $1_t;
1328
1329         typeattribute $1_t admindomain;
1330
1331         ifdef(`direct_sysadm_daemon',`
1332                 domain_system_change_exemption($1_t)
1333         ')
1334
1335         ##############################
1336         #
1337         # $1_t local policy
1338         #
1339
1340         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1341         allow $1_t self:capability2 syslog;
1342         allow $1_t self:process { setexec setfscreate };
1343         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1344         allow $1_t self:tun_socket create;
1345         # Set password information for other users.
1346         allow $1_t self:passwd { passwd chfn chsh };
1347         # Skip authentication when pam_rootok is specified.
1348         allow $1_t self:passwd rootok;
1349
1350         # Manipulate other users crontab.
1351         allow $1_t self:passwd crontab;
1352
1353         kernel_read_software_raid_state($1_t)
1354         kernel_getattr_core_if($1_t)
1355         kernel_getattr_message_if($1_t)
1356         kernel_change_ring_buffer_level($1_t)
1357         kernel_clear_ring_buffer($1_t)
1358         kernel_read_ring_buffer($1_t)
1359         kernel_get_sysvipc_info($1_t)
1360         kernel_rw_all_sysctls($1_t)
1361         # signal unlabeled processes:
1362         kernel_kill_unlabeled($1_t)
1363         kernel_signal_unlabeled($1_t)
1364         kernel_sigstop_unlabeled($1_t)
1365         kernel_signull_unlabeled($1_t)
1366         kernel_sigchld_unlabeled($1_t)
1367         kernel_signal($1_t)
1368
1369         corenet_tcp_bind_generic_port($1_t)
1370         # allow setting up tunnels
1371         corenet_rw_tun_tap_dev($1_t)
1372
1373         dev_getattr_generic_blk_files($1_t)
1374         dev_getattr_generic_chr_files($1_t)
1375         # for lsof
1376         dev_getattr_mtrr_dev($1_t)
1377         # Allow MAKEDEV to work
1378         dev_create_all_blk_files($1_t)
1379         dev_create_all_chr_files($1_t)
1380         dev_delete_all_blk_files($1_t)
1381         dev_delete_all_chr_files($1_t)
1382         dev_rename_all_blk_files($1_t)
1383         dev_rename_all_chr_files($1_t)
1384         dev_create_generic_symlinks($1_t)
1385         dev_rw_generic_usb_dev($1_t)
1386         dev_rw_usbfs($1_t)
1387
1388         domain_setpriority_all_domains($1_t)
1389         domain_read_all_domains_state($1_t)
1390         domain_getattr_all_domains($1_t)
1391         domain_getcap_all_domains($1_t)
1392         domain_dontaudit_ptrace_all_domains($1_t)
1393         # signal all domains:
1394         domain_kill_all_domains($1_t)
1395         domain_signal_all_domains($1_t)
1396         domain_signull_all_domains($1_t)
1397         domain_sigstop_all_domains($1_t)
1398         domain_sigstop_all_domains($1_t)
1399         domain_sigchld_all_domains($1_t)
1400         # for lsof
1401         domain_getattr_all_sockets($1_t)
1402         domain_dontaudit_getattr_all_sockets($1_t)
1403
1404         files_exec_usr_src_files($1_t)
1405
1406         fs_getattr_all_fs($1_t)
1407         fs_getattr_all_files($1_t)
1408         fs_list_all($1_t)
1409         fs_set_all_quotas($1_t)
1410         fs_exec_noxattr($1_t)
1411
1412         storage_raw_read_removable_device($1_t)
1413         storage_raw_write_removable_device($1_t)
1414         storage_dontaudit_read_fixed_disk($1_t)
1415
1416         term_use_all_inherited_terms($1_t)
1417         term_use_unallocated_ttys($1_t)
1418
1419         auth_getattr_shadow($1_t)
1420         # Manage almost all files
1421         auth_manage_all_files_except_shadow($1_t)
1422         # Relabel almost all files
1423         auth_relabel_all_files_except_shadow($1_t)
1424
1425         init_telinit($1_t)
1426
1427         logging_send_syslog_msg($1_t)
1428
1429         optional_policy(`
1430                 modutils_domtrans_insmod($1_t)
1431                 modutils_domtrans_depmod($1_t)
1432         ')
1433
1434         # The following rule is temporary until such time that a complete
1435         # policy management infrastructure is in place so that an administrator
1436         # cannot directly manipulate policy files with arbitrary programs.
1437         seutil_manage_src_policy($1_t)
1438         # Violates the goal of limiting write access to checkpolicy.
1439         # But presently necessary for installing the file_contexts file.
1440         seutil_manage_bin_policy($1_t)
1441
1442         userdom_manage_user_home_content_dirs($1_t)
1443         userdom_manage_user_home_content_files($1_t)
1444         userdom_manage_user_home_content_symlinks($1_t)
1445         userdom_manage_user_home_content_pipes($1_t)
1446         userdom_manage_user_home_content_sockets($1_t)
1447         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1448
1449         tunable_policy(`user_rw_noexattrfile',`
1450                 fs_manage_noxattr_fs_files($1_t)
1451                 fs_manage_noxattr_fs_dirs($1_t)
1452         ',`
1453                 fs_read_noxattr_fs_files($1_t)
1454         ')
1455
1456         optional_policy(`
1457                 postgresql_unconfined($1_t)
1458         ')
1459
1460         optional_policy(`
1461                 userhelper_exec($1_t)
1462         ')
1463 ')
1464
1465 ########################################
1466 ## <summary>
1467 ##      Allow user to run as a secadm
1468 ## </summary>
1469 ## <desc>
1470 ##      <p>
1471 ##      Create objects in a user home directory
1472 ##      with an automatic type transition to
1473 ##      a specified private type.
1474 ##      </p>
1475 ##      <p>
1476 ##      This is a templated interface, and should only
1477 ##      be called from a per-userdomain template.
1478 ##      </p>
1479 ## </desc>
1480 ## <param name="domain">
1481 ##      <summary>
1482 ##      Domain allowed access.
1483 ##      </summary>
1484 ## </param>
1485 ## <param name="role">
1486 ##      <summary>
1487 ##      The role  of the object to create.
1488 ##      </summary>
1489 ## </param>
1490 #
1491 template(`userdom_security_admin_template',`
1492         allow $1 self:capability { dac_read_search dac_override };
1493
1494         corecmd_exec_shell($1)
1495
1496         domain_obj_id_change_exemption($1)
1497
1498         dev_relabel_all_dev_nodes($1)
1499
1500         files_create_boot_flag($1)
1501         files_create_default_dir($1)
1502         files_root_filetrans_default($1, dir)
1503
1504         # Necessary for managing /boot/efi
1505         fs_manage_dos_files($1)
1506
1507         mls_process_read_up($1)
1508         mls_file_read_all_levels($1)
1509         mls_file_upgrade($1)
1510         mls_file_downgrade($1)
1511
1512         selinux_set_enforce_mode($1)
1513         selinux_set_all_booleans($1)
1514         selinux_set_parameters($1)
1515         selinux_read_policy($1)
1516
1517         auth_relabel_all_files_except_shadow($1)
1518         auth_relabel_shadow($1)
1519
1520         init_exec($1)
1521
1522         logging_send_syslog_msg($1)
1523         logging_read_audit_log($1)
1524         logging_read_generic_logs($1)
1525         logging_read_audit_config($1)
1526
1527         seutil_manage_bin_policy($1)
1528         seutil_manage_default_contexts($1)
1529         seutil_manage_file_contexts($1)
1530         seutil_manage_module_store($1)
1531         seutil_manage_config($1)
1532         seutil_run_checkpolicy($1,$2)
1533         seutil_run_loadpolicy($1,$2)
1534         seutil_run_semanage($1,$2)
1535         seutil_run_setsebool($1,$2)
1536         seutil_run_setfiles($1, $2)
1537
1538         seutil_manage_bin_policy($1)
1539     seutil_manage_default_contexts($1)
1540     seutil_manage_file_contexts($1)
1541     seutil_manage_module_store($1)
1542     seutil_manage_config($1)
1543
1544         optional_policy(`
1545                 aide_run($1,$2)
1546         ')
1547
1548         optional_policy(`
1549                 consoletype_exec($1)
1550         ')
1551
1552         optional_policy(`
1553                 dmesg_exec($1)
1554         ')
1555
1556         optional_policy(`
1557                 ipsec_run_setkey($1,$2)
1558         ')
1559
1560         optional_policy(`
1561                 netlabel_run_mgmt($1,$2)
1562         ')
1563
1564         optional_policy(`
1565                 samhain_run($1, $2)
1566         ')
1567 ')
1568
1569 ########################################
1570 ## <summary>
1571 ##      Make the specified type usable in a
1572 ##      user home directory.
1573 ## </summary>
1574 ## <param name="type">
1575 ##      <summary>
1576 ##      Type to be used as a file in the
1577 ##      user home directory.
1578 ##      </summary>
1579 ## </param>
1580 #
1581 interface(`userdom_user_home_content',`
1582         gen_require(`
1583                 type user_home_t;
1584                 attribute user_home_type;
1585         ')
1586
1587         allow $1 user_home_t:filesystem associate;
1588         files_type($1)
1589         ubac_constrained($1)
1590
1591         files_poly_member($1)
1592         typeattribute $1  user_home_type;
1593 ')
1594
1595 ########################################
1596 ## <summary>
1597 ##      Make the specified type usable in a
1598 ##      generic temporary directory.
1599 ## </summary>
1600 ## <param name="type">
1601 ##      <summary>
1602 ##      Type to be used as a file in the
1603 ##      generic temporary directory.
1604 ##      </summary>
1605 ## </param>
1606 #
1607 interface(`userdom_user_tmp_content',`
1608         gen_require(`
1609                 attribute user_tmp_type;
1610         ')
1611
1612         typeattribute $1 user_tmp_type;
1613
1614         files_tmp_file($1)
1615         ubac_constrained($1)
1616 ')
1617
1618 ########################################
1619 ## <summary>
1620 ##      Make the specified type usable in a
1621 ##      generic tmpfs_t directory.
1622 ## </summary>
1623 ## <param name="type">
1624 ##      <summary>
1625 ##      Type to be used as a file in the
1626 ##      generic temporary directory.
1627 ##      </summary>
1628 ## </param>
1629 #
1630 interface(`userdom_user_tmpfs_content',`
1631         gen_require(`
1632                 attribute user_tmpfs_type;
1633         ')
1634
1635         typeattribute $1 user_tmpfs_type;
1636
1637         files_tmpfs_file($1)
1638         ubac_constrained($1)
1639 ')
1640
1641 ########################################
1642 ## <summary>
1643 ##      Allow domain to attach to TUN devices created by administrative users.
1644 ## </summary>
1645 ## <param name="domain">
1646 ##      <summary>
1647 ##      Domain allowed access.
1648 ##      </summary>
1649 ## </param>
1650 #
1651 interface(`userdom_attach_admin_tun_iface',`
1652         gen_require(`
1653                 attribute admindomain;
1654         ')
1655
1656         allow $1 admindomain:tun_socket relabelfrom;
1657         allow $1 self:tun_socket relabelto;
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Set the attributes of a user pty.
1663 ## </summary>
1664 ## <param name="domain">
1665 ##      <summary>
1666 ##      Domain allowed access.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_setattr_user_ptys',`
1671         gen_require(`
1672                 type user_devpts_t;
1673         ')
1674
1675         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1676 ')
1677
1678 ########################################
1679 ## <summary>
1680 ##      Create a user pty.
1681 ## </summary>
1682 ## <param name="domain">
1683 ##      <summary>
1684 ##      Domain allowed access.
1685 ##      </summary>
1686 ## </param>
1687 #
1688 interface(`userdom_create_user_pty',`
1689         gen_require(`
1690                 type user_devpts_t;
1691         ')
1692
1693         term_create_pty($1, user_devpts_t)
1694 ')
1695
1696 ########################################
1697 ## <summary>
1698 ##      Get the attributes of user home directories.
1699 ## </summary>
1700 ## <param name="domain">
1701 ##      <summary>
1702 ##      Domain allowed access.
1703 ##      </summary>
1704 ## </param>
1705 #
1706 interface(`userdom_getattr_user_home_dirs',`
1707         gen_require(`
1708                 type user_home_dir_t;
1709         ')
1710
1711         allow $1 user_home_dir_t:dir getattr_dir_perms;
1712         files_search_home($1)
1713 ')
1714
1715 ########################################
1716 ## <summary>
1717 ##      Do not audit attempts to get the attributes of user home directories.
1718 ## </summary>
1719 ## <param name="domain">
1720 ##      <summary>
1721 ##      Domain to not audit.
1722 ##      </summary>
1723 ## </param>
1724 #
1725 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1726         gen_require(`
1727                 type user_home_dir_t;
1728         ')
1729
1730         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1731 ')
1732
1733 ########################################
1734 ## <summary>
1735 ##      Search user home directories.
1736 ## </summary>
1737 ## <param name="domain">
1738 ##      <summary>
1739 ##      Domain allowed access.
1740 ##      </summary>
1741 ## </param>
1742 #
1743 interface(`userdom_search_user_home_dirs',`
1744         gen_require(`
1745                 type user_home_dir_t;
1746         ')
1747
1748         allow $1 user_home_dir_t:dir search_dir_perms;
1749         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1750         files_search_home($1)
1751 ')
1752
1753 ########################################
1754 ## <summary>
1755 ##      Do not audit attempts to search user home directories.
1756 ## </summary>
1757 ## <desc>
1758 ##      <p>
1759 ##      Do not audit attempts to search user home directories.
1760 ##      This will supress SELinux denial messages when the specified
1761 ##      domain is denied the permission to search these directories.
1762 ##      </p>
1763 ## </desc>
1764 ## <param name="domain">
1765 ##      <summary>
1766 ##      Domain to not audit.
1767 ##      </summary>
1768 ## </param>
1769 ## <infoflow type="none"/>
1770 #
1771 interface(`userdom_dontaudit_search_user_home_dirs',`
1772         gen_require(`
1773                 type user_home_dir_t;
1774         ')
1775
1776         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1777 ')
1778
1779 ########################################
1780 ## <summary>
1781 ##      List user home directories.
1782 ## </summary>
1783 ## <param name="domain">
1784 ##      <summary>
1785 ##      Domain allowed access.
1786 ##      </summary>
1787 ## </param>
1788 #
1789 interface(`userdom_list_user_home_dirs',`
1790         gen_require(`
1791                 type user_home_dir_t;
1792         ')
1793
1794         allow $1 user_home_dir_t:dir list_dir_perms;
1795         files_search_home($1)
1796
1797         tunable_policy(`use_nfs_home_dirs',`
1798                 fs_list_nfs($1)
1799         ')
1800
1801         tunable_policy(`use_samba_home_dirs',`
1802                 fs_list_cifs($1)
1803         ')
1804 ')
1805
1806 ########################################
1807 ## <summary>
1808 ##      Do not audit attempts to list user home subdirectories.
1809 ## </summary>
1810 ## <param name="domain">
1811 ##      <summary>
1812 ##      Domain to not audit.
1813 ##      </summary>
1814 ## </param>
1815 #
1816 interface(`userdom_dontaudit_list_user_home_dirs',`
1817         gen_require(`
1818                 type user_home_dir_t;
1819                 type user_home_t;
1820         ')
1821
1822         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1823         dontaudit $1 user_home_t:dir list_dir_perms;
1824 ')
1825
1826 ########################################
1827 ## <summary>
1828 ##      Create user home directories.
1829 ## </summary>
1830 ## <param name="domain">
1831 ##      <summary>
1832 ##      Domain allowed access.
1833 ##      </summary>
1834 ## </param>
1835 #
1836 interface(`userdom_create_user_home_dirs',`
1837         gen_require(`
1838                 type user_home_dir_t;
1839         ')
1840
1841         allow $1 user_home_dir_t:dir create_dir_perms;
1842 ')
1843
1844 ########################################
1845 ## <summary>
1846 ##      Create user home directories.
1847 ## </summary>
1848 ## <param name="domain">
1849 ##      <summary>
1850 ##      Domain allowed access.
1851 ##      </summary>
1852 ## </param>
1853 #
1854 interface(`userdom_manage_user_home_dirs',`
1855         gen_require(`
1856                 type user_home_dir_t;
1857         ')
1858
1859         allow $1 user_home_dir_t:dir manage_dir_perms;
1860 ')
1861
1862 ########################################
1863 ## <summary>
1864 ##      Relabel to user home directories.
1865 ## </summary>
1866 ## <param name="domain">
1867 ##      <summary>
1868 ##      Domain allowed access.
1869 ##      </summary>
1870 ## </param>
1871 #
1872 interface(`userdom_relabelto_user_home_dirs',`
1873         gen_require(`
1874                 type user_home_dir_t;
1875         ')
1876
1877         allow $1 user_home_dir_t:dir relabelto;
1878 ')
1879
1880
1881 ########################################
1882 ## <summary>
1883 ##      Relabel to user home files.
1884 ## </summary>
1885 ## <param name="domain">
1886 ##      <summary>
1887 ##      Domain allowed access.
1888 ##      </summary>
1889 ## </param>
1890 #
1891 interface(`userdom_relabelto_user_home_files',`
1892         gen_require(`
1893                 type user_home_t;
1894         ')
1895
1896         allow $1 user_home_t:file relabelto;
1897 ')
1898 ########################################
1899 ## <summary>
1900 ##      Relabel user home files.
1901 ## </summary>
1902 ## <param name="domain">
1903 ##      <summary>
1904 ##      Domain allowed access.
1905 ##      </summary>
1906 ## </param>
1907 #
1908 interface(`userdom_relabel_user_home_files',`
1909         gen_require(`
1910                 type user_home_t;
1911         ')
1912
1913         allow $1 user_home_t:file relabel_file_perms;
1914 ')
1915
1916 ########################################
1917 ## <summary>
1918 ##      Create directories in the home dir root with
1919 ##      the user home directory type.
1920 ## </summary>
1921 ## <param name="domain">
1922 ##      <summary>
1923 ##      Domain allowed access.
1924 ##      </summary>
1925 ## </param>
1926 #
1927 interface(`userdom_home_filetrans_user_home_dir',`
1928         gen_require(`
1929                 type user_home_dir_t;
1930         ')
1931
1932         files_home_filetrans($1, user_home_dir_t, dir)
1933 ')
1934
1935 ########################################
1936 ## <summary>
1937 ##      Do a domain transition to the specified
1938 ##      domain when executing a program in the
1939 ##      user home directory.
1940 ## </summary>
1941 ## <desc>
1942 ##      <p>
1943 ##      Do a domain transition to the specified
1944 ##      domain when executing a program in the
1945 ##      user home directory.
1946 ##      </p>
1947 ##      <p>
1948 ##      No interprocess communication (signals, pipes,
1949 ##      etc.) is provided by this interface since
1950 ##      the domains are not owned by this module.
1951 ##      </p>
1952 ## </desc>
1953 ## <param name="source_domain">
1954 ##      <summary>
1955 ##      Domain allowed to transition.
1956 ##      </summary>
1957 ## </param>
1958 ## <param name="target_domain">
1959 ##      <summary>
1960 ##      Domain to transition to.
1961 ##      </summary>
1962 ## </param>
1963 #
1964 interface(`userdom_user_home_domtrans',`
1965         gen_require(`
1966                 type user_home_dir_t, user_home_t;
1967         ')
1968
1969         domain_auto_trans($1, user_home_t, $2)
1970         allow $1 user_home_dir_t:dir search_dir_perms;
1971         files_search_home($1)
1972 ')
1973
1974 ########################################
1975 ## <summary>
1976 ##      Do not audit attempts to search user home content directories.
1977 ## </summary>
1978 ## <param name="domain">
1979 ##      <summary>
1980 ##      Domain to not audit.
1981 ##      </summary>
1982 ## </param>
1983 #
1984 interface(`userdom_dontaudit_search_user_home_content',`
1985         gen_require(`
1986                 type user_home_t;
1987         ')
1988
1989         dontaudit $1 user_home_t:dir search_dir_perms;
1990         fs_dontaudit_list_nfs($1)
1991         fs_dontaudit_list_cifs($1)
1992 ')
1993
1994 ########################################
1995 ## <summary>
1996 ##      List contents of users home directory.
1997 ## </summary>
1998 ## <param name="domain">
1999 ##      <summary>
2000 ##      Domain allowed access.
2001 ##      </summary>
2002 ## </param>
2003 #
2004 interface(`userdom_list_user_home_content',`
2005         gen_require(`
2006                 type user_home_dir_t;
2007                 attribute user_home_type;
2008         ')
2009
2010         files_list_home($1)
2011         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2012 ')
2013
2014 ########################################
2015 ## <summary>
2016 ##      Create, read, write, and delete directories
2017 ##      in a user home subdirectory.
2018 ## </summary>
2019 ## <param name="domain">
2020 ##      <summary>
2021 ##      Domain allowed access.
2022 ##      </summary>
2023 ## </param>
2024 #
2025 interface(`userdom_manage_user_home_content_dirs',`
2026         gen_require(`
2027                 type user_home_dir_t, user_home_t;
2028         ')
2029
2030         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2031         files_search_home($1)
2032 ')
2033
2034 ########################################
2035 ## <summary>
2036 ##      Delete directories in a user home subdirectory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_delete_user_home_content_dirs',`
2045         gen_require(`
2046                 type user_home_t;
2047         ')
2048
2049         allow $1 user_home_t:dir delete_dir_perms;
2050 ')
2051
2052 ########################################
2053 ## <summary>
2054 ##      Delete all directories in a user home subdirectory.
2055 ## </summary>
2056 ## <param name="domain">
2057 ##      <summary>
2058 ##      Domain allowed access.
2059 ##      </summary>
2060 ## </param>
2061 #
2062 interface(`userdom_delete_all_user_home_content_dirs',`
2063         gen_require(`
2064                 attribute user_home_type;
2065         ')
2066
2067         allow $1 user_home_type:dir delete_dir_perms;
2068 ')
2069
2070 ########################################
2071 ## <summary>
2072 ##      Set the attributes of user home files.
2073 ## </summary>
2074 ## <param name="domain">
2075 ##      <summary>
2076 ##      Domain allowed access.
2077 ##      </summary>
2078 ## </param>
2079 ## <rolecap/>
2080 #
2081 interface(`userdom_setattr_user_home_content_files',`
2082         gen_require(`
2083                 type user_home_t;
2084         ')
2085
2086         allow $1 user_home_t:file setattr;
2087 ')
2088
2089 ########################################
2090 ## <summary>
2091 ##      Do not audit attempts to set the
2092 ##      attributes of user home files.
2093 ## </summary>
2094 ## <param name="domain">
2095 ##      <summary>
2096 ##      Domain to not audit.
2097 ##      </summary>
2098 ## </param>
2099 #
2100 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2101         gen_require(`
2102                 type user_home_t;
2103         ')
2104
2105         dontaudit $1 user_home_t:file setattr_file_perms;
2106 ')
2107
2108 ########################################
2109 ## <summary>
2110 ##      Set the attributes of all user home directories.
2111 ## </summary>
2112 ## <param name="domain">
2113 ##      <summary>
2114 ##      Domain allowed access.
2115 ##      </summary>
2116 ## </param>
2117 ## <rolecap/>
2118 #
2119 interface(`userdom_setattr_all_user_home_content_dirs',`
2120         gen_require(`
2121                 attribute user_home_type;
2122         ')
2123
2124         allow $1 user_home_type:dir setattr_dir_perms;
2125 ')
2126
2127 ########################################
2128 ## <summary>
2129 ##      Mmap user home files.
2130 ## </summary>
2131 ## <param name="domain">
2132 ##      <summary>
2133 ##      Domain allowed access.
2134 ##      </summary>
2135 ## </param>
2136 #
2137 interface(`userdom_mmap_user_home_content_files',`
2138         gen_require(`
2139                 type user_home_dir_t, user_home_t;
2140         ')
2141
2142         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2143         files_search_home($1)
2144 ')
2145
2146 ########################################
2147 ## <summary>
2148 ##      Read user home files.
2149 ## </summary>
2150 ## <param name="domain">
2151 ##      <summary>
2152 ##      Domain allowed access.
2153 ##      </summary>
2154 ## </param>
2155 #
2156 interface(`userdom_read_user_home_content_files',`
2157         gen_require(`
2158                 type user_home_dir_t, user_home_t;
2159         ')
2160
2161         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2162         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2163         files_search_home($1)
2164 ')
2165
2166 ########################################
2167 ## <summary>
2168 ##      Do not audit attempts to getattr user home files.
2169 ## </summary>
2170 ## <param name="domain">
2171 ##      <summary>
2172 ##      Domain to not audit.
2173 ##      </summary>
2174 ## </param>
2175 #
2176 interface(`userdom_dontaudit_getattr_user_home_content',`
2177         gen_require(`
2178                 attribute user_home_type;
2179         ')
2180
2181         dontaudit $1 user_home_type:dir getattr;
2182         dontaudit $1 user_home_type:file getattr;
2183 ')
2184
2185 ########################################
2186 ## <summary>
2187 ##      Do not audit attempts to read user home files.
2188 ## </summary>
2189 ## <param name="domain">
2190 ##      <summary>
2191 ##      Domain to not audit.
2192 ##      </summary>
2193 ## </param>
2194 #
2195 interface(`userdom_dontaudit_read_user_home_content_files',`
2196         gen_require(`
2197                 attribute user_home_type;
2198                 type user_home_dir_t;
2199         ')
2200
2201         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2202         dontaudit $1 user_home_type:dir list_dir_perms;
2203         dontaudit $1 user_home_type:file read_file_perms;
2204         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2205 ')
2206
2207 ########################################
2208 ## <summary>
2209 ##      Do not audit attempts to append user home files.
2210 ## </summary>
2211 ## <param name="domain">
2212 ##      <summary>
2213 ##      Domain to not audit.
2214 ##      </summary>
2215 ## </param>
2216 #
2217 interface(`userdom_dontaudit_append_user_home_content_files',`
2218         gen_require(`
2219                 type user_home_t;
2220         ')
2221
2222         dontaudit $1 user_home_t:file append_file_perms;
2223 ')
2224
2225 ########################################
2226 ## <summary>
2227 ##      Do not audit attempts to write user home files.
2228 ## </summary>
2229 ## <param name="domain">
2230 ##      <summary>
2231 ##      Domain to not audit.
2232 ##      </summary>
2233 ## </param>
2234 #
2235 interface(`userdom_dontaudit_write_user_home_content_files',`
2236         gen_require(`
2237                 type user_home_t;
2238         ')
2239
2240         dontaudit $1 user_home_t:file write_file_perms;
2241 ')
2242
2243 ########################################
2244 ## <summary>
2245 ##      Delete files in a user home subdirectory.
2246 ## </summary>
2247 ## <param name="domain">
2248 ##      <summary>
2249 ##      Domain allowed access.
2250 ##      </summary>
2251 ## </param>
2252 #
2253 interface(`userdom_delete_user_home_content_files',`
2254         gen_require(`
2255                 type user_home_t;
2256         ')
2257
2258         allow $1 user_home_t:file delete_file_perms;
2259 ')
2260
2261 ########################################
2262 ## <summary>
2263 ##      Delete all files in a user home subdirectory.
2264 ## </summary>
2265 ## <param name="domain">
2266 ##      <summary>
2267 ##      Domain allowed access.
2268 ##      </summary>
2269 ## </param>
2270 #
2271 interface(`userdom_delete_all_user_home_content_files',`
2272         gen_require(`
2273                 attribute user_home_type;
2274         ')
2275
2276         allow $1 user_home_type:file delete_file_perms;
2277 ')
2278
2279 ########################################
2280 ## <summary>
2281 ##      Delete sock files in a user home subdirectory.
2282 ## </summary>
2283 ## <param name="domain">
2284 ##      <summary>
2285 ##      Domain allowed access.
2286 ##      </summary>
2287 ## </param>
2288 #
2289 interface(`userdom_delete_user_home_content_sock_files',`
2290         gen_require(`
2291                 type user_home_t;
2292         ')
2293
2294         allow $1 user_home_t:sock_file delete_file_perms;
2295 ')
2296
2297 ########################################
2298 ## <summary>
2299 ##      Delete all sock files in a user home subdirectory.
2300 ## </summary>
2301 ## <param name="domain">
2302 ##      <summary>
2303 ##      Domain allowed access.
2304 ##      </summary>
2305 ## </param>
2306 #
2307 interface(`userdom_delete_all_user_home_content_sock_files',`
2308         gen_require(`
2309                 attribute user_home_type;
2310         ')
2311
2312         allow $1 user_home_type:sock_file delete_file_perms;
2313 ')
2314
2315 ########################################
2316 ## <summary>
2317 ##      Do not audit attempts to write user home files.
2318 ## </summary>
2319 ## <param name="domain">
2320 ##      <summary>
2321 ##      Domain to not audit.
2322 ##      </summary>
2323 ## </param>
2324 #
2325 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2326         gen_require(`
2327                 type user_home_t;
2328         ')
2329
2330         dontaudit $1 user_home_t:file relabel_file_perms;
2331 ')
2332
2333 ########################################
2334 ## <summary>
2335 ##      Read user home subdirectory symbolic links.
2336 ## </summary>
2337 ## <param name="domain">
2338 ##      <summary>
2339 ##      Domain allowed access.
2340 ##      </summary>
2341 ## </param>
2342 #
2343 interface(`userdom_read_user_home_content_symlinks',`
2344         gen_require(`
2345                 type user_home_dir_t, user_home_t;
2346         ')
2347
2348         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2349 ')
2350
2351 ########################################
2352 ## <summary>
2353 ##      Execute user home files.
2354 ## </summary>
2355 ## <param name="domain">
2356 ##      <summary>
2357 ##      Domain allowed access.
2358 ##      </summary>
2359 ## </param>
2360 ## <rolecap/>
2361 #
2362 interface(`userdom_exec_user_home_content_files',`
2363         gen_require(`
2364                 type user_home_dir_t;
2365                 attribute user_home_type;
2366         ')
2367
2368         files_search_home($1)
2369         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2370         dontaudit $1 user_home_type:sock_file execute;
2371         ')
2372
2373 ########################################
2374 ## <summary>
2375 ##      Do not audit attempts to execute user home files.
2376 ## </summary>
2377 ## <param name="domain">
2378 ##      <summary>
2379 ##      Domain to not audit.
2380 ##      </summary>
2381 ## </param>
2382 #
2383 interface(`userdom_dontaudit_exec_user_home_content_files',`
2384         gen_require(`
2385                 type user_home_t;
2386         ')
2387
2388         dontaudit $1 user_home_t:file exec_file_perms;
2389 ')
2390
2391 ########################################
2392 ## <summary>
2393 ##      Create, read, write, and delete files
2394 ##      in a user home subdirectory.
2395 ## </summary>
2396 ## <param name="domain">
2397 ##      <summary>
2398 ##      Domain allowed access.
2399 ##      </summary>
2400 ## </param>
2401 #
2402 interface(`userdom_manage_user_home_content_files',`
2403         gen_require(`
2404                 type user_home_dir_t, user_home_t;
2405         ')
2406
2407         manage_files_pattern($1, user_home_t, user_home_t)
2408         allow $1 user_home_dir_t:dir search_dir_perms;
2409         files_search_home($1)
2410 ')
2411
2412 ########################################
2413 ## <summary>
2414 ##      Do not audit attempts to create, read, write, and delete directories
2415 ##      in a user home subdirectory.
2416 ## </summary>
2417 ## <param name="domain">
2418 ##      <summary>
2419 ##      Domain to not audit.
2420 ##      </summary>
2421 ## </param>
2422 #
2423 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2424         gen_require(`
2425                 type user_home_dir_t, user_home_t;
2426         ')
2427
2428         dontaudit $1 user_home_t:dir manage_dir_perms;
2429 ')
2430
2431 ########################################
2432 ## <summary>
2433 ##      Create, read, write, and delete symbolic links
2434 ##      in a user home subdirectory.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      Domain allowed access.
2439 ##      </summary>
2440 ## </param>
2441 #
2442 interface(`userdom_manage_user_home_content_symlinks',`
2443         gen_require(`
2444                 type user_home_dir_t, user_home_t;
2445         ')
2446
2447         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2448         allow $1 user_home_dir_t:dir search_dir_perms;
2449         files_search_home($1)
2450 ')
2451
2452 ########################################
2453 ## <summary>
2454 ##      Delete symbolic links in a user home directory.
2455 ## </summary>
2456 ## <param name="domain">
2457 ##      <summary>
2458 ##      Domain allowed access.
2459 ##      </summary>
2460 ## </param>
2461 #
2462 interface(`userdom_delete_user_home_content_symlinks',`
2463         gen_require(`
2464                 type user_home_t;
2465         ')
2466
2467         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2468 ')
2469
2470 ########################################
2471 ## <summary>
2472 ##      Delete all symbolic links in a user home directory.
2473 ## </summary>
2474 ## <param name="domain">
2475 ##      <summary>
2476 ##      Domain allowed access.
2477 ##      </summary>
2478 ## </param>
2479 #
2480 interface(`userdom_delete_all_user_home_content_symlinks',`
2481         gen_require(`
2482                 attribute user_home_type;
2483         ')
2484
2485         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2486 ')
2487
2488 ########################################
2489 ## <summary>
2490 ##      Create, read, write, and delete named pipes
2491 ##      in a user home subdirectory.
2492 ## </summary>
2493 ## <param name="domain">
2494 ##      <summary>
2495 ##      Domain allowed access.
2496 ##      </summary>
2497 ## </param>
2498 #
2499 interface(`userdom_manage_user_home_content_pipes',`
2500         gen_require(`
2501                 type user_home_dir_t, user_home_t;
2502         ')
2503
2504         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2505         allow $1 user_home_dir_t:dir search_dir_perms;
2506         files_search_home($1)
2507 ')
2508
2509 ########################################
2510 ## <summary>
2511 ##      Create, read, write, and delete named sockets
2512 ##      in a user home subdirectory.
2513 ## </summary>
2514 ## <param name="domain">
2515 ##      <summary>
2516 ##      Domain allowed access.
2517 ##      </summary>
2518 ## </param>
2519 #
2520 interface(`userdom_manage_user_home_content_sockets',`
2521         gen_require(`
2522                 type user_home_dir_t, user_home_t;
2523         ')
2524
2525         allow $1 user_home_dir_t:dir search_dir_perms;
2526         manage_sock_files_pattern($1, user_home_t, user_home_t)
2527         files_search_home($1)
2528 ')
2529
2530 ########################################
2531 ## <summary>
2532 ##      Create objects in a user home directory
2533 ##      with an automatic type transition to
2534 ##      a specified private type.
2535 ## </summary>
2536 ## <param name="domain">
2537 ##      <summary>
2538 ##      Domain allowed access.
2539 ##      </summary>
2540 ## </param>
2541 ## <param name="private_type">
2542 ##      <summary>
2543 ##      The type of the object to create.
2544 ##      </summary>
2545 ## </param>
2546 ## <param name="object_class">
2547 ##      <summary>
2548 ##      The class of the object to be created.
2549 ##      </summary>
2550 ## </param>
2551 #
2552 interface(`userdom_user_home_dir_filetrans',`
2553         gen_require(`
2554                 type user_home_dir_t;
2555         ')
2556
2557         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2558         files_search_home($1)
2559 ')
2560
2561 ########################################
2562 ## <summary>
2563 ##      Create objects in a user home directory
2564 ##      with an automatic type transition to
2565 ##      a specified private type.
2566 ## </summary>
2567 ## <param name="domain">
2568 ##      <summary>
2569 ##      Domain allowed access.
2570 ##      </summary>
2571 ## </param>
2572 ## <param name="private_type">
2573 ##      <summary>
2574 ##      The type of the object to create.
2575 ##      </summary>
2576 ## </param>
2577 ## <param name="object_class">
2578 ##      <summary>
2579 ##      The class of the object to be created.
2580 ##      </summary>
2581 ## </param>
2582 #
2583 interface(`userdom_user_home_content_filetrans',`
2584         gen_require(`
2585                 type user_home_dir_t, user_home_t;
2586         ')
2587
2588         filetrans_pattern($1, user_home_t, $2, $3)
2589         allow $1 user_home_dir_t:dir search_dir_perms;
2590         files_search_home($1)
2591 ')
2592
2593 ########################################
2594 ## <summary>
2595 ##      Create objects in a user home directory
2596 ##      with an automatic type transition to
2597 ##      the user home file type.
2598 ## </summary>
2599 ## <param name="domain">
2600 ##      <summary>
2601 ##      Domain allowed access.
2602 ##      </summary>
2603 ## </param>
2604 ## <param name="object_class">
2605 ##      <summary>
2606 ##      The class of the object to be created.
2607 ##      </summary>
2608 ## </param>
2609 #
2610 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2611         gen_require(`
2612                 type user_home_dir_t, user_home_t;
2613         ')
2614
2615         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2616         files_search_home($1)
2617 ')
2618
2619 ########################################
2620 ## <summary>
2621 ##      Write to user temporary named sockets.
2622 ## </summary>
2623 ## <param name="domain">
2624 ##      <summary>
2625 ##      Domain allowed access.
2626 ##      </summary>
2627 ## </param>
2628 #
2629 interface(`userdom_write_user_tmp_sockets',`
2630         gen_require(`
2631                 type user_tmp_t;
2632         ')
2633
2634         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2635         files_search_tmp($1)
2636 ')
2637
2638 ########################################
2639 ## <summary>
2640 ##      List user temporary directories.
2641 ## </summary>
2642 ## <param name="domain">
2643 ##      <summary>
2644 ##      Domain allowed access.
2645 ##      </summary>
2646 ## </param>
2647 #
2648 interface(`userdom_list_user_tmp',`
2649         gen_require(`
2650                 type user_tmp_t;
2651         ')
2652
2653         allow $1 user_tmp_t:dir list_dir_perms;
2654         files_search_tmp($1)
2655 ')
2656
2657 ########################################
2658 ## <summary>
2659 ##      Do not audit attempts to list user
2660 ##      temporary directories.
2661 ## </summary>
2662 ## <param name="domain">
2663 ##      <summary>
2664 ##      Domain to not audit.
2665 ##      </summary>
2666 ## </param>
2667 #
2668 interface(`userdom_dontaudit_list_user_tmp',`
2669         gen_require(`
2670                 type user_tmp_t;
2671         ')
2672
2673         dontaudit $1 user_tmp_t:dir list_dir_perms;
2674 ')
2675
2676 ########################################
2677 ## <summary>
2678 ##      Do not audit attempts to manage users
2679 ##      temporary directories.
2680 ## </summary>
2681 ## <param name="domain">
2682 ##      <summary>
2683 ##      Domain to not audit.
2684 ##      </summary>
2685 ## </param>
2686 #
2687 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2688         gen_require(`
2689                 type user_tmp_t;
2690         ')
2691
2692         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2693 ')
2694
2695 ########################################
2696 ## <summary>
2697 ##      Read user temporary files.
2698 ## </summary>
2699 ## <param name="domain">
2700 ##      <summary>
2701 ##      Domain allowed access.
2702 ##      </summary>
2703 ## </param>
2704 #
2705 interface(`userdom_read_user_tmp_files',`
2706         gen_require(`
2707                 type user_tmp_t;
2708         ')
2709
2710         read_files_pattern($1, user_tmp_t, user_tmp_t)
2711         allow $1 user_tmp_t:dir list_dir_perms;
2712         files_search_tmp($1)
2713 ')
2714
2715 ########################################
2716 ## <summary>
2717 ##      Do not audit attempts to read users
2718 ##      temporary files.
2719 ## </summary>
2720 ## <param name="domain">
2721 ##      <summary>
2722 ##      Domain to not audit.
2723 ##      </summary>
2724 ## </param>
2725 #
2726 interface(`userdom_dontaudit_read_user_tmp_files',`
2727         gen_require(`
2728                 type user_tmp_t;
2729         ')
2730
2731         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2732 ')
2733
2734 ########################################
2735 ## <summary>
2736 ##      Do not audit attempts to append users
2737 ##      temporary files.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain to not audit.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_dontaudit_append_user_tmp_files',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         dontaudit $1 user_tmp_t:file append_file_perms;
2751 ')
2752
2753 ########################################
2754 ## <summary>
2755 ##      Read and write user temporary files.
2756 ## </summary>
2757 ## <param name="domain">
2758 ##      <summary>
2759 ##      Domain allowed access.
2760 ##      </summary>
2761 ## </param>
2762 #
2763 interface(`userdom_rw_user_tmp_files',`
2764         gen_require(`
2765                 type user_tmp_t;
2766         ')
2767
2768         allow $1 user_tmp_t:dir list_dir_perms;
2769         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2770         files_search_tmp($1)
2771 ')
2772
2773 ########################################
2774 ## <summary>
2775 ##      Do not audit attempts to manage users
2776 ##      temporary files.
2777 ## </summary>
2778 ## <param name="domain">
2779 ##      <summary>
2780 ##      Domain to not audit.
2781 ##      </summary>
2782 ## </param>
2783 #
2784 interface(`userdom_dontaudit_manage_user_tmp_files',`
2785         gen_require(`
2786                 type user_tmp_t;
2787         ')
2788
2789         dontaudit $1 user_tmp_t:file manage_file_perms;
2790 ')
2791
2792 ########################################
2793 ## <summary>
2794 ##      Read user temporary symbolic links.
2795 ## </summary>
2796 ## <param name="domain">
2797 ##      <summary>
2798 ##      Domain allowed access.
2799 ##      </summary>
2800 ## </param>
2801 #
2802 interface(`userdom_read_user_tmp_symlinks',`
2803         gen_require(`
2804                 type user_tmp_t;
2805         ')
2806
2807         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2808         allow $1 user_tmp_t:dir list_dir_perms;
2809         files_search_tmp($1)
2810 ')
2811
2812 ########################################
2813 ## <summary>
2814 ##      Create, read, write, and delete user
2815 ##      temporary directories.
2816 ## </summary>
2817 ## <param name="domain">
2818 ##      <summary>
2819 ##      Domain allowed access.
2820 ##      </summary>
2821 ## </param>
2822 #
2823 interface(`userdom_manage_user_tmp_dirs',`
2824         gen_require(`
2825                 type user_tmp_t;
2826         ')
2827
2828         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2829         files_search_tmp($1)
2830 ')
2831
2832 ########################################
2833 ## <summary>
2834 ##      Create, read, write, and delete user
2835 ##      temporary files.
2836 ## </summary>
2837 ## <param name="domain">
2838 ##      <summary>
2839 ##      Domain allowed access.
2840 ##      </summary>
2841 ## </param>
2842 #
2843 interface(`userdom_manage_user_tmp_files',`
2844         gen_require(`
2845                 type user_tmp_t;
2846         ')
2847
2848         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2849         files_search_tmp($1)
2850 ')
2851
2852 ########################################
2853 ## <summary>
2854 ##      Create, read, write, and delete user
2855 ##      temporary symbolic links.
2856 ## </summary>
2857 ## <param name="domain">
2858 ##      <summary>
2859 ##      Domain allowed access.
2860 ##      </summary>
2861 ## </param>
2862 #
2863 interface(`userdom_manage_user_tmp_symlinks',`
2864         gen_require(`
2865                 type user_tmp_t;
2866         ')
2867
2868         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2869         files_search_tmp($1)
2870 ')
2871
2872 ########################################
2873 ## <summary>
2874 ##      Create, read, write, and delete user
2875 ##      temporary named pipes.
2876 ## </summary>
2877 ## <param name="domain">
2878 ##      <summary>
2879 ##      Domain allowed access.
2880 ##      </summary>
2881 ## </param>
2882 #
2883 interface(`userdom_manage_user_tmp_pipes',`
2884         gen_require(`
2885                 type user_tmp_t;
2886         ')
2887
2888         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2889         files_search_tmp($1)
2890 ')
2891
2892 ########################################
2893 ## <summary>
2894 ##      Create, read, write, and delete user
2895 ##      temporary named sockets.
2896 ## </summary>
2897 ## <param name="domain">
2898 ##      <summary>
2899 ##      Domain allowed access.
2900 ##      </summary>
2901 ## </param>
2902 #
2903 interface(`userdom_manage_user_tmp_sockets',`
2904         gen_require(`
2905                 type user_tmp_t;
2906         ')
2907
2908         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2909         files_search_tmp($1)
2910 ')
2911
2912 ########################################
2913 ## <summary>
2914 ##      Create objects in a user temporary directory
2915 ##      with an automatic type transition to
2916 ##      a specified private type.
2917 ## </summary>
2918 ## <param name="domain">
2919 ##      <summary>
2920 ##      Domain allowed access.
2921 ##      </summary>
2922 ## </param>
2923 ## <param name="private_type">
2924 ##      <summary>
2925 ##      The type of the object to create.
2926 ##      </summary>
2927 ## </param>
2928 ## <param name="object_class">
2929 ##      <summary>
2930 ##      The class of the object to be created.
2931 ##      </summary>
2932 ## </param>
2933 #
2934 interface(`userdom_user_tmp_filetrans',`
2935         gen_require(`
2936                 type user_tmp_t;
2937         ')
2938
2939         filetrans_pattern($1, user_tmp_t, $2, $3)
2940         files_search_tmp($1)
2941 ')
2942
2943 ########################################
2944 ## <summary>
2945 ##      Create objects in the temporary directory
2946 ##      with an automatic type transition to
2947 ##      the user temporary type.
2948 ## </summary>
2949 ## <param name="domain">
2950 ##      <summary>
2951 ##      Domain allowed access.
2952 ##      </summary>
2953 ## </param>
2954 ## <param name="object_class">
2955 ##      <summary>
2956 ##      The class of the object to be created.
2957 ##      </summary>
2958 ## </param>
2959 #
2960 interface(`userdom_tmp_filetrans_user_tmp',`
2961         gen_require(`
2962                 type user_tmp_t;
2963         ')
2964
2965         files_tmp_filetrans($1, user_tmp_t, $2)
2966 ')
2967
2968 ########################################
2969 ## <summary>
2970 ##      Read user tmpfs files.
2971 ## </summary>
2972 ## <param name="domain">
2973 ##      <summary>
2974 ##      Domain allowed access.
2975 ##      </summary>
2976 ## </param>
2977 #
2978 interface(`userdom_read_user_tmpfs_files',`
2979         gen_require(`
2980                 type user_tmpfs_t;
2981         ')
2982
2983         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2984         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2985         allow $1 user_tmpfs_t:dir list_dir_perms;
2986         fs_search_tmpfs($1)
2987 ')
2988
2989 ########################################
2990 ## <summary>
2991 ##      Read/Write user tmpfs files.
2992 ## </summary>
2993 ## <param name="domain">
2994 ##      <summary>
2995 ##      Domain allowed access.
2996 ##      </summary>
2997 ## </param>
2998 #
2999 interface(`userdom_rw_user_tmpfs_files',`
3000         gen_require(`
3001                 type user_tmpfs_t;
3002         ')
3003
3004         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3005         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3006         allow $1 user_tmpfs_t:dir list_dir_perms;
3007         fs_search_tmpfs($1)
3008 ')
3009
3010 ########################################
3011 ## <summary>
3012 ##      Get the attributes of a user domain tty.
3013 ## </summary>
3014 ## <param name="domain">
3015 ##      <summary>
3016 ##      Domain allowed access.
3017 ##      </summary>
3018 ## </param>
3019 #
3020 interface(`userdom_getattr_user_ttys',`
3021         gen_require(`
3022                 type user_tty_device_t;
3023         ')
3024
3025         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3026 ')
3027
3028 ########################################
3029 ## <summary>
3030 ##      Do not audit attempts to get the attributes of a user domain tty.
3031 ## </summary>
3032 ## <param name="domain">
3033 ##      <summary>
3034 ##      Domain to not audit.
3035 ##      </summary>
3036 ## </param>
3037 #
3038 interface(`userdom_dontaudit_getattr_user_ttys',`
3039         gen_require(`
3040                 type user_tty_device_t;
3041         ')
3042
3043         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3044 ')
3045
3046 ########################################
3047 ## <summary>
3048 ##      Set the attributes of a user domain tty.
3049 ## </summary>
3050 ## <param name="domain">
3051 ##      <summary>
3052 ##      Domain allowed access.
3053 ##      </summary>
3054 ## </param>
3055 #
3056 interface(`userdom_setattr_user_ttys',`
3057         gen_require(`
3058                 type user_tty_device_t;
3059         ')
3060
3061         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3062 ')
3063
3064 ########################################
3065 ## <summary>
3066 ##      Do not audit attempts to set the attributes of a user domain tty.
3067 ## </summary>
3068 ## <param name="domain">
3069 ##      <summary>
3070 ##      Domain to not audit.
3071 ##      </summary>
3072 ## </param>
3073 #
3074 interface(`userdom_dontaudit_setattr_user_ttys',`
3075         gen_require(`
3076                 type user_tty_device_t;
3077         ')
3078
3079         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3080 ')
3081
3082 ########################################
3083 ## <summary>
3084 ##      Read and write a user domain tty.
3085 ## </summary>
3086 ## <param name="domain">
3087 ##      <summary>
3088 ##      Domain allowed access.
3089 ##      </summary>
3090 ## </param>
3091 #
3092 interface(`userdom_use_user_ttys',`
3093         gen_require(`
3094                 type user_tty_device_t;
3095         ')
3096
3097         allow $1 user_tty_device_t:chr_file rw_term_perms;
3098 ')
3099
3100 ########################################
3101 ## <summary>
3102 ##      Read and write a inherited user domain tty.
3103 ## </summary>
3104 ## <param name="domain">
3105 ##      <summary>
3106 ##      Domain allowed access.
3107 ##      </summary>
3108 ## </param>
3109 #
3110 interface(`userdom_use_inherited_user_ttys',`
3111         gen_require(`
3112                 type user_tty_device_t;
3113         ')
3114
3115         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3116 ')
3117
3118 ########################################
3119 ## <summary>
3120 ##      Read and write a user domain pty.
3121 ## </summary>
3122 ## <param name="domain">
3123 ##      <summary>
3124 ##      Domain allowed access.
3125 ##      </summary>
3126 ## </param>
3127 #
3128 interface(`userdom_use_user_ptys',`
3129         gen_require(`
3130                 type user_devpts_t;
3131         ')
3132
3133         allow $1 user_devpts_t:chr_file rw_term_perms;
3134 ')
3135
3136 ########################################
3137 ## <summary>
3138 ##      Read and write a inherited user domain pty.
3139 ## </summary>
3140 ## <param name="domain">
3141 ##      <summary>
3142 ##      Domain allowed access.
3143 ##      </summary>
3144 ## </param>
3145 #
3146 interface(`userdom_use_inherited_user_ptys',`
3147         gen_require(`
3148                 type user_devpts_t;
3149         ')
3150
3151         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3152 ')
3153
3154 ########################################
3155 ## <summary>
3156 ##      Read and write a inherited user TTYs and PTYs.
3157 ## </summary>
3158 ## <desc>
3159 ##      <p>
3160 ##      Allow the specified domain to read and write inherited user
3161 ##      TTYs and PTYs. This will allow the domain to
3162 ##      interact with the user via the terminal. Typically
3163 ##      all interactive applications will require this
3164 ##      access.
3165 ##      </p>
3166 ## </desc>
3167 ## <param name="domain">
3168 ##      <summary>
3169 ##      Domain allowed access.
3170 ##      </summary>
3171 ## </param>
3172 ## <infoflow type="both" weight="10"/>
3173 #
3174 interface(`userdom_use_inherited_user_terminals',`
3175         gen_require(`
3176                 type user_tty_device_t, user_devpts_t;
3177         ')
3178
3179         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3180         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3181 ')
3182
3183 #######################################
3184 ## <summary>
3185 ##  Allow attempts to read and write
3186 ##  a user domain tty and pty.
3187 ## </summary>
3188 ## <param name="domain">
3189 ##  <summary>
3190 ##  Domain to not audit.
3191 ##  </summary>
3192 ## </param>
3193 #
3194 interface(`userdom_use_user_terminals',`
3195     gen_require(`
3196         type user_tty_device_t, user_devpts_t;
3197     ')
3198
3199     allow $1 user_tty_device_t:chr_file rw_term_perms;
3200     allow $1 user_devpts_t:chr_file rw_term_perms;
3201 ')
3202
3203 ########################################
3204 ## <summary>
3205 ##      Do not audit attempts to read and write
3206 ##      a user domain tty and pty.
3207 ## </summary>
3208 ## <param name="domain">
3209 ##      <summary>
3210 ##      Domain to not audit.
3211 ##      </summary>
3212 ## </param>
3213 #
3214 interface(`userdom_dontaudit_use_user_terminals',`
3215         gen_require(`
3216                 type user_tty_device_t, user_devpts_t;
3217         ')
3218
3219         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3220         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3221 ')
3222
3223
3224 ########################################
3225 ## <summary>
3226 ##      Get attributes of user domain tty and pty.
3227 ## </summary>
3228 ## <param name="domain">
3229 ##      <summary>
3230 ##      Domain allowed access.
3231 ##      </summary>
3232 ## </param>
3233 #
3234 interface(`userdom_getattr_user_terminals',`
3235         gen_require(`
3236                 type user_tty_device_t, user_devpts_t;
3237         ')
3238
3239         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3240 ')
3241
3242 ########################################
3243 ## <summary>
3244 ##      Execute a shell in all user domains.  This
3245 ##      is an explicit transition, requiring the
3246 ##      caller to use setexeccon().
3247 ## </summary>
3248 ## <param name="domain">
3249 ##      <summary>
3250 ##      Domain allowed to transition.
3251 ##      </summary>
3252 ## </param>
3253 #
3254 interface(`userdom_spec_domtrans_all_users',`
3255         gen_require(`
3256                 attribute userdomain;
3257         ')
3258
3259         corecmd_shell_spec_domtrans($1, userdomain)
3260         allow userdomain $1:fd use;
3261         allow userdomain $1:fifo_file rw_file_perms;
3262         allow userdomain $1:process sigchld;
3263 ')
3264
3265 ########################################
3266 ## <summary>
3267 ##      Execute an Xserver session in all unprivileged user domains.  This
3268 ##      is an explicit transition, requiring the
3269 ##      caller to use setexeccon().
3270 ## </summary>
3271 ## <param name="domain">
3272 ##      <summary>
3273 ##      Domain allowed to transition.
3274 ##      </summary>
3275 ## </param>
3276 #
3277 interface(`userdom_xsession_spec_domtrans_all_users',`
3278         gen_require(`
3279                 attribute userdomain;
3280         ')
3281
3282         xserver_xsession_spec_domtrans($1, userdomain)
3283         allow userdomain $1:fd use;
3284         allow userdomain $1:fifo_file rw_file_perms;
3285         allow userdomain $1:process sigchld;
3286 ')
3287
3288 ########################################
3289 ## <summary>
3290 ##      Execute a shell in all unprivileged user domains.  This
3291 ##      is an explicit transition, requiring the
3292 ##      caller to use setexeccon().
3293 ## </summary>
3294 ## <param name="domain">
3295 ##      <summary>
3296 ##      Domain allowed to transition.
3297 ##      </summary>
3298 ## </param>
3299 #
3300 interface(`userdom_spec_domtrans_unpriv_users',`
3301         gen_require(`
3302                 attribute unpriv_userdomain;
3303         ')
3304
3305         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3306         allow unpriv_userdomain $1:fd use;
3307         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3308         allow unpriv_userdomain $1:process sigchld;
3309 ')
3310
3311 ########################################
3312 ## <summary>
3313 ##      Execute an Xserver session in all unprivileged user domains.  This
3314 ##      is an explicit transition, requiring the
3315 ##      caller to use setexeccon().
3316 ## </summary>
3317 ## <param name="domain">
3318 ##      <summary>
3319 ##      Domain allowed to transition.
3320 ##      </summary>
3321 ## </param>
3322 #
3323 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3324         gen_require(`
3325                 attribute unpriv_userdomain;
3326         ')
3327
3328         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3329         allow unpriv_userdomain $1:fd use;
3330         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3331         allow unpriv_userdomain $1:process sigchld;
3332 ')
3333
3334 ########################################
3335 ## <summary>
3336 ##      Manage unpriviledged user SysV sempaphores.
3337 ## </summary>
3338 ## <param name="domain">
3339 ##      <summary>
3340 ##      Domain allowed access.
3341 ##      </summary>
3342 ## </param>
3343 #
3344 interface(`userdom_manage_unpriv_user_semaphores',`
3345         gen_require(`
3346                 attribute unpriv_userdomain;
3347         ')
3348
3349         allow $1 unpriv_userdomain:sem create_sem_perms;
3350 ')
3351
3352 ########################################
3353 ## <summary>
3354 ##      Manage unpriviledged user SysV shared
3355 ##      memory segments.
3356 ## </summary>
3357 ## <param name="domain">
3358 ##      <summary>
3359 ##      Domain allowed access.
3360 ##      </summary>
3361 ## </param>
3362 #
3363 interface(`userdom_manage_unpriv_user_shared_mem',`
3364         gen_require(`
3365                 attribute unpriv_userdomain;
3366         ')
3367
3368         allow $1 unpriv_userdomain:shm create_shm_perms;
3369 ')
3370
3371 ########################################
3372 ## <summary>
3373 ##      Execute bin_t in the unprivileged user domains. This
3374 ##      is an explicit transition, requiring the
3375 ##      caller to use setexeccon().
3376 ## </summary>
3377 ## <param name="domain">
3378 ##      <summary>
3379 ##      Domain allowed to transition.
3380 ##      </summary>
3381 ## </param>
3382 #
3383 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3384         gen_require(`
3385                 attribute unpriv_userdomain;
3386         ')
3387
3388         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3389         allow unpriv_userdomain $1:fd use;
3390         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3391         allow unpriv_userdomain $1:process sigchld;
3392 ')
3393
3394 ########################################
3395 ## <summary>
3396 ##      Execute all entrypoint files in unprivileged user
3397 ##      domains. This is an explicit transition, requiring the
3398 ##      caller to use setexeccon().
3399 ## </summary>
3400 ## <param name="domain">
3401 ##      <summary>
3402 ##      Domain allowed access.
3403 ##      </summary>
3404 ## </param>
3405 #
3406 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3407         gen_require(`
3408                 attribute unpriv_userdomain;
3409         ')
3410
3411         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3412         allow unpriv_userdomain $1:fd use;
3413         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3414         allow unpriv_userdomain $1:process sigchld;
3415 ')
3416
3417 ########################################
3418 ## <summary>
3419 ##      Search users home directories.
3420 ## </summary>
3421 ## <param name="domain">
3422 ##      <summary>
3423 ##      Domain allowed access.
3424 ##      </summary>
3425 ## </param>
3426 #
3427 interface(`userdom_search_user_home_content',`
3428         gen_require(`
3429                 type user_home_dir_t;
3430                 attribute user_home_type;
3431         ')
3432
3433         files_list_home($1)
3434         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3435         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3436 ')
3437
3438 ########################################
3439 ## <summary>
3440 ##      Send general signals to unprivileged user domains.
3441 ## </summary>
3442 ## <param name="domain">
3443 ##      <summary>
3444 ##      Domain allowed access.
3445 ##      </summary>
3446 ## </param>
3447 #
3448 interface(`userdom_signal_unpriv_users',`
3449         gen_require(`
3450                 attribute unpriv_userdomain;
3451         ')
3452
3453         allow $1 unpriv_userdomain:process signal;
3454 ')
3455
3456 ########################################
3457 ## <summary>
3458 ##      Inherit the file descriptors from unprivileged user domains.
3459 ## </summary>
3460 ## <param name="domain">
3461 ##      <summary>
3462 ##      Domain allowed access.
3463 ##      </summary>
3464 ## </param>
3465 #
3466 interface(`userdom_use_unpriv_users_fds',`
3467         gen_require(`
3468                 attribute unpriv_userdomain;
3469         ')
3470
3471         allow $1 unpriv_userdomain:fd use;
3472 ')
3473
3474 ########################################
3475 ## <summary>
3476 ##      Do not audit attempts to inherit the file descriptors
3477 ##      from unprivileged user domains.
3478 ## </summary>
3479 ## <desc>
3480 ##      <p>
3481 ##      Do not audit attempts to inherit the file descriptors
3482 ##      from unprivileged user domains. This will supress
3483 ##      SELinux denial messages when the specified domain is denied
3484 ##      the permission to inherit these file descriptors.
3485 ##      </p>
3486 ## </desc>
3487 ## <param name="domain">
3488 ##      <summary>
3489 ##      Domain to not audit.
3490 ##      </summary>
3491 ## </param>
3492 ## <infoflow type="none"/>
3493 #
3494 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3495         gen_require(`
3496                 attribute unpriv_userdomain;
3497         ')
3498
3499         dontaudit $1 unpriv_userdomain:fd use;
3500 ')
3501
3502 ########################################
3503 ## <summary>
3504 ##      Do not audit attempts to use user ptys.
3505 ## </summary>
3506 ## <param name="domain">
3507 ##      <summary>
3508 ##      Domain to not audit.
3509 ##      </summary>
3510 ## </param>
3511 #
3512 interface(`userdom_dontaudit_use_user_ptys',`
3513         gen_require(`
3514                 type user_devpts_t;
3515         ')
3516
3517         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3518 ')
3519
3520 ########################################
3521 ## <summary>
3522 ##      Relabel files to unprivileged user pty types.
3523 ## </summary>
3524 ## <param name="domain">
3525 ##      <summary>
3526 ##      Domain allowed access.
3527 ##      </summary>
3528 ## </param>
3529 #
3530 interface(`userdom_relabelto_user_ptys',`
3531         gen_require(`
3532                 type user_devpts_t;
3533         ')
3534
3535         allow $1 user_devpts_t:chr_file relabelto;
3536 ')
3537
3538 ########################################
3539 ## <summary>
3540 ##      Do not audit attempts to relabel files from
3541 ##      user pty types.
3542 ## </summary>
3543 ## <param name="domain">
3544 ##      <summary>
3545 ##      Domain to not audit.
3546 ##      </summary>
3547 ## </param>
3548 #
3549 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3550         gen_require(`
3551                 type user_devpts_t;
3552         ')
3553
3554         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3555 ')
3556
3557 ########################################
3558 ## <summary>
3559 ##      Write all users files in /tmp
3560 ## </summary>
3561 ## <param name="domain">
3562 ##      <summary>
3563 ##      Domain allowed access.
3564 ##      </summary>
3565 ## </param>
3566 #
3567 interface(`userdom_write_user_tmp_files',`
3568         gen_require(`
3569                 type user_tmp_t;
3570         ')
3571
3572         write_files_pattern($1, user_tmp_t, user_tmp_t)
3573 ')
3574
3575 ########################################
3576 ## <summary>
3577 ##      Do not audit attempts to write users
3578 ##      temporary files.
3579 ## </summary>
3580 ## <param name="domain">
3581 ##      <summary>
3582 ##      Domain to not audit.
3583 ##      </summary>
3584 ## </param>
3585 #
3586 interface(`userdom_dontaudit_write_user_tmp_files',`
3587         gen_require(`
3588                 type user_tmp_t;
3589         ')
3590
3591         dontaudit $1 user_tmp_t:file write;
3592 ')
3593
3594 ########################################
3595 ## <summary>
3596 ##      Do not audit attempts to read/write users
3597 ##      temporary fifo files.
3598 ## </summary>
3599 ## <param name="domain">
3600 ##      <summary>
3601 ##      Domain to not audit.
3602 ##      </summary>
3603 ## </param>
3604 #
3605 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3606         gen_require(`
3607                 type user_tmp_t;
3608         ')
3609
3610         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3611 ')
3612
3613 ########################################
3614 ## <summary>
3615 ##      Do not audit attempts to use user ttys.
3616 ## </summary>
3617 ## <param name="domain">
3618 ##      <summary>
3619 ##      Domain to not audit.
3620 ##      </summary>
3621 ## </param>
3622 #
3623 interface(`userdom_dontaudit_use_user_ttys',`
3624         gen_require(`
3625                 type user_tty_device_t;
3626         ')
3627
3628         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3629 ')
3630
3631 ########################################
3632 ## <summary>
3633 ##      Read the process state of all user domains.
3634 ## </summary>
3635 ## <param name="domain">
3636 ##      <summary>
3637 ##      Domain allowed access.
3638 ##      </summary>
3639 ## </param>
3640 #
3641 interface(`userdom_read_all_users_state',`
3642         gen_require(`
3643                 attribute userdomain;
3644         ')
3645
3646         read_files_pattern($1, userdomain, userdomain)
3647         read_lnk_files_pattern($1,userdomain,userdomain)
3648         kernel_search_proc($1)
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Get the attributes of all user domains.
3654 ## </summary>
3655 ## <param name="domain">
3656 ##      <summary>
3657 ##      Domain allowed access.
3658 ##      </summary>
3659 ## </param>
3660 #
3661 interface(`userdom_getattr_all_users',`
3662         gen_require(`
3663                 attribute userdomain;
3664         ')
3665
3666         allow $1 userdomain:process getattr;
3667 ')
3668
3669 ########################################
3670 ## <summary>
3671 ##      Inherit the file descriptors from all user domains
3672 ## </summary>
3673 ## <param name="domain">
3674 ##      <summary>
3675 ##      Domain allowed access.
3676 ##      </summary>
3677 ## </param>
3678 #
3679 interface(`userdom_use_all_users_fds',`
3680         gen_require(`
3681                 attribute userdomain;
3682         ')
3683
3684         allow $1 userdomain:fd use;
3685 ')
3686
3687 ########################################
3688 ## <summary>
3689 ##      Do not audit attempts to inherit the file
3690 ##      descriptors from any user domains.
3691 ## </summary>
3692 ## <param name="domain">
3693 ##      <summary>
3694 ##      Domain to not audit.
3695 ##      </summary>
3696 ## </param>
3697 #
3698 interface(`userdom_dontaudit_use_all_users_fds',`
3699         gen_require(`
3700                 attribute userdomain;
3701         ')
3702
3703         dontaudit $1 userdomain:fd use;
3704 ')
3705
3706 ########################################
3707 ## <summary>
3708 ##      Send general signals to all user domains.
3709 ## </summary>
3710 ## <param name="domain">
3711 ##      <summary>
3712 ##      Domain allowed access.
3713 ##      </summary>
3714 ## </param>
3715 #
3716 interface(`userdom_signal_all_users',`
3717         gen_require(`
3718                 attribute userdomain;
3719         ')
3720
3721         allow $1 userdomain:process signal;
3722 ')
3723
3724 ########################################
3725 ## <summary>
3726 ##      Send kill signals to all user domains.
3727 ## </summary>
3728 ## <param name="domain">
3729 ##      <summary>
3730 ##      Domain allowed access.
3731 ##      </summary>
3732 ## </param>
3733 #
3734 interface(`userdom_kill_all_users',`
3735         gen_require(`
3736                 attribute userdomain;
3737         ')
3738
3739         allow $1 userdomain:process sigkill;
3740 ')
3741
3742 ########################################
3743 ## <summary>
3744 ##      Send a SIGCHLD signal to all user domains.
3745 ## </summary>
3746 ## <param name="domain">
3747 ##      <summary>
3748 ##      Domain allowed access.
3749 ##      </summary>
3750 ## </param>
3751 #
3752 interface(`userdom_sigchld_all_users',`
3753         gen_require(`
3754                 attribute userdomain;
3755         ')
3756
3757         allow $1 userdomain:process sigchld;
3758 ')
3759
3760 ########################################
3761 ## <summary>
3762 ##      Create keys for all user domains.
3763 ## </summary>
3764 ## <param name="domain">
3765 ##      <summary>
3766 ##      Domain allowed access.
3767 ##      </summary>
3768 ## </param>
3769 #
3770 interface(`userdom_create_all_users_keys',`
3771         gen_require(`
3772                 attribute userdomain;
3773         ')
3774
3775         allow $1 userdomain:key create;
3776 ')
3777
3778 ########################################
3779 ## <summary>
3780 ##      Send a dbus message to all user domains.
3781 ## </summary>
3782 ## <param name="domain">
3783 ##      <summary>
3784 ##      Domain allowed access.
3785 ##      </summary>
3786 ## </param>
3787 #
3788 interface(`userdom_dbus_send_all_users',`
3789         gen_require(`
3790                 attribute userdomain;
3791                 class dbus send_msg;
3792         ')
3793
3794         allow $1 userdomain:dbus send_msg;
3795 ')
3796
3797 ########################################
3798 ## <summary>
3799 ##      Allow apps to set rlimits on userdomain
3800 ## </summary>
3801 ## <param name="domain">
3802 ##      <summary>
3803 ##      Domain allowed access.
3804 ##      </summary>
3805 ## </param>
3806 #
3807 interface(`userdom_set_rlimitnh',`
3808         gen_require(`
3809                 attribute userdomain;
3810         ')
3811
3812         allow $1 userdomain:process rlimitinh;
3813 ')
3814
3815 ########################################
3816 ## <summary>
3817 ##      Define this type as a Allow apps to set rlimits on userdomain
3818 ## </summary>
3819 ## <param name="domain">
3820 ##      <summary>
3821 ##      Domain allowed access.
3822 ##      </summary>
3823 ## </param>
3824 ## <param name="userdomain_prefix">
3825 ##      <summary>
3826 ##      The prefix of the user domain (e.g., user
3827 ##      is the prefix for user_t).
3828 ## </summary>
3829 ## </param>
3830 ## <param name="domain">
3831 ##      <summary>
3832 ##      Domain allowed access.
3833 ##      </summary>
3834 ## </param>
3835 #
3836 template(`userdom_unpriv_usertype',`
3837         gen_require(`
3838                 attribute unpriv_userdomain, userdomain;
3839                 attribute $1_usertype;
3840         ')
3841         typeattribute $2  $1_usertype;
3842         typeattribute $2  unpriv_userdomain;
3843         typeattribute $2  userdomain;
3844
3845         ubac_constrained($2)
3846 ')
3847
3848 ########################################
3849 ## <summary>
3850 ##      Connect to users over an unix stream socket.
3851 ## </summary>
3852 ## <param name="domain">
3853 ##      <summary>
3854 ##      Domain allowed access.
3855 ##      </summary>
3856 ## </param>
3857 #
3858 interface(`userdom_stream_connect',`
3859         gen_require(`
3860                 type user_tmp_t;
3861                 attribute userdomain;
3862         ')
3863
3864         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3865 ')
3866
3867 ########################################
3868 ## <summary>
3869 ##      Ptrace user domains.
3870 ## </summary>
3871 ## <param name="domain">
3872 ##      <summary>
3873 ##      Domain allowed access.
3874 ##      </summary>
3875 ## </param>
3876 #
3877 interface(`userdom_ptrace_all_users',`
3878         gen_require(`
3879                 attribute userdomain;
3880         ')
3881
3882         allow $1 userdomain:process ptrace;
3883 ')
3884
3885 ########################################
3886 ## <summary>
3887 ##      dontaudit Search /root
3888 ## </summary>
3889 ## <param name="domain">
3890 ##      <summary>
3891 ##      Domain to not audit.
3892 ##      </summary>
3893 ## </param>
3894 #
3895 interface(`userdom_dontaudit_search_admin_dir',`
3896         gen_require(`
3897                 type admin_home_t;
3898         ')
3899
3900         dontaudit $1 admin_home_t:dir search_dir_perms;
3901 ')
3902
3903 ########################################
3904 ## <summary>
3905 ##      dontaudit list /root
3906 ## </summary>
3907 ## <param name="domain">
3908 ##      <summary>
3909 ##      Domain to not audit.
3910 ##      </summary>
3911 ## </param>
3912 #
3913 interface(`userdom_dontaudit_list_admin_dir',`
3914         gen_require(`
3915                 type admin_home_t;
3916         ')
3917
3918         dontaudit $1 admin_home_t:dir list_dir_perms;
3919 ')
3920
3921 ########################################
3922 ## <summary>
3923 ##      Allow domain to  list /root
3924 ## </summary>
3925 ## <param name="domain">
3926 ##      <summary>
3927 ##      Domain allowed access.
3928 ##      </summary>
3929 ## </param>
3930 #
3931 interface(`userdom_list_admin_dir',`
3932         gen_require(`
3933                 type admin_home_t;
3934         ')
3935
3936         allow $1 admin_home_t:dir list_dir_perms;
3937 ')
3938
3939 ########################################
3940 ## <summary>
3941 ##      Allow Search /root
3942 ## </summary>
3943 ## <param name="domain">
3944 ##      <summary>
3945 ##      Domain allowed access.
3946 ##      </summary>
3947 ## </param>
3948 #
3949 interface(`userdom_search_admin_dir',`
3950         gen_require(`
3951                 type admin_home_t;
3952         ')
3953
3954         allow $1 admin_home_t:dir search_dir_perms;
3955 ')
3956
3957 ########################################
3958 ## <summary>
3959 ##      RW unpriviledged user SysV sempaphores.
3960 ## </summary>
3961 ## <param name="domain">
3962 ##      <summary>
3963 ##      Domain allowed access.
3964 ##      </summary>
3965 ## </param>
3966 #
3967 interface(`userdom_rw_semaphores',`
3968         gen_require(`
3969                 attribute unpriv_userdomain;
3970         ')
3971
3972         allow $1 unpriv_userdomain:sem rw_sem_perms;
3973 ')
3974
3975 ########################################
3976 ## <summary>
3977 ##      Send a message to unpriv users over a unix domain
3978 ##      datagram socket.
3979 ## </summary>
3980 ## <param name="domain">
3981 ##      <summary>
3982 ##      Domain allowed access.
3983 ##      </summary>
3984 ## </param>
3985 #
3986 interface(`userdom_dgram_send',`
3987         gen_require(`
3988                 attribute unpriv_userdomain;
3989         ')
3990
3991         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3992 ')
3993
3994 ######################################
3995 ## <summary>
3996 ##      Send a message to users over a unix domain
3997 ##      datagram socket.
3998 ## </summary>
3999 ## <param name="domain">
4000 ##      <summary>
4001 ##      Domain allowed access.
4002 ##      </summary>
4003 ## </param>
4004 #
4005 interface(`userdom_users_dgram_send',`
4006         gen_require(`
4007                  attribute userdomain;
4008       ')
4009
4010        allow $1 userdomain:unix_dgram_socket sendto;
4011 ')
4012
4013 #######################################
4014 ## <summary>
4015 ##      Allow execmod on files in homedirectory
4016 ## </summary>
4017 ## <param name="domain">
4018 ##      <summary>
4019 ##      Domain allowed access.
4020 ##      </summary>
4021 ## </param>
4022 ## <rolebase/>
4023 #
4024 interface(`userdom_execmod_user_home_files',`
4025         gen_require(`
4026                 type user_home_type;
4027         ')
4028
4029         allow $1 user_home_type:file execmod;
4030 ')
4031
4032 ########################################
4033 ## <summary>
4034 ##      Read admin home files.
4035 ## </summary>
4036 ## <param name="domain">
4037 ##      <summary>
4038 ##      Domain allowed access.
4039 ##      </summary>
4040 ## </param>
4041 ## <rolecap/>
4042 #
4043 interface(`userdom_read_admin_home_files',`
4044         gen_require(`
4045                 type admin_home_t;
4046         ')
4047
4048         read_files_pattern($1, admin_home_t, admin_home_t)
4049 ')
4050
4051 ########################################
4052 ## <summary>
4053 ##      Execute admin home files.
4054 ## </summary>
4055 ## <param name="domain">
4056 ##      <summary>
4057 ##      Domain allowed access.
4058 ##      </summary>
4059 ## </param>
4060 ## <rolecap/>
4061 #
4062 interface(`userdom_exec_admin_home_files',`
4063         gen_require(`
4064                 type admin_home_t;
4065         ')
4066
4067         exec_files_pattern($1, admin_home_t, admin_home_t)
4068 ')
4069
4070 ########################################
4071 ## <summary>
4072 ##      Append files inherited
4073 ##      in the /root directory.
4074 ## </summary>
4075 ## <param name="domain">
4076 ##      <summary>
4077 ##      Domain allowed access.
4078 ##      </summary>
4079 ## </param>
4080 #
4081 interface(`userdom_inherit_append_admin_home_files',`
4082         gen_require(`
4083                 type admin_home_t;
4084         ')
4085
4086         allow $1 admin_home_t:file { getattr append };
4087 ')
4088
4089
4090 #######################################
4091 ## <summary>
4092 ##      Manage all files/directories in the homedir
4093 ## </summary>
4094 ## <param name="userdomain">
4095 ##      <summary>
4096 ##      The user domain
4097 ##      </summary>
4098 ## </param>
4099 ## <rolebase/>
4100 #
4101 interface(`userdom_manage_user_home_content',`
4102         gen_require(`
4103                 type user_home_dir_t, user_home_t;
4104                 attribute user_home_type;
4105         ')
4106
4107         files_list_home($1)
4108         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4109         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4110         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4111         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4112         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4113         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4114
4115 ')
4116
4117
4118 ########################################
4119 ## <summary>
4120 ##      Create objects in a user home directory
4121 ##      with an automatic type transition to
4122 ##      the user home file type.
4123 ## </summary>
4124 ## <param name="domain">
4125 ##      <summary>
4126 ##      Domain allowed access.
4127 ##      </summary>
4128 ## </param>
4129 ## <param name="object_class">
4130 ##      <summary>
4131 ##      The class of the object to be created.
4132 ##      </summary>
4133 ## </param>
4134 #
4135 interface(`userdom_user_home_dir_filetrans_pattern',`
4136         gen_require(`
4137                 type user_home_dir_t, user_home_t;
4138         ')
4139
4140         type_transition $1 user_home_dir_t:$2 user_home_t;
4141 ')
4142
4143 ########################################
4144 ## <summary>
4145 ##      Create objects in the /root directory
4146 ##      with an automatic type transition to
4147 ##      a specified private type.
4148 ## </summary>
4149 ## <param name="domain">
4150 ##      <summary>
4151 ##      Domain allowed access.
4152 ##      </summary>
4153 ## </param>
4154 ## <param name="private_type">
4155 ##      <summary>
4156 ##      The type of the object to create.
4157 ##      </summary>
4158 ## </param>
4159 ## <param name="object_class">
4160 ##      <summary>
4161 ##      The class of the object to be created.
4162 ##      </summary>
4163 ## </param>
4164 #
4165 interface(`userdom_admin_home_dir_filetrans',`
4166         gen_require(`
4167                 type admin_home_t;
4168         ')
4169
4170         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4171 ')
4172
4173 ########################################
4174 ## <summary>
4175 ##      Send signull to unprivileged user domains.
4176 ## </summary>
4177 ## <param name="domain">
4178 ##      <summary>
4179 ##      Domain allowed access.
4180 ##      </summary>
4181 ## </param>
4182 #
4183 interface(`userdom_signull_unpriv_users',`
4184         gen_require(`
4185                 attribute unpriv_userdomain;
4186         ')
4187
4188         allow $1 unpriv_userdomain:process signull;
4189 ')
4190
4191 ########################################
4192 ## <summary>
4193 ##      Write all users files in /tmp
4194 ## </summary>
4195 ## <param name="domain">
4196 ##      <summary>
4197 ##      Domain allowed access.
4198 ##      </summary>
4199 ## </param>
4200 #
4201 interface(`userdom_write_user_tmp_dirs',`
4202         gen_require(`
4203                 type user_tmp_t;
4204         ')
4205
4206         write_files_pattern($1, user_tmp_t, user_tmp_t)
4207 ')
4208
4209 ########################################
4210 ## <summary>
4211 ##      Manage keys for all user domains.
4212 ## </summary>
4213 ## <param name="domain">
4214 ##      <summary>
4215 ##      Domain allowed access.
4216 ##      </summary>
4217 ## </param>
4218 #
4219 interface(`userdom_manage_all_users_keys',`
4220         gen_require(`
4221                 attribute userdomain;
4222         ')
4223
4224         allow $1 userdomain:key manage_key_perms;
4225 ')
4226
4227
4228 ########################################
4229 ## <summary>
4230 ##      Do not audit attempts to read and write
4231 ##      unserdomain stream.
4232 ## </summary>
4233 ## <param name="domain">
4234 ##      <summary>
4235 ##      Domain to not audit.
4236 ##      </summary>
4237 ## </param>
4238 #
4239 interface(`userdom_dontaudit_rw_stream',`
4240         gen_require(`
4241                 attribute userdomain;
4242         ')
4243
4244         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4245 ')
4246
4247 ########################################
4248 ## <summary>
4249 ##      Do not audit attempts to read and write
4250 ##      unserdomain datagram socket.
4251 ## </summary>
4252 ## <param name="domain">
4253 ##      <summary>
4254 ##      Domain to not audit.
4255 ##      </summary>
4256 ## </param>
4257 #
4258 interface(`userdom_dontaudit_rw_dgram_socket',`
4259         gen_require(`
4260                 attribute userdomain;
4261         ')
4262
4263         dontaudit $1 userdomain:unix_dgram_socket { read write };
4264 ')
4265
4266 ########################################
4267 ## <summary>
4268 ##      Append files
4269 ##      in a user home subdirectory.
4270 ## </summary>
4271 ## <param name="domain">
4272 ##      <summary>
4273 ##      Domain allowed access.
4274 ##      </summary>
4275 ## </param>
4276 #
4277 interface(`userdom_append_user_home_content_files',`
4278         gen_require(`
4279                 type user_home_dir_t, user_home_t;
4280         ')
4281
4282         append_files_pattern($1, user_home_t, user_home_t)
4283         allow $1 user_home_dir_t:dir search_dir_perms;
4284         files_search_home($1)
4285 ')
4286
4287 ########################################
4288 ## <summary>
4289 ##      Read files inherited
4290 ##      in a user home subdirectory.
4291 ## </summary>
4292 ## <param name="domain">
4293 ##      <summary>
4294 ##      Domain allowed access.
4295 ##      </summary>
4296 ## </param>
4297 #
4298 interface(`userdom_read_inherited_user_home_content_files',`
4299         gen_require(`
4300                 attribute user_home_type;
4301         ')
4302
4303         allow $1 user_home_type:file { getattr read };
4304 ')
4305
4306 ########################################
4307 ## <summary>
4308 ##      Append files inherited
4309 ##      in a user home subdirectory.
4310 ## </summary>
4311 ## <param name="domain">
4312 ##      <summary>
4313 ##      Domain allowed access.
4314 ##      </summary>
4315 ## </param>
4316 #
4317 interface(`userdom_inherit_append_user_home_content_files',`
4318         gen_require(`
4319                 type user_home_t;
4320         ')
4321
4322         allow $1 user_home_t:file { getattr append };
4323 ')
4324
4325 ########################################
4326 ## <summary>
4327 ##      Append files inherited
4328 ##      in a user tmp files.
4329 ## </summary>
4330 ## <param name="domain">
4331 ##      <summary>
4332 ##      Domain allowed access.
4333 ##      </summary>
4334 ## </param>
4335 #
4336 interface(`userdom_inherit_append_user_tmp_files',`
4337         gen_require(`
4338                 type user_tmp_t;
4339         ')
4340
4341         allow $1 user_tmp_t:file { getattr append };
4342 ')
4343
4344 ######################################
4345 ## <summary>
4346 ##      Read audio files in the users homedir.
4347 ## </summary>
4348 ## <param name="domain">
4349 ##      <summary>
4350 ##      Domain allowed access.
4351 ##      </summary>
4352 ## </param>
4353 ## <rolecap/>
4354 #
4355 interface(`userdom_read_home_audio_files',`
4356         gen_require(`
4357                 type audio_home_t;
4358         ')
4359
4360         userdom_search_user_home_dirs($1)
4361         allow $1 audio_home_t:dir list_dir_perms;
4362         read_files_pattern($1, audio_home_t, audio_home_t)
4363         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4364 ')
4365
4366 ########################################
4367 ## <summary>
4368 ##      Do not audit attempts to write all user home content files.
4369 ## </summary>
4370 ## <param name="domain">
4371 ##      <summary>
4372 ##      Domain to not audit.
4373 ##      </summary>
4374 ## </param>
4375 #
4376 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4377         gen_require(`
4378                 attribute user_home_type;
4379         ')
4380
4381         dontaudit $1 user_home_type:file write_file_perms;
4382 ')
4383
4384 ########################################
4385 ## <summary>
4386 ##      Do not audit attempts to write all user tmp content files.
4387 ## </summary>
4388 ## <param name="domain">
4389 ##      <summary>
4390 ##      Domain to not audit.
4391 ##      </summary>
4392 ## </param>
4393 #
4394 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4395         gen_require(`
4396                 attribute user_tmp_type;
4397         ')
4398
4399         dontaudit $1 user_tmp_type:file write_file_perms;
4400 ')
4401
4402 ########################################
4403 ## <summary>
4404 ##      Manage all user temporary content.
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain allowed access.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`userdom_manage_all_user_tmp_content',`
4413         gen_require(`
4414                 attribute user_tmp_type;
4415         ')
4416
4417         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4418         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4419         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4420         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4421         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4422         files_search_tmp($1)
4423 ')
4424
4425 ########################################
4426 ## <summary>
4427 ##      List all user temporary content.
4428 ## </summary>
4429 ## <param name="domain">
4430 ##      <summary>
4431 ##      Domain allowed access.
4432 ##      </summary>
4433 ## </param>
4434 #
4435 interface(`userdom_list_all_user_tmp_content',`
4436         gen_require(`
4437                 attribute user_tmp_type;
4438         ')
4439
4440         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4441         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4442         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4443         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4444         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4445         files_search_var($1)
4446         files_search_tmp($1)
4447 ')
4448
4449 ########################################
4450 ## <summary>
4451 ##      Manage all user tmpfs content.
4452 ## </summary>
4453 ## <param name="domain">
4454 ##      <summary>
4455 ##      Domain allowed access.
4456 ##      </summary>
4457 ## </param>
4458 #
4459 interface(`userdom_manage_all_user_tmpfs_content',`
4460         gen_require(`
4461                 attribute user_tmpfs_type;
4462         ')
4463
4464         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4465         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4466         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4467         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4468         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4469         fs_search_tmpfs($1)
4470 ')
4471
4472 ########################################
4473 ## <summary>
4474 ##      Delete all user temporary content.
4475 ## </summary>
4476 ## <param name="domain">
4477 ##      <summary>
4478 ##      Domain allowed access.
4479 ##      </summary>
4480 ## </param>
4481 #
4482 interface(`userdom_delete_all_user_tmp_content',`
4483         gen_require(`
4484                 attribute user_tmp_type;
4485         ')
4486
4487         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4488         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4489         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4490         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4491         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4492         # /var/tmp
4493         files_search_var($1)
4494         files_delete_tmp_dir_entry($1)
4495 ')
4496
4497 ########################################
4498 ## <summary>
4499 ##      Read system SSL certificates in the users homedir.
4500 ## </summary>
4501 ## <param name="domain">
4502 ##      <summary>
4503 ##      Domain allowed access.
4504 ##      </summary>
4505 ## </param>
4506 #
4507 interface(`userdom_read_home_certs',`
4508         gen_require(`
4509                 type home_cert_t;
4510         ')
4511
4512         userdom_search_user_home_content($1)
4513         allow $1 home_cert_t:dir list_dir_perms;
4514         read_files_pattern($1, home_cert_t, home_cert_t)
4515         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4516 ')
4517
4518 #######################################
4519 ## <summary>
4520 ##  Dontaudit Write system SSL certificates in the users homedir.
4521 ## </summary>
4522 ## <param name="domain">
4523 ##  <summary>
4524 ##      Domain to not audit.
4525 ##  </summary>
4526 ## </param>
4527 #
4528 interface(`userdom_dontaudit_write_home_certs',`
4529     gen_require(`
4530         type home_cert_t;
4531     ')
4532
4533     dontaudit $1 home_cert_t:file write;
4534 ')
4535
4536 ########################################
4537 ## <summary>
4538 ##      dontaudit Search getatrr /root files
4539 ## </summary>
4540 ## <param name="domain">
4541 ##      <summary>
4542 ##      Domain to not audit.
4543 ##      </summary>
4544 ## </param>
4545 #
4546 interface(`userdom_dontaudit_getattr_admin_home_files',`
4547         gen_require(`
4548                 type admin_home_t;
4549         ')
4550
4551         dontaudit $1 admin_home_t:file getattr;
4552 ')
4553
4554 ########################################
4555 ## <summary>
4556 ##      dontaudit read /root lnk files
4557 ## </summary>
4558 ## <param name="domain">
4559 ##      <summary>
4560 ##      Domain to not audit.
4561 ##      </summary>
4562 ## </param>
4563 #
4564 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4565         gen_require(`
4566                 type admin_home_t;
4567         ')
4568
4569         dontaudit $1 admin_home_t:lnk_file read;
4570 ')
4571
4572 ########################################
4573 ## <summary>
4574 ##      dontaudit read /root files
4575 ## </summary>
4576 ## <param name="domain">
4577 ##      <summary>
4578 ##      Domain to not audit.
4579 ##      </summary>
4580 ## </param>
4581 #
4582 interface(`userdom_dontaudit_read_admin_home_files',`
4583         gen_require(`
4584                 type admin_home_t;
4585         ')
4586
4587         dontaudit $1 admin_home_t:file read_file_perms;
4588 ')
4589
4590 ########################################
4591 ## <summary>
4592 ##      Create, read, write, and delete user
4593 ##      temporary chr files.
4594 ## </summary>
4595 ## <param name="domain">
4596 ##      <summary>
4597 ##      Domain allowed access.
4598 ##      </summary>
4599 ## </param>
4600 #
4601 interface(`userdom_manage_user_tmp_chr_files',`
4602         gen_require(`
4603                 type user_tmp_t;
4604         ')
4605
4606         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4607         files_search_tmp($1)
4608 ')
4609
4610 ########################################
4611 ## <summary>
4612 ##      Create, read, write, and delete user
4613 ##      temporary blk files.
4614 ## </summary>
4615 ## <param name="domain">
4616 ##      <summary>
4617 ##      Domain allowed access.
4618 ##      </summary>
4619 ## </param>
4620 #
4621 interface(`userdom_manage_user_tmp_blk_files',`
4622         gen_require(`
4623                 type user_tmp_t;
4624         ')
4625
4626         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4627         files_search_tmp($1)
4628 ')
4629
4630 ########################################
4631 ## <summary>
4632 ##      Dontaudit attempt to set attributes on  user temporary directories.
4633 ## </summary>
4634 ## <param name="domain">
4635 ##      <summary>
4636 ##      Domain to not audit.
4637 ##      </summary>
4638 ## </param>
4639 #
4640 interface(`userdom_dontaudit_setattr_user_tmp',`
4641         gen_require(`
4642                 type user_tmp_t;
4643         ')
4644
4645         dontaudit $1 user_tmp_t:dir setattr;
4646 ')
4647
4648 ########################################
4649 ## <summary>
4650 ##      Write all inherited users files in /tmp
4651 ## </summary>
4652 ## <param name="domain">
4653 ##      <summary>
4654 ##      Domain allowed access.
4655 ##      </summary>
4656 ## </param>
4657 #
4658 interface(`userdom_write_inherited_user_tmp_files',`
4659         gen_require(`
4660                 type user_tmp_t;
4661         ')
4662
4663         allow $1 user_tmp_t:file write;
4664 ')
4665
4666 ########################################
4667 ## <summary>
4668 ##      Delete all users files in /tmp
4669 ## </summary>
4670 ## <param name="domain">
4671 ##      <summary>
4672 ##      Domain allowed access.
4673 ##      </summary>
4674 ## </param>
4675 #
4676 interface(`userdom_delete_user_tmp_files',`
4677         gen_require(`
4678                 type user_tmp_t;
4679         ')
4680
4681         allow $1 user_tmp_t:file delete_file_perms;
4682 ')
4683
4684 ########################################
4685 ## <summary>
4686 ##      Delete user tmpfs files.
4687 ## </summary>
4688 ## <param name="domain">
4689 ##      <summary>
4690 ##      Domain allowed access.
4691 ##      </summary>
4692 ## </param>
4693 #
4694 interface(`userdom_delete_user_tmpfs_files',`
4695         gen_require(`
4696                 type user_tmpfs_t;
4697         ')
4698
4699         allow $1 user_tmpfs_t:file delete_file_perms;
4700 ')
4701
4702 ########################################
4703 ## <summary>
4704 ##      Read/Write unpriviledged user SysV shared
4705 ##      memory segments.
4706 ## </summary>
4707 ## <param name="domain">
4708 ##      <summary>
4709 ##      Domain allowed access.
4710 ##      </summary>
4711 ## </param>
4712 #
4713 interface(`userdom_rw_unpriv_user_shared_mem',`
4714         gen_require(`
4715                 attribute unpriv_userdomain;
4716         ')
4717
4718         allow $1 unpriv_userdomain:shm rw_shm_perms;
4719 ')
4720
4721 ########################################
4722 ## <summary>
4723 ##      Do not audit attempts to search user
4724 ##      temporary directories.
4725 ## </summary>
4726 ## <param name="domain">
4727 ##      <summary>
4728 ##      Domain to not audit.
4729 ##      </summary>
4730 ## </param>
4731 #
4732 interface(`userdom_dontaudit_search_user_tmp',`
4733         gen_require(`
4734                 type user_tmp_t;
4735         ')
4736
4737         dontaudit $1 user_tmp_t:dir search_dir_perms;
4738 ')
4739
4740 ########################################
4741 ## <summary>
4742 ##      Execute a file in a user home directory
4743 ##      in the specified domain.
4744 ## </summary>
4745 ## <desc>
4746 ##      <p>
4747 ##      Execute a file in a user home directory
4748 ##      in the specified domain.
4749 ##      </p>
4750 ##      <p>
4751 ##      No interprocess communication (signals, pipes,
4752 ##      etc.) is provided by this interface since
4753 ##      the domains are not owned by this module.
4754 ##      </p>
4755 ## </desc>
4756 ## <param name="domain">
4757 ##      <summary>
4758 ##      Domain allowed access.
4759 ##      </summary>
4760 ## </param>
4761 ## <param name="target_domain">
4762 ##      <summary>
4763 ##      The type of the new process.
4764 ##      </summary>
4765 ## </param>
4766 #
4767 interface(`userdom_domtrans_user_home',`
4768         gen_require(`
4769                 type user_home_t;
4770         ')
4771
4772         read_lnk_files_pattern($1, user_home_t, user_home_t)
4773         domain_transition_pattern($1, user_home_t, $2)
4774         type_transition $1 user_home_t:process $2;
4775 ')
4776
4777 ########################################
4778 ## <summary>
4779 ##      Execute a file in a user tmp directory
4780 ##      in the specified domain.
4781 ## </summary>
4782 ## <desc>
4783 ##      <p>
4784 ##      Execute a file in a user tmp directory
4785 ##      in the specified domain.
4786 ##      </p>
4787 ##      <p>
4788 ##      No interprocess communication (signals, pipes,
4789 ##      etc.) is provided by this interface since
4790 ##      the domains are not owned by this module.
4791 ##      </p>
4792 ## </desc>
4793 ## <param name="domain">
4794 ##      <summary>
4795 ##      Domain allowed access.
4796 ##      </summary>
4797 ## </param>
4798 ## <param name="target_domain">
4799 ##      <summary>
4800 ##      The type of the new process.
4801 ##      </summary>
4802 ## </param>
4803 #
4804 interface(`userdom_domtrans_user_tmp',`
4805         gen_require(`
4806                 type user_tmp_t;
4807         ')
4808
4809         files_search_tmp($1)
4810         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4811         domain_transition_pattern($1, user_tmp_t, $2)
4812         type_transition $1 user_tmp_t:process $2;
4813 ')
4814
4815 ########################################
4816 ## <summary>
4817 ##      Do not audit attempts to read all user home content files.
4818 ## </summary>
4819 ## <param name="domain">
4820 ##      <summary>
4821 ##      Domain to not audit.
4822 ##      </summary>
4823 ## </param>
4824 #
4825 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4826         gen_require(`
4827                 attribute user_home_type;
4828         ')
4829
4830         dontaudit $1 user_home_type:file read_file_perms;
4831 ')
4832
4833 ########################################
4834 ## <summary>
4835 ##      Do not audit attempts to read all user tmp content files.
4836 ## </summary>
4837 ## <param name="domain">
4838 ##      <summary>
4839 ##      Domain to not audit.
4840 ##      </summary>
4841 ## </param>
4842 #
4843 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4844         gen_require(`
4845                 attribute user_tmp_type;
4846         ')
4847
4848         dontaudit $1 user_tmp_type:file read_file_perms;
4849 ')
4850