policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_list_var($1_usertype)
  99         files_read_mnt_files($1_usertype)
 100         files_dontaudit_access_check_mnt($1_usertype)
 101         files_read_etc_runtime_files($1_usertype)
 102         files_read_usr_files($1_usertype)
 103         files_read_usr_src_files($1_usertype)
 104         # Read directories and files with the readable_t type.
 105         # This type is a general type for "world"-readable files.
 106         files_list_world_readable($1_usertype)
 107         files_read_world_readable_files($1_usertype)
 108         files_read_world_readable_symlinks($1_usertype)
 109         files_read_world_readable_pipes($1_usertype)
 110         files_read_world_readable_sockets($1_usertype)
 111         # old broswer_domain():
 112         files_dontaudit_getattr_all_dirs($1_usertype)
 113         files_dontaudit_list_non_security($1_usertype)
 114         files_dontaudit_getattr_all_files($1_usertype)
 115         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 116         files_dontaudit_getattr_non_security_pipes($1_usertype)
 117         files_dontaudit_getattr_non_security_sockets($1_usertype)
 118         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 119
 120         files_exec_usr_files($1_t)
 121
 122         fs_list_cgroup_dirs($1_usertype)
 123         fs_dontaudit_rw_cgroup_files($1_usertype)
 124
 125         storage_rw_fuse($1_usertype)
 126
 127         auth_use_nsswitch($1_t)
 128
 129         init_stream_connect($1_usertype)
 130         # The library functions always try to open read-write first,
 131         # then fall back to read-only if it fails.
 132         init_dontaudit_rw_utmp($1_usertype)
 133
 134         libs_exec_ld_so($1_usertype)
 135
 136         logging_send_audit_msgs($1_t)
 137
 138         miscfiles_read_localization($1_t)
 139         miscfiles_read_generic_certs($1_t)
 140
 141         miscfiles_read_all_certs($1_usertype)
 142         miscfiles_read_localization($1_usertype)
 143         miscfiles_read_man_pages($1_usertype)
 144         miscfiles_read_public_files($1_usertype)
 145
 146         systemd_dbus_chat_logind($1_usertype)
 147
 148         tunable_policy(`allow_execmem',`
 149                 # Allow loading DSOs that require executable stack.
 150                 allow $1_t self:process execmem;
 151         ')
 152
 153         tunable_policy(`allow_execmem && allow_execstack',`
 154                 # Allow making the stack executable via mprotect.
 155                 allow $1_t self:process execstack;
 156         ')
 157
 158         optional_policy(`
 159                 abrt_stream_connect($1_usertype)
 160         ')
 161
 162         optional_policy(`
 163                 fs_list_cgroup_dirs($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 ssh_rw_stream_sockets($1_usertype)
 168                 ssh_delete_tmp($1_t)
 169                 ssh_signal($1_t)
 170         ')
 171 ')
 172
 173 #######################################
 174 ## <summary>
 175 ##      Allow a home directory for which the
 176 ##      role has read-only access.
 177 ## </summary>
 178 ## <desc>
 179 ##      <p>
 180 ##      Allow a home directory for which the
 181 ##      role has read-only access.
 182 ##      </p>
 183 ##      <p>
 184 ##      This does not allow execute access.
 185 ##      </p>
 186 ## </desc>
 187 ## <param name="role">
 188 ##      <summary>
 189 ##      The user role
 190 ##      </summary>
 191 ## </param>
 192 ## <param name="userdomain">
 193 ##      <summary>
 194 ##      The user domain
 195 ##      </summary>
 196 ## </param>
 197 ## <rolebase/>
 198 #
 199 interface(`userdom_ro_home_role',`
 200         gen_require(`
 201                 type user_home_t, user_home_dir_t;
 202         ')
 203
 204         role $1 types { user_home_t user_home_dir_t };
 205
 206         ##############################
 207         #
 208         # Domain access to home dir
 209         #
 210
 211         type_member $2 user_home_dir_t:dir user_home_dir_t;
 212
 213         # read-only home directory
 214         allow $2 user_home_dir_t:dir list_dir_perms;
 215         allow $2 user_home_t:dir list_dir_perms;
 216         allow $2 user_home_t:file entrypoint;
 217         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 218         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         files_list_home($2)
 222
 223 ')
 224
 225 #######################################
 226 ## <summary>
 227 ##      Allow a home directory for which the
 228 ##      role has full access.
 229 ## </summary>
 230 ## <desc>
 231 ##      <p>
 232 ##      Allow a home directory for which the
 233 ##      role has full access.
 234 ##      </p>
 235 ##      <p>
 236 ##      This does not allow execute access.
 237 ##      </p>
 238 ## </desc>
 239 ## <param name="role">
 240 ##      <summary>
 241 ##      The user role
 242 ##      </summary>
 243 ## </param>
 244 ## <param name="userdomain">
 245 ##      <summary>
 246 ##      The user domain
 247 ##      </summary>
 248 ## </param>
 249 ## <rolebase/>
 250 #
 251 interface(`userdom_manage_home_role',`
 252         gen_require(`
 253                 type user_home_t, user_home_dir_t;
 254                 attribute user_home_type;
 255         ')
 256
 257         role $1 types { user_home_type user_home_dir_t };
 258
 259         ##############################
 260         #
 261         # Domain access to home dir
 262         #
 263
 264         type_member $2 user_home_dir_t:dir user_home_dir_t;
 265
 266         # full control of the home directory
 267         allow $2 user_home_t:dir mounton;
 268         allow $2 user_home_t:file entrypoint;
 269
 270         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 271         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 272         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 283         files_list_home($2)
 284
 285         # cjp: this should probably be removed:
 286         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 287
 288         tunable_policy(`use_nfs_home_dirs',`
 289                 fs_mount_nfs($2)
 290                 fs_mounton_nfs($2)
 291                 fs_manage_nfs_dirs($2)
 292                 fs_manage_nfs_files($2)
 293                 fs_manage_nfs_symlinks($2)
 294                 fs_manage_nfs_named_sockets($2)
 295                 fs_manage_nfs_named_pipes($2)
 296         ')
 297
 298         tunable_policy(`use_samba_home_dirs',`
 299                 fs_mount_cifs($2)
 300                 fs_mounton_cifs($2)
 301                 fs_manage_cifs_dirs($2)
 302                 fs_manage_cifs_files($2)
 303                 fs_manage_cifs_symlinks($2)
 304                 fs_manage_cifs_named_sockets($2)
 305                 fs_manage_cifs_named_pipes($2)
 306         ')
 307 ')
 308
 309 #######################################
 310 ## <summary>
 311 ##      Manage user temporary files
 312 ## </summary>
 313 ## <param name="role">
 314 ##      <summary>
 315 ##      Role allowed access.
 316 ##      </summary>
 317 ## </param>
 318 ## <param name="domain">
 319 ##      <summary>
 320 ##      Domain allowed access.
 321 ##      </summary>
 322 ## </param>
 323 ## <rolebase/>
 324 #
 325 interface(`userdom_manage_tmp_role',`
 326         gen_require(`
 327                 attribute user_tmp_type;
 328                 type user_tmp_t;
 329         ')
 330
 331         role $1 types user_tmp_t;
 332
 333         files_poly_member_tmp($2, user_tmp_t)
 334
 335         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 336         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 340         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 341         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346 ')
 347
 348 #######################################
 349 ## <summary>
 350 ##      Dontaudit search of user bin dirs.
 351 ## </summary>
 352 ## <param name="domain">
 353 ##      <summary>
 354 ##      Domain to not audit.
 355 ##      </summary>
 356 ## </param>
 357 #
 358 interface(`userdom_dontaudit_search_user_bin_dirs',`
 359         gen_require(`
 360                 type home_bin_t;
 361         ')
 362
 363         dontaudit $1 home_bin_t:dir search_dir_perms;
 364 ')
 365
 366 #######################################
 367 ## <summary>
 368 ##      Execute user bin files.
 369 ## </summary>
 370 ## <param name="domain">
 371 ##      <summary>
 372 ##      Domain allowed access.
 373 ##      </summary>
 374 ## </param>
 375 #
 376 interface(`userdom_exec_user_bin_files',`
 377         gen_require(`
 378                 attribute user_home_type;
 379                 type home_bin_t, user_home_dir_t;
 380         ')
 381
 382         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 383         files_search_home($1)
 384 ')
 385
 386 #######################################
 387 ## <summary>
 388 ##      The execute access user temporary files.
 389 ## </summary>
 390 ## <param name="domain">
 391 ##      <summary>
 392 ##      Domain allowed access.
 393 ##      </summary>
 394 ## </param>
 395 ## <rolebase/>
 396 #
 397 interface(`userdom_exec_user_tmp_files',`
 398         gen_require(`
 399                 type user_tmp_t;
 400         ')
 401
 402         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 403         dontaudit $1 user_tmp_t:sock_file execute;
 404         files_search_tmp($1)
 405 ')
 406
 407 #######################################
 408 ## <summary>
 409 ##      Role access for the user tmpfs type
 410 ##      that the user has full access.
 411 ## </summary>
 412 ## <desc>
 413 ##      <p>
 414 ##      Role access for the user tmpfs type
 415 ##      that the user has full access.
 416 ##      </p>
 417 ##      <p>
 418 ##      This does not allow execute access.
 419 ##      </p>
 420 ## </desc>
 421 ## <param name="role">
 422 ##      <summary>
 423 ##      Role allowed access.
 424 ##      </summary>
 425 ## </param>
 426 ## <param name="domain">
 427 ##      <summary>
 428 ##      Domain allowed access.
 429 ##      </summary>
 430 ## </param>
 431 ## <rolecap/>
 432 #
 433 interface(`userdom_manage_tmpfs_role',`
 434         gen_require(`
 435                 attribute user_tmpfs_type;
 436                 type user_tmpfs_t;
 437         ')
 438
 439         role $1 types user_tmpfs_t;
 440
 441         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 447         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452 ')
 453
 454 #######################################
 455 ## <summary>
 456 ##      The interface allowing the user basic
 457 ##      network permissions
 458 ## </summary>
 459 ## <param name="userdomain">
 460 ##      <summary>
 461 ##      The user domain
 462 ##      </summary>
 463 ## </param>
 464 ## <rolebase/>
 465 #
 466 interface(`userdom_basic_networking',`
 467
 468         allow $1 self:tcp_socket create_stream_socket_perms;
 469         allow $1 self:udp_socket create_socket_perms;
 470
 471         corenet_all_recvfrom_unlabeled($1)
 472         corenet_all_recvfrom_netlabel($1)
 473         corenet_tcp_sendrecv_generic_if($1)
 474         corenet_udp_sendrecv_generic_if($1)
 475         corenet_tcp_sendrecv_generic_node($1)
 476         corenet_udp_sendrecv_generic_node($1)
 477         corenet_tcp_sendrecv_all_ports($1)
 478         corenet_udp_sendrecv_all_ports($1)
 479         corenet_tcp_connect_all_ports($1)
 480         corenet_sendrecv_all_client_packets($1)
 481
 482         optional_policy(`
 483                 init_tcp_recvfrom_all_daemons($1)
 484                 init_udp_recvfrom_all_daemons($1)
 485         ')
 486
 487         optional_policy(`
 488                 ipsec_match_default_spd($1)
 489         ')
 490
 491 ')
 492
 493 #######################################
 494 ## <summary>
 495 ##      The template for creating a user xwindows client.  (Deprecated)
 496 ## </summary>
 497 ## <param name="userdomain_prefix">
 498 ##      <summary>
 499 ##      The prefix of the user domain (e.g., user
 500 ##      is the prefix for user_t).
 501 ##      </summary>
 502 ## </param>
 503 ## <rolebase/>
 504 #
 505 template(`userdom_xwindows_client_template',`
 506         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 507         gen_require(`
 508                 type $1_t, user_tmpfs_t;
 509         ')
 510
 511         dev_rw_xserver_misc($1_t)
 512         dev_rw_power_management($1_t)
 513         dev_read_input($1_t)
 514         dev_read_misc($1_t)
 515         dev_write_misc($1_t)
 516         # open office is looking for the following
 517         dev_getattr_agp_dev($1_t)
 518         dev_dontaudit_rw_dri($1_t)
 519         # GNOME checks for usb and other devices:
 520         dev_rw_usbfs($1_t)
 521         dev_rw_generic_usb_dev($1_t)
 522
 523         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 524         xserver_xsession_entry_type($1_t)
 525         xserver_dontaudit_write_log($1_t)
 526         xserver_stream_connect_xdm($1_t)
 527         # certain apps want to read xdm.pid file
 528         xserver_read_xdm_pid($1_t)
 529         # gnome-session creates socket under /tmp/.ICE-unix/
 530         xserver_create_xdm_tmp_sockets($1_t)
 531         # Needed for escd, remove if we get escd policy
 532         xserver_manage_xdm_tmp_files($1_t)
 533 ')
 534
 535 #######################################
 536 ## <summary>
 537 ##      The template for allowing the user to change passwords.
 538 ## </summary>
 539 ## <param name="userdomain_prefix">
 540 ##      <summary>
 541 ##      The prefix of the user domain (e.g., user
 542 ##      is the prefix for user_t).
 543 ##      </summary>
 544 ## </param>
 545 ## <rolebase/>
 546 #
 547 template(`userdom_change_password_template',`
 548         gen_require(`
 549                 type $1_t;
 550                 role $1_r;
 551         ')
 552
 553         optional_policy(`
 554                 usermanage_run_chfn($1_t,$1_r)
 555                 usermanage_run_passwd($1_t,$1_r)
 556         ')
 557 ')
 558
 559 #######################################
 560 ## <summary>
 561 ##      The template containing rules common to unprivileged
 562 ##      users and administrative users.
 563 ## </summary>
 564 ## <desc>
 565 ##      <p>
 566 ##      This template creates a user domain, types, and
 567 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 568 ##      </p>
 569 ## </desc>
 570 ## <param name="userdomain_prefix">
 571 ##      <summary>
 572 ##      The prefix of the user domain (e.g., user
 573 ##      is the prefix for user_t).
 574 ##      </summary>
 575 ## </param>
 576 #
 577 template(`userdom_common_user_template',`
 578         gen_require(`
 579                 attribute unpriv_userdomain;
 580         ')
 581
 582         userdom_basic_networking($1_usertype)
 583
 584         ##############################
 585         #
 586         # User domain Local policy
 587         #
 588
 589         # evolution and gnome-session try to create a netlink socket
 590         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 591         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 592         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 593         allow $1_t self:socket create_socket_perms;
 594
 595         allow $1_usertype unpriv_userdomain:fd use;
 596
 597         kernel_read_system_state($1_usertype)
 598         kernel_read_network_state($1_usertype)
 599         kernel_read_software_raid_state($1_usertype)
 600         kernel_read_net_sysctls($1_usertype)
 601         # Very permissive allowing every domain to see every type:
 602         kernel_get_sysvipc_info($1_usertype)
 603         # Find CDROM devices:
 604         kernel_read_device_sysctls($1_usertype)
 605         kernel_request_load_module($1_usertype)
 606
 607         corenet_udp_bind_generic_node($1_usertype)
 608         corenet_udp_bind_generic_port($1_usertype)
 609
 610         dev_read_rand($1_usertype)
 611         dev_write_sound($1_usertype)
 612         dev_read_sound($1_usertype)
 613         dev_read_sound_mixer($1_usertype)
 614         dev_write_sound_mixer($1_usertype)
 615
 616         files_exec_etc_files($1_usertype)
 617         files_search_locks($1_usertype)
 618         # Check to see if cdrom is mounted
 619         files_search_mnt($1_usertype)
 620         # cjp: perhaps should cut back on file reads:
 621         files_read_var_files($1_usertype)
 622         files_read_var_symlinks($1_usertype)
 623         files_read_generic_spool($1_usertype)
 624         files_read_var_lib_files($1_usertype)
 625         # Stat lost+found.
 626         files_getattr_lost_found_dirs($1_usertype)
 627         files_read_config_files($1_usertype)
 628         fs_read_noxattr_fs_files($1_usertype)
 629         fs_read_noxattr_fs_symlinks($1_usertype)
 630         fs_rw_cgroup_files($1_usertype)
 631
 632         application_getattr_socket($1_usertype)
 633
 634         logging_send_syslog_msg($1_usertype)
 635         logging_send_audit_msgs($1_usertype)
 636         selinux_get_enforce_mode($1_usertype)
 637
 638         # cjp: some of this probably can be removed
 639         selinux_get_fs_mount($1_usertype)
 640         selinux_validate_context($1_usertype)
 641         selinux_compute_access_vector($1_usertype)
 642         selinux_compute_create_context($1_usertype)
 643         selinux_compute_relabel_context($1_usertype)
 644         selinux_compute_user_contexts($1_usertype)
 645
 646         # for eject
 647         storage_getattr_fixed_disk_dev($1_usertype)
 648
 649         auth_read_login_records($1_usertype)
 650         auth_run_pam($1_t,$1_r)
 651         auth_run_utempter($1_t,$1_r)
 652
 653         init_read_utmp($1_usertype)
 654
 655         seutil_read_file_contexts($1_usertype)
 656         seutil_read_default_contexts($1_usertype)
 657         seutil_run_newrole($1_t,$1_r)
 658         seutil_exec_checkpolicy($1_t)
 659         seutil_exec_setfiles($1_usertype)
 660         # for when the network connection is killed
 661         # this is needed when a login role can change
 662         # to this one.
 663         seutil_dontaudit_signal_newrole($1_t)
 664
 665         tunable_policy(`user_direct_mouse',`
 666                 dev_read_mouse($1_usertype)
 667         ')
 668
 669         tunable_policy(`user_ttyfile_stat',`
 670                 term_getattr_all_ttys($1_t)
 671         ')
 672
 673         optional_policy(`
 674                 alsa_read_rw_config($1_usertype)
 675                 alsa_manage_home_files($1_t)
 676                 alsa_relabel_home_files($1_t)
 677         ')
 678
 679         optional_policy(`
 680                 # Allow graphical boot to check battery lifespan
 681                 apm_stream_connect($1_usertype)
 682         ')
 683
 684         optional_policy(`
 685                 canna_stream_connect($1_usertype)
 686         ')
 687
 688         optional_policy(`
 689                 chrome_role($1_r, $1_usertype)
 690         ')
 691
 692         optional_policy(`
 693                 colord_read_lib_files($1_usertype)
 694         ')
 695
 696         optional_policy(`
 697                 dbus_system_bus_client($1_usertype)
 698
 699                 allow $1_usertype $1_usertype:dbus  send_msg;
 700
 701                 optional_policy(`
 702                         avahi_dbus_chat($1_usertype)
 703                 ')
 704
 705                 optional_policy(`
 706                         policykit_dbus_chat($1_usertype)
 707                 ')
 708
 709                 optional_policy(`
 710                         bluetooth_dbus_chat($1_usertype)
 711                 ')
 712
 713                 optional_policy(`
 714                         consolekit_dbus_chat($1_usertype)
 715                         consolekit_read_log($1_usertype)
 716                 ')
 717
 718                 optional_policy(`
 719                         devicekit_dbus_chat($1_usertype)
 720                         devicekit_dbus_chat_power($1_usertype)
 721                         devicekit_dbus_chat_disk($1_usertype)
 722                 ')
 723
 724                 optional_policy(`
 725                         evolution_dbus_chat($1_usertype)
 726                         evolution_alarm_dbus_chat($1_usertype)
 727                 ')
 728
 729                 optional_policy(`
 730                         gnome_dbus_chat_gconfdefault($1_usertype)
 731                 ')
 732
 733                 optional_policy(`
 734                         hal_dbus_chat($1_usertype)
 735                 ')
 736
 737                 optional_policy(`
 738                         kde_dbus_chat_backlighthelper($1_usertype)
 739                 ')
 740
 741                 optional_policy(`
 742                         modemmanager_dbus_chat($1_usertype)
 743                 ')
 744
 745                 optional_policy(`
 746                         networkmanager_dbus_chat($1_usertype)
 747                         networkmanager_read_lib_files($1_usertype)
 748                 ')
 749
 750                 optional_policy(`
 751                         vpn_dbus_chat($1_usertype)
 752                 ')
 753         ')
 754
 755         optional_policy(`
 756                 git_session_role($1_r, $1_usertype)
 757         ')
 758
 759         optional_policy(`
 760                 inetd_use_fds($1_usertype)
 761                 inetd_rw_tcp_sockets($1_usertype)
 762         ')
 763
 764         optional_policy(`
 765                 inn_read_config($1_usertype)
 766                 inn_read_news_lib($1_usertype)
 767                 inn_read_news_spool($1_usertype)
 768         ')
 769
 770         optional_policy(`
 771                 lircd_stream_connect($1_usertype)
 772         ')
 773
 774         optional_policy(`
 775                 locate_read_lib_files($1_usertype)
 776         ')
 777
 778         # for running depmod as part of the kernel packaging process
 779         optional_policy(`
 780                 modutils_read_module_config($1_usertype)
 781         ')
 782
 783         optional_policy(`
 784                 mta_rw_spool($1_usertype)
 785                 mta_manage_queue($1_usertype)
 786                 mta_filetrans_home_content($1_usertype)
 787         ')
 788
 789         optional_policy(`
 790                 nsplugin_role($1_r, $1_usertype)
 791         ')
 792
 793         optional_policy(`
 794                 tunable_policy(`allow_user_mysql_connect',`
 795                         mysql_stream_connect($1_t)
 796                 ')
 797         ')
 798
 799         optional_policy(`
 800                 oident_manage_user_content($1_t)
 801                 oident_relabel_user_content($1_t)
 802         ')
 803
 804         optional_policy(`
 805                 # to allow monitoring of pcmcia status
 806                 pcmcia_read_pid($1_usertype)
 807         ')
 808
 809         optional_policy(`
 810                 pcscd_read_pub_files($1_usertype)
 811                 pcscd_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 tunable_policy(`allow_user_postgresql_connect',`
 816                         postgresql_stream_connect($1_usertype)
 817                         postgresql_tcp_connect($1_usertype)
 818                 ')
 819         ')
 820
 821         optional_policy(`
 822                 resmgr_stream_connect($1_usertype)
 823         ')
 824
 825         optional_policy(`
 826                 rpc_dontaudit_getattr_exports($1_usertype)
 827                 rpc_manage_nfs_rw_content($1_usertype)
 828         ')
 829
 830         optional_policy(`
 831                 rpcbind_stream_connect($1_usertype)
 832         ')
 833
 834         optional_policy(`
 835                 samba_stream_connect_winbind($1_usertype)
 836         ')
 837
 838         optional_policy(`
 839                 sandbox_transition($1_usertype, $1_r)
 840         ')
 841
 842         optional_policy(`
 843                 seunshare_role_template($1, $1_r, $1_t)
 844         ')
 845
 846         optional_policy(`
 847                 slrnpull_search_spool($1_usertype)
 848         ')
 849
 850 ')
 851
 852 #######################################
 853 ## <summary>
 854 ##      The template for creating a login user.
 855 ## </summary>
 856 ## <desc>
 857 ##      <p>
 858 ##      This template creates a user domain, types, and
 859 ##      rules for the user's tty, pty, home directories,
 860 ##      tmp, and tmpfs files.
 861 ##      </p>
 862 ## </desc>
 863 ## <param name="userdomain_prefix">
 864 ##      <summary>
 865 ##      The prefix of the user domain (e.g., user
 866 ##      is the prefix for user_t).
 867 ##      </summary>
 868 ## </param>
 869 #
 870 template(`userdom_login_user_template', `
 871         gen_require(`
 872                 class context contains;
 873         ')
 874
 875         userdom_base_user_template($1)
 876
 877         userdom_manage_home_role($1_r, $1_usertype)
 878
 879         userdom_manage_tmp_role($1_r, $1_usertype)
 880         userdom_manage_tmpfs_role($1_r, $1_usertype)
 881
 882         ifelse(`$1',`unconfined',`',`
 883                 gen_tunable(allow_$1_exec_content, true)
 884
 885                 tunable_policy(`allow_$1_exec_content',`
 886                         userdom_exec_user_tmp_files($1_usertype)
 887                         userdom_exec_user_home_content_files($1_usertype)
 888                 ')
 889                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 890                         fs_exec_nfs_files($1_usertype)
 891                 ')
 892
 893                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 894                         fs_exec_cifs_files($1_usertype)
 895                 ')
 896         ')
 897
 898         userdom_change_password_template($1)
 899
 900         ##############################
 901         #
 902         # User domain Local policy
 903         #
 904
 905         allow $1_t self:capability { setgid chown fowner };
 906         dontaudit $1_t self:capability { sys_nice fsetid };
 907
 908         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 909         dontaudit $1_t self:process setrlimit;
 910         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 911
 912         allow $1_t self:context contains;
 913
 914         kernel_dontaudit_read_system_state($1_usertype)
 915         kernel_dontaudit_list_all_proc($1_usertype)
 916
 917         dev_read_sysfs($1_usertype)
 918         dev_read_urand($1_usertype)
 919
 920         domain_use_interactive_fds($1_usertype)
 921         # Command completion can fire hundreds of denials
 922         domain_dontaudit_exec_all_entry_files($1_usertype)
 923
 924         files_dontaudit_list_default($1_usertype)
 925         files_dontaudit_read_default_files($1_usertype)
 926         # Stat lost+found.
 927         files_getattr_lost_found_dirs($1_usertype)
 928
 929         fs_get_all_fs_quotas($1_usertype)
 930         fs_getattr_all_fs($1_usertype)
 931         fs_search_all($1_usertype)
 932         fs_list_inotifyfs($1_usertype)
 933         fs_rw_anon_inodefs_files($1_usertype)
 934
 935         auth_dontaudit_write_login_records($1_t)
 936         auth_rw_cache($1_t)
 937
 938         application_exec_all($1_t)
 939         # The library functions always try to open read-write first,
 940         # then fall back to read-only if it fails.
 941         init_dontaudit_rw_utmp($1_t)
 942
 943         # Stop warnings about access to /dev/console
 944         init_dontaudit_use_fds($1_usertype)
 945         init_dontaudit_use_script_fds($1_usertype)
 946
 947         libs_exec_lib_files($1_usertype)
 948
 949         logging_dontaudit_getattr_all_logs($1_usertype)
 950
 951         # for running TeX programs
 952         miscfiles_read_tetex_data($1_usertype)
 953         miscfiles_exec_tetex_data($1_usertype)
 954
 955         seutil_read_config($1_usertype)
 956
 957         optional_policy(`
 958                 cups_read_config($1_usertype)
 959                 cups_stream_connect($1_usertype)
 960                 cups_stream_connect_ptal($1_usertype)
 961         ')
 962
 963         optional_policy(`
 964                 kerberos_use($1_usertype)
 965                 kerberos_filetrans_home_content($1_usertype)
 966         ')
 967
 968         optional_policy(`
 969                 mta_dontaudit_read_spool_symlinks($1_usertype)
 970         ')
 971
 972         optional_policy(`
 973                 quota_dontaudit_getattr_db($1_usertype)
 974         ')
 975
 976         optional_policy(`
 977                 rpm_read_db($1_usertype)
 978                 rpm_dontaudit_manage_db($1_usertype)
 979                 rpm_read_cache($1_usertype)
 980         ')
 981
 982         optional_policy(`
 983                 oddjob_run_mkhomedir($1_t, $1_r)
 984         ')
 985 ')
 986
 987 #######################################
 988 ## <summary>
 989 ##      The template for creating a unprivileged login user.
 990 ## </summary>
 991 ## <desc>
 992 ##      <p>
 993 ##      This template creates a user domain, types, and
 994 ##      rules for the user's tty, pty, home directories,
 995 ##      tmp, and tmpfs files.
 996 ##      </p>
 997 ## </desc>
 998 ## <param name="userdomain_prefix">
 999 ##      <summary>
1000 ##      The prefix of the user domain (e.g., user
1001 ##      is the prefix for user_t).
1002 ##      </summary>
1003 ## </param>
1004 #
1005 template(`userdom_restricted_user_template',`
1006         gen_require(`
1007                 attribute unpriv_userdomain;
1008         ')
1009
1010         userdom_login_user_template($1)
1011
1012         typeattribute $1_t unpriv_userdomain;
1013         domain_interactive_fd($1_t)
1014
1015         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1016         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1017
1018         ##############################
1019         #
1020         # Local policy
1021         #
1022
1023         optional_policy(`
1024                 loadkeys_run($1_t, $1_r)
1025         ')
1026 ')
1027
1028 #######################################
1029 ## <summary>
1030 ##      The template for creating a unprivileged xwindows login user.
1031 ## </summary>
1032 ## <desc>
1033 ##      <p>
1034 ##      The template for creating a unprivileged xwindows login user.
1035 ##      </p>
1036 ##      <p>
1037 ##      This template creates a user domain, types, and
1038 ##      rules for the user's tty, pty, home directories,
1039 ##      tmp, and tmpfs files.
1040 ##      </p>
1041 ## </desc>
1042 ## <param name="userdomain_prefix">
1043 ##      <summary>
1044 ##      The prefix of the user domain (e.g., user
1045 ##      is the prefix for user_t).
1046 ##      </summary>
1047 ## </param>
1048 #
1049 template(`userdom_restricted_xwindows_user_template',`
1050
1051         userdom_restricted_user_template($1)
1052
1053         ##############################
1054         #
1055         # Local policy
1056         #
1057
1058         auth_role($1_r, $1_t)
1059         auth_search_pam_console_data($1_usertype)
1060         auth_dontaudit_read_login_records($1_usertype)
1061
1062         dev_read_sound($1_usertype)
1063         dev_write_sound($1_usertype)
1064         # gnome keyring wants to read this.
1065         dev_dontaudit_read_rand($1_usertype)
1066         # temporarily allow since openoffice requires this
1067         dev_read_rand($1_usertype)
1068
1069         dev_read_video_dev($1_usertype)
1070         dev_write_video_dev($1_usertype)
1071         dev_rw_wireless($1_usertype)
1072
1073         libs_dontaudit_setattr_lib_files($1_usertype)
1074
1075         tunable_policy(`user_rw_noexattrfile',`
1076                 dev_rw_usbfs($1_t)
1077                 dev_rw_generic_usb_dev($1_usertype)
1078
1079                 fs_manage_noxattr_fs_files($1_usertype)
1080                 fs_manage_noxattr_fs_dirs($1_usertype)
1081                 fs_manage_dos_dirs($1_usertype)
1082                 fs_manage_dos_files($1_usertype)
1083                 storage_raw_read_removable_device($1_usertype)
1084                 storage_raw_write_removable_device($1_usertype)
1085         ')
1086
1087         logging_send_syslog_msg($1_usertype)
1088         logging_dontaudit_send_audit_msgs($1_t)
1089
1090         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1091         logging_send_audit_msgs($1_t)
1092         selinux_get_enforce_mode($1_t)
1093         seutil_exec_restorecond($1_t)
1094         seutil_read_file_contexts($1_t)
1095         seutil_read_default_contexts($1_t)
1096
1097         xserver_restricted_role($1_r, $1_t)
1098
1099         optional_policy(`
1100                 alsa_read_rw_config($1_usertype)
1101         ')
1102
1103          # cjp: needed by KDE apps
1104          # bug: #682499
1105          optional_policy(`
1106                 gnome_read_usr_config($1_usertype)
1107                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1108                 # cjp: telepathy F15 bugs
1109                 telepathy_role($1_r, $1_t, $1)
1110         ')
1111
1112         optional_policy(`
1113                 dbus_role_template($1, $1_r, $1_usertype)
1114                 dbus_system_bus_client($1_usertype)
1115                 allow $1_usertype $1_usertype:dbus send_msg;
1116
1117                 optional_policy(`
1118                         abrt_dbus_chat($1_usertype)
1119                         abrt_run_helper($1_usertype, $1_r)
1120                 ')
1121
1122                 optional_policy(`
1123                         consolekit_dontaudit_read_log($1_usertype)
1124                         consolekit_dbus_chat($1_usertype)
1125                 ')
1126
1127                 optional_policy(`
1128                         cups_dbus_chat($1_usertype)
1129                         cups_dbus_chat_config($1_usertype)
1130                 ')
1131
1132                 optional_policy(`
1133                         devicekit_dbus_chat($1_usertype)
1134                         devicekit_dbus_chat_disk($1_usertype)
1135                         devicekit_dbus_chat_power($1_usertype)
1136                 ')
1137
1138                 optional_policy(`
1139                         fprintd_dbus_chat($1_t)
1140                 ')
1141         ')
1142
1143         optional_policy(`
1144                 openoffice_role_template($1, $1_r, $1_usertype)
1145         ')
1146
1147         optional_policy(`
1148                 policykit_role($1_r, $1_usertype)
1149         ')
1150
1151         optional_policy(`
1152                 pulseaudio_role($1_r, $1_usertype)
1153                 pulseaudio_filetrans_admin_home_content($1_usertype)
1154                 pulseaudio_filetrans_home_content($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 rtkit_scheduled($1_usertype)
1159         ')
1160
1161         optional_policy(`
1162                 setroubleshoot_dontaudit_stream_connect($1_t)
1163         ')
1164
1165         optional_policy(`
1166                 udev_read_db($1_usertype)
1167         ')
1168
1169         optional_policy(`
1170                 wm_role_template($1, $1_r, $1_t)
1171         ')
1172 ')
1173
1174 #######################################
1175 ## <summary>
1176 ##      The template for creating a unprivileged user roughly
1177 ##      equivalent to a regular linux user.
1178 ## </summary>
1179 ## <desc>
1180 ##      <p>
1181 ##      The template for creating a unprivileged user roughly
1182 ##      equivalent to a regular linux user.
1183 ##      </p>
1184 ##      <p>
1185 ##      This template creates a user domain, types, and
1186 ##      rules for the user's tty, pty, home directories,
1187 ##      tmp, and tmpfs files.
1188 ##      </p>
1189 ## </desc>
1190 ## <param name="userdomain_prefix">
1191 ##      <summary>
1192 ##      The prefix of the user domain (e.g., user
1193 ##      is the prefix for user_t).
1194 ##      </summary>
1195 ## </param>
1196 #
1197 template(`userdom_unpriv_user_template', `
1198
1199         ##############################
1200         #
1201         # Declarations
1202         #
1203
1204         # Inherit rules for ordinary users.
1205         userdom_restricted_xwindows_user_template($1)
1206         userdom_common_user_template($1)
1207
1208         ##############################
1209         #
1210         # Local policy
1211         #
1212
1213         # port access is audited even if dac would not have allowed it, so dontaudit it here
1214 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1215         # Need the following rule to allow users to run vpnc
1216         corenet_tcp_bind_xserver_port($1_t)
1217         corenet_tcp_bind_generic_node($1_usertype)
1218
1219         storage_rw_fuse($1_t)
1220
1221         files_exec_usr_files($1_t)
1222    # cjp: why?
1223         files_read_kernel_symbol_table($1_t)
1224
1225         ifndef(`enable_mls',`
1226                 fs_exec_noxattr($1_t)
1227
1228                 tunable_policy(`user_rw_noexattrfile',`
1229                         fs_manage_noxattr_fs_files($1_t)
1230                         fs_manage_noxattr_fs_dirs($1_t)
1231                         # Write floppies
1232                         storage_raw_read_removable_device($1_t)
1233                         storage_raw_write_removable_device($1_t)
1234                 ',`
1235                         storage_raw_read_removable_device($1_t)
1236                 ')
1237         ')
1238
1239         miscfiles_read_hwdata($1_usertype)
1240
1241         # Allow users to run TCP servers (bind to ports and accept connection from
1242         # the same domain and outside users) disabling this forces FTP passive mode
1243         # and may change other protocols
1244
1245         tunable_policy(`user_share_music',`
1246                 corenet_tcp_bind_daap_port($1_usertype)
1247         ')
1248
1249         tunable_policy(`user_tcp_server',`
1250                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1251         ')
1252
1253         tunable_policy(`user_setrlimit',`
1254                 allow $1_usertype self:process setrlimit;
1255         ')
1256
1257         optional_policy(`
1258                 cdrecord_role($1_r, $1_t)
1259         ')
1260
1261         optional_policy(`
1262                 cron_role($1_r, $1_t)
1263         ')
1264
1265         optional_policy(`
1266                 games_rw_data($1_usertype)
1267         ')
1268
1269         optional_policy(`
1270                 gpg_role($1_r, $1_usertype)
1271         ')
1272
1273         optional_policy(`
1274                 gnomeclock_dbus_chat($1_t)
1275         ')
1276
1277         optional_policy(`
1278                 gpm_stream_connect($1_usertype)
1279         ')
1280
1281         optional_policy(`
1282                 execmem_role_template($1, $1_r, $1_t)
1283         ')
1284
1285         optional_policy(`
1286                 java_role_template($1, $1_r, $1_t)
1287         ')
1288
1289         optional_policy(`
1290                 mono_role_template($1, $1_r, $1_t)
1291         ')
1292
1293         optional_policy(`
1294                 mount_run_fusermount($1_t, $1_r)
1295                 mount_read_pid_files($1_t)
1296         ')
1297
1298         optional_policy(`
1299                 wine_role_template($1, $1_r, $1_t)
1300         ')
1301
1302         optional_policy(`
1303                 postfix_run_postdrop($1_t, $1_r)
1304         ')
1305
1306         # Run pppd in pppd_t by default for user
1307         optional_policy(`
1308                 ppp_run_cond($1_t, $1_r)
1309         ')
1310 ')
1311
1312 #######################################
1313 ## <summary>
1314 ##      The template for creating an administrative user.
1315 ## </summary>
1316 ## <desc>
1317 ##      <p>
1318 ##      This template creates a user domain, types, and
1319 ##      rules for the user's tty, pty, home directories,
1320 ##      tmp, and tmpfs files.
1321 ##      </p>
1322 ##      <p>
1323 ##      The privileges given to administrative users are:
1324 ##      <ul>
1325 ##              <li>Raw disk access</li>
1326 ##              <li>Set all sysctls</li>
1327 ##              <li>All kernel ring buffer controls</li>
1328 ##              <li>Create, read, write, and delete all files but shadow</li>
1329 ##              <li>Manage source and binary format SELinux policy</li>
1330 ##              <li>Run insmod</li>
1331 ##      </ul>
1332 ##      </p>
1333 ## </desc>
1334 ## <param name="userdomain_prefix">
1335 ##      <summary>
1336 ##      The prefix of the user domain (e.g., sysadm
1337 ##      is the prefix for sysadm_t).
1338 ##      </summary>
1339 ## </param>
1340 #
1341 template(`userdom_admin_user_template',`
1342         gen_require(`
1343                 attribute admindomain;
1344                 class passwd { passwd chfn chsh rootok crontab };
1345         ')
1346
1347         ##############################
1348         #
1349         # Declarations
1350         #
1351
1352         # Inherit rules for ordinary users.
1353         userdom_login_user_template($1)
1354         userdom_common_user_template($1)
1355
1356         domain_obj_id_change_exemption($1_t)
1357         role system_r types $1_t;
1358
1359         typeattribute $1_t admindomain;
1360
1361         ifdef(`direct_sysadm_daemon',`
1362                 domain_system_change_exemption($1_t)
1363         ')
1364
1365         ##############################
1366         #
1367         # $1_t local policy
1368         #
1369
1370         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1371         allow $1_t self:capability2 syslog;
1372         allow $1_t self:process { setexec setfscreate };
1373         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1374         allow $1_t self:tun_socket create;
1375         # Set password information for other users.
1376         allow $1_t self:passwd { passwd chfn chsh };
1377         # Skip authentication when pam_rootok is specified.
1378         allow $1_t self:passwd rootok;
1379
1380         # Manipulate other users crontab.
1381         allow $1_t self:passwd crontab;
1382
1383         kernel_read_software_raid_state($1_t)
1384         kernel_getattr_core_if($1_t)
1385         kernel_getattr_message_if($1_t)
1386         kernel_change_ring_buffer_level($1_t)
1387         kernel_clear_ring_buffer($1_t)
1388         kernel_read_ring_buffer($1_t)
1389         kernel_get_sysvipc_info($1_t)
1390         kernel_rw_all_sysctls($1_t)
1391         # signal unlabeled processes:
1392         kernel_kill_unlabeled($1_t)
1393         kernel_signal_unlabeled($1_t)
1394         kernel_sigstop_unlabeled($1_t)
1395         kernel_signull_unlabeled($1_t)
1396         kernel_sigchld_unlabeled($1_t)
1397         kernel_signal($1_t)
1398
1399         corenet_tcp_bind_generic_port($1_t)
1400         # allow setting up tunnels
1401         corenet_rw_tun_tap_dev($1_t)
1402
1403         dev_getattr_generic_blk_files($1_t)
1404         dev_getattr_generic_chr_files($1_t)
1405         # for lsof
1406         dev_getattr_mtrr_dev($1_t)
1407         # Allow MAKEDEV to work
1408         dev_create_all_blk_files($1_t)
1409         dev_create_all_chr_files($1_t)
1410         dev_delete_all_blk_files($1_t)
1411         dev_delete_all_chr_files($1_t)
1412         dev_rename_all_blk_files($1_t)
1413         dev_rename_all_chr_files($1_t)
1414         dev_create_generic_symlinks($1_t)
1415         dev_rw_generic_usb_dev($1_t)
1416         dev_rw_usbfs($1_t)
1417
1418         domain_setpriority_all_domains($1_t)
1419         domain_read_all_domains_state($1_t)
1420         domain_getattr_all_domains($1_t)
1421         domain_getcap_all_domains($1_t)
1422         domain_dontaudit_ptrace_all_domains($1_t)
1423         # signal all domains:
1424         domain_kill_all_domains($1_t)
1425         domain_signal_all_domains($1_t)
1426         domain_signull_all_domains($1_t)
1427         domain_sigstop_all_domains($1_t)
1428         domain_sigstop_all_domains($1_t)
1429         domain_sigchld_all_domains($1_t)
1430         # for lsof
1431         domain_getattr_all_sockets($1_t)
1432         domain_dontaudit_getattr_all_sockets($1_t)
1433
1434         files_exec_usr_src_files($1_t)
1435
1436         fs_getattr_all_fs($1_t)
1437         fs_getattr_all_files($1_t)
1438         fs_list_all($1_t)
1439         fs_set_all_quotas($1_t)
1440         fs_exec_noxattr($1_t)
1441
1442         storage_raw_read_removable_device($1_t)
1443         storage_raw_write_removable_device($1_t)
1444         storage_dontaudit_read_fixed_disk($1_t)
1445
1446         term_use_all_inherited_terms($1_t)
1447         term_use_unallocated_ttys($1_t)
1448
1449         auth_getattr_shadow($1_t)
1450         # Manage almost all files
1451         auth_manage_all_files_except_shadow($1_t)
1452         # Relabel almost all files
1453         auth_relabel_all_files_except_shadow($1_t)
1454
1455         init_telinit($1_t)
1456
1457         logging_send_syslog_msg($1_t)
1458
1459         optional_policy(`
1460                 modutils_domtrans_insmod($1_t)
1461                 modutils_domtrans_depmod($1_t)
1462         ')
1463
1464         # The following rule is temporary until such time that a complete
1465         # policy management infrastructure is in place so that an administrator
1466         # cannot directly manipulate policy files with arbitrary programs.
1467         seutil_manage_src_policy($1_t)
1468         # Violates the goal of limiting write access to checkpolicy.
1469         # But presently necessary for installing the file_contexts file.
1470         seutil_manage_bin_policy($1_t)
1471
1472         systemd_config_all_services($1_t)
1473
1474         userdom_manage_user_home_content_dirs($1_t)
1475         userdom_manage_user_home_content_files($1_t)
1476         userdom_manage_user_home_content_symlinks($1_t)
1477         userdom_manage_user_home_content_pipes($1_t)
1478         userdom_manage_user_home_content_sockets($1_t)
1479         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1480
1481         tunable_policy(`user_rw_noexattrfile',`
1482                 fs_manage_noxattr_fs_files($1_t)
1483                 fs_manage_noxattr_fs_dirs($1_t)
1484         ',`
1485                 fs_read_noxattr_fs_files($1_t)
1486         ')
1487
1488         optional_policy(`
1489                 postgresql_unconfined($1_t)
1490         ')
1491
1492         optional_policy(`
1493                 userhelper_exec($1_t)
1494         ')
1495 ')
1496
1497 ########################################
1498 ## <summary>
1499 ##      Allow user to run as a secadm
1500 ## </summary>
1501 ## <desc>
1502 ##      <p>
1503 ##      Create objects in a user home directory
1504 ##      with an automatic type transition to
1505 ##      a specified private type.
1506 ##      </p>
1507 ##      <p>
1508 ##      This is a templated interface, and should only
1509 ##      be called from a per-userdomain template.
1510 ##      </p>
1511 ## </desc>
1512 ## <param name="domain">
1513 ##      <summary>
1514 ##      Domain allowed access.
1515 ##      </summary>
1516 ## </param>
1517 ## <param name="role">
1518 ##      <summary>
1519 ##      The role  of the object to create.
1520 ##      </summary>
1521 ## </param>
1522 #
1523 template(`userdom_security_admin_template',`
1524         allow $1 self:capability { dac_read_search dac_override };
1525
1526         corecmd_exec_shell($1)
1527
1528         domain_obj_id_change_exemption($1)
1529
1530         dev_relabel_all_dev_nodes($1)
1531
1532         files_create_boot_flag($1)
1533         files_create_default_dir($1)
1534         files_root_filetrans_default($1, dir)
1535
1536         # Necessary for managing /boot/efi
1537         fs_manage_dos_files($1)
1538
1539         mls_process_read_up($1)
1540         mls_file_read_all_levels($1)
1541         mls_file_upgrade($1)
1542         mls_file_downgrade($1)
1543
1544         selinux_set_enforce_mode($1)
1545         selinux_set_all_booleans($1)
1546         selinux_set_parameters($1)
1547         selinux_read_policy($1)
1548
1549         auth_relabel_all_files_except_shadow($1)
1550         auth_relabel_shadow($1)
1551
1552         init_exec($1)
1553
1554         logging_send_syslog_msg($1)
1555         logging_read_audit_log($1)
1556         logging_read_generic_logs($1)
1557         logging_read_audit_config($1)
1558
1559         seutil_manage_bin_policy($1)
1560         seutil_manage_default_contexts($1)
1561         seutil_manage_file_contexts($1)
1562         seutil_manage_module_store($1)
1563         seutil_manage_config($1)
1564         seutil_run_checkpolicy($1,$2)
1565         seutil_run_loadpolicy($1,$2)
1566         seutil_run_semanage($1,$2)
1567         seutil_run_setsebool($1,$2)
1568         seutil_run_setfiles($1, $2)
1569
1570         seutil_manage_bin_policy($1)
1571     seutil_manage_default_contexts($1)
1572     seutil_manage_file_contexts($1)
1573     seutil_manage_module_store($1)
1574     seutil_manage_config($1)
1575
1576         optional_policy(`
1577                 aide_run($1,$2)
1578         ')
1579
1580         optional_policy(`
1581                 consoletype_exec($1)
1582         ')
1583
1584         optional_policy(`
1585                 dmesg_exec($1)
1586         ')
1587
1588         optional_policy(`
1589                 ipsec_run_setkey($1,$2)
1590         ')
1591
1592         optional_policy(`
1593                 netlabel_run_mgmt($1,$2)
1594         ')
1595
1596         optional_policy(`
1597                 samhain_run($1, $2)
1598         ')
1599 ')
1600
1601 ########################################
1602 ## <summary>
1603 ##      Make the specified type usable in a
1604 ##      user home directory.
1605 ## </summary>
1606 ## <param name="type">
1607 ##      <summary>
1608 ##      Type to be used as a file in the
1609 ##      user home directory.
1610 ##      </summary>
1611 ## </param>
1612 #
1613 interface(`userdom_user_home_content',`
1614         gen_require(`
1615                 type user_home_t;
1616                 attribute user_home_type;
1617         ')
1618
1619         allow $1 user_home_t:filesystem associate;
1620         files_type($1)
1621         ubac_constrained($1)
1622
1623         files_poly_member($1)
1624         typeattribute $1  user_home_type;
1625 ')
1626
1627 ########################################
1628 ## <summary>
1629 ##      Make the specified type usable in a
1630 ##      generic temporary directory.
1631 ## </summary>
1632 ## <param name="type">
1633 ##      <summary>
1634 ##      Type to be used as a file in the
1635 ##      generic temporary directory.
1636 ##      </summary>
1637 ## </param>
1638 #
1639 interface(`userdom_user_tmp_content',`
1640         gen_require(`
1641                 attribute user_tmp_type;
1642         ')
1643
1644         typeattribute $1 user_tmp_type;
1645
1646         files_tmp_file($1)
1647         ubac_constrained($1)
1648 ')
1649
1650 ########################################
1651 ## <summary>
1652 ##      Make the specified type usable in a
1653 ##      generic tmpfs_t directory.
1654 ## </summary>
1655 ## <param name="type">
1656 ##      <summary>
1657 ##      Type to be used as a file in the
1658 ##      generic temporary directory.
1659 ##      </summary>
1660 ## </param>
1661 #
1662 interface(`userdom_user_tmpfs_content',`
1663         gen_require(`
1664                 attribute user_tmpfs_type;
1665         ')
1666
1667         typeattribute $1 user_tmpfs_type;
1668
1669         files_tmpfs_file($1)
1670         ubac_constrained($1)
1671 ')
1672
1673 ########################################
1674 ## <summary>
1675 ##      Allow domain to attach to TUN devices created by administrative users.
1676 ## </summary>
1677 ## <param name="domain">
1678 ##      <summary>
1679 ##      Domain allowed access.
1680 ##      </summary>
1681 ## </param>
1682 #
1683 interface(`userdom_attach_admin_tun_iface',`
1684         gen_require(`
1685                 attribute admindomain;
1686         ')
1687
1688         allow $1 admindomain:tun_socket relabelfrom;
1689         allow $1 self:tun_socket relabelto;
1690 ')
1691
1692 ########################################
1693 ## <summary>
1694 ##      Set the attributes of a user pty.
1695 ## </summary>
1696 ## <param name="domain">
1697 ##      <summary>
1698 ##      Domain allowed access.
1699 ##      </summary>
1700 ## </param>
1701 #
1702 interface(`userdom_setattr_user_ptys',`
1703         gen_require(`
1704                 type user_devpts_t;
1705         ')
1706
1707         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1708 ')
1709
1710 ########################################
1711 ## <summary>
1712 ##      Create a user pty.
1713 ## </summary>
1714 ## <param name="domain">
1715 ##      <summary>
1716 ##      Domain allowed access.
1717 ##      </summary>
1718 ## </param>
1719 #
1720 interface(`userdom_create_user_pty',`
1721         gen_require(`
1722                 type user_devpts_t;
1723         ')
1724
1725         term_create_pty($1, user_devpts_t)
1726 ')
1727
1728 ########################################
1729 ## <summary>
1730 ##      Get the attributes of user home directories.
1731 ## </summary>
1732 ## <param name="domain">
1733 ##      <summary>
1734 ##      Domain allowed access.
1735 ##      </summary>
1736 ## </param>
1737 #
1738 interface(`userdom_getattr_user_home_dirs',`
1739         gen_require(`
1740                 type user_home_dir_t;
1741         ')
1742
1743         allow $1 user_home_dir_t:dir getattr_dir_perms;
1744         files_search_home($1)
1745 ')
1746
1747 ########################################
1748 ## <summary>
1749 ##      Do not audit attempts to get the attributes of user home directories.
1750 ## </summary>
1751 ## <param name="domain">
1752 ##      <summary>
1753 ##      Domain to not audit.
1754 ##      </summary>
1755 ## </param>
1756 #
1757 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1758         gen_require(`
1759                 type user_home_dir_t;
1760         ')
1761
1762         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1763 ')
1764
1765 ########################################
1766 ## <summary>
1767 ##      Search user home directories.
1768 ## </summary>
1769 ## <param name="domain">
1770 ##      <summary>
1771 ##      Domain allowed access.
1772 ##      </summary>
1773 ## </param>
1774 #
1775 interface(`userdom_search_user_home_dirs',`
1776         gen_require(`
1777                 type user_home_dir_t;
1778         ')
1779
1780         allow $1 user_home_dir_t:dir search_dir_perms;
1781         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1782         files_search_home($1)
1783 ')
1784
1785 ########################################
1786 ## <summary>
1787 ##      Do not audit attempts to search user home directories.
1788 ## </summary>
1789 ## <desc>
1790 ##      <p>
1791 ##      Do not audit attempts to search user home directories.
1792 ##      This will supress SELinux denial messages when the specified
1793 ##      domain is denied the permission to search these directories.
1794 ##      </p>
1795 ## </desc>
1796 ## <param name="domain">
1797 ##      <summary>
1798 ##      Domain to not audit.
1799 ##      </summary>
1800 ## </param>
1801 ## <infoflow type="none"/>
1802 #
1803 interface(`userdom_dontaudit_search_user_home_dirs',`
1804         gen_require(`
1805                 type user_home_dir_t;
1806         ')
1807
1808         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1809 ')
1810
1811 ########################################
1812 ## <summary>
1813 ##      List user home directories.
1814 ## </summary>
1815 ## <param name="domain">
1816 ##      <summary>
1817 ##      Domain allowed access.
1818 ##      </summary>
1819 ## </param>
1820 #
1821 interface(`userdom_list_user_home_dirs',`
1822         gen_require(`
1823                 type user_home_dir_t;
1824         ')
1825
1826         allow $1 user_home_dir_t:dir list_dir_perms;
1827         files_search_home($1)
1828
1829         tunable_policy(`use_nfs_home_dirs',`
1830                 fs_list_nfs($1)
1831         ')
1832
1833         tunable_policy(`use_samba_home_dirs',`
1834                 fs_list_cifs($1)
1835         ')
1836 ')
1837
1838 ########################################
1839 ## <summary>
1840 ##      Do not audit attempts to list user home subdirectories.
1841 ## </summary>
1842 ## <param name="domain">
1843 ##      <summary>
1844 ##      Domain to not audit.
1845 ##      </summary>
1846 ## </param>
1847 #
1848 interface(`userdom_dontaudit_list_user_home_dirs',`
1849         gen_require(`
1850                 type user_home_dir_t;
1851                 type user_home_t;
1852         ')
1853
1854         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1855         dontaudit $1 user_home_t:dir list_dir_perms;
1856 ')
1857
1858 ########################################
1859 ## <summary>
1860 ##      Create user home directories.
1861 ## </summary>
1862 ## <param name="domain">
1863 ##      <summary>
1864 ##      Domain allowed access.
1865 ##      </summary>
1866 ## </param>
1867 #
1868 interface(`userdom_create_user_home_dirs',`
1869         gen_require(`
1870                 type user_home_dir_t;
1871         ')
1872
1873         allow $1 user_home_dir_t:dir create_dir_perms;
1874 ')
1875
1876 ########################################
1877 ## <summary>
1878 ##      Create user home directories.
1879 ## </summary>
1880 ## <param name="domain">
1881 ##      <summary>
1882 ##      Domain allowed access.
1883 ##      </summary>
1884 ## </param>
1885 #
1886 interface(`userdom_manage_user_home_dirs',`
1887         gen_require(`
1888                 type user_home_dir_t;
1889         ')
1890
1891         allow $1 user_home_dir_t:dir manage_dir_perms;
1892 ')
1893
1894 ########################################
1895 ## <summary>
1896 ##      Relabel to user home directories.
1897 ## </summary>
1898 ## <param name="domain">
1899 ##      <summary>
1900 ##      Domain allowed access.
1901 ##      </summary>
1902 ## </param>
1903 #
1904 interface(`userdom_relabelto_user_home_dirs',`
1905         gen_require(`
1906                 type user_home_dir_t;
1907         ')
1908
1909         allow $1 user_home_dir_t:dir relabelto;
1910 ')
1911
1912
1913 ########################################
1914 ## <summary>
1915 ##      Relabel to user home files.
1916 ## </summary>
1917 ## <param name="domain">
1918 ##      <summary>
1919 ##      Domain allowed access.
1920 ##      </summary>
1921 ## </param>
1922 #
1923 interface(`userdom_relabelto_user_home_files',`
1924         gen_require(`
1925                 type user_home_t;
1926         ')
1927
1928         allow $1 user_home_t:file relabelto;
1929 ')
1930 ########################################
1931 ## <summary>
1932 ##      Relabel user home files.
1933 ## </summary>
1934 ## <param name="domain">
1935 ##      <summary>
1936 ##      Domain allowed access.
1937 ##      </summary>
1938 ## </param>
1939 #
1940 interface(`userdom_relabel_user_home_files',`
1941         gen_require(`
1942                 type user_home_t;
1943         ')
1944
1945         allow $1 user_home_t:file relabel_file_perms;
1946 ')
1947
1948 ########################################
1949 ## <summary>
1950 ##      Create directories in the home dir root with
1951 ##      the user home directory type.
1952 ## </summary>
1953 ## <param name="domain">
1954 ##      <summary>
1955 ##      Domain allowed access.
1956 ##      </summary>
1957 ## </param>
1958 #
1959 interface(`userdom_home_filetrans_user_home_dir',`
1960         gen_require(`
1961                 type user_home_dir_t;
1962         ')
1963
1964         files_home_filetrans($1, user_home_dir_t, dir)
1965 ')
1966
1967 ########################################
1968 ## <summary>
1969 ##      Do a domain transition to the specified
1970 ##      domain when executing a program in the
1971 ##      user home directory.
1972 ## </summary>
1973 ## <desc>
1974 ##      <p>
1975 ##      Do a domain transition to the specified
1976 ##      domain when executing a program in the
1977 ##      user home directory.
1978 ##      </p>
1979 ##      <p>
1980 ##      No interprocess communication (signals, pipes,
1981 ##      etc.) is provided by this interface since
1982 ##      the domains are not owned by this module.
1983 ##      </p>
1984 ## </desc>
1985 ## <param name="source_domain">
1986 ##      <summary>
1987 ##      Domain allowed to transition.
1988 ##      </summary>
1989 ## </param>
1990 ## <param name="target_domain">
1991 ##      <summary>
1992 ##      Domain to transition to.
1993 ##      </summary>
1994 ## </param>
1995 #
1996 interface(`userdom_user_home_domtrans',`
1997         gen_require(`
1998                 type user_home_dir_t, user_home_t;
1999         ')
2000
2001         domain_auto_trans($1, user_home_t, $2)
2002         allow $1 user_home_dir_t:dir search_dir_perms;
2003         files_search_home($1)
2004 ')
2005
2006 ########################################
2007 ## <summary>
2008 ##      Do not audit attempts to search user home content directories.
2009 ## </summary>
2010 ## <param name="domain">
2011 ##      <summary>
2012 ##      Domain to not audit.
2013 ##      </summary>
2014 ## </param>
2015 #
2016 interface(`userdom_dontaudit_search_user_home_content',`
2017         gen_require(`
2018                 type user_home_t;
2019         ')
2020
2021         dontaudit $1 user_home_t:dir search_dir_perms;
2022         fs_dontaudit_list_nfs($1)
2023         fs_dontaudit_list_cifs($1)
2024 ')
2025
2026 ########################################
2027 ## <summary>
2028 ##      List contents of users home directory.
2029 ## </summary>
2030 ## <param name="domain">
2031 ##      <summary>
2032 ##      Domain allowed access.
2033 ##      </summary>
2034 ## </param>
2035 #
2036 interface(`userdom_list_user_home_content',`
2037         gen_require(`
2038                 type user_home_dir_t;
2039                 attribute user_home_type;
2040         ')
2041
2042         files_list_home($1)
2043         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2044 ')
2045
2046 ########################################
2047 ## <summary>
2048 ##      Create, read, write, and delete directories
2049 ##      in a user home subdirectory.
2050 ## </summary>
2051 ## <param name="domain">
2052 ##      <summary>
2053 ##      Domain allowed access.
2054 ##      </summary>
2055 ## </param>
2056 #
2057 interface(`userdom_manage_user_home_content_dirs',`
2058         gen_require(`
2059                 type user_home_dir_t, user_home_t;
2060         ')
2061
2062         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2063         files_search_home($1)
2064 ')
2065
2066 ########################################
2067 ## <summary>
2068 ##      Delete directories in a user home subdirectory.
2069 ## </summary>
2070 ## <param name="domain">
2071 ##      <summary>
2072 ##      Domain allowed access.
2073 ##      </summary>
2074 ## </param>
2075 #
2076 interface(`userdom_delete_user_home_content_dirs',`
2077         gen_require(`
2078                 type user_home_t;
2079         ')
2080
2081         allow $1 user_home_t:dir delete_dir_perms;
2082 ')
2083
2084 ########################################
2085 ## <summary>
2086 ##      Delete all directories in a user home subdirectory.
2087 ## </summary>
2088 ## <param name="domain">
2089 ##      <summary>
2090 ##      Domain allowed access.
2091 ##      </summary>
2092 ## </param>
2093 #
2094 interface(`userdom_delete_all_user_home_content_dirs',`
2095         gen_require(`
2096                 attribute user_home_type;
2097         ')
2098
2099         allow $1 user_home_type:dir delete_dir_perms;
2100 ')
2101
2102 ########################################
2103 ## <summary>
2104 ##      Set the attributes of user home files.
2105 ## </summary>
2106 ## <param name="domain">
2107 ##      <summary>
2108 ##      Domain allowed access.
2109 ##      </summary>
2110 ## </param>
2111 ## <rolecap/>
2112 #
2113 interface(`userdom_setattr_user_home_content_files',`
2114         gen_require(`
2115                 type user_home_t;
2116         ')
2117
2118         allow $1 user_home_t:file setattr;
2119 ')
2120
2121 ########################################
2122 ## <summary>
2123 ##      Do not audit attempts to set the
2124 ##      attributes of user home files.
2125 ## </summary>
2126 ## <param name="domain">
2127 ##      <summary>
2128 ##      Domain to not audit.
2129 ##      </summary>
2130 ## </param>
2131 #
2132 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2133         gen_require(`
2134                 type user_home_t;
2135         ')
2136
2137         dontaudit $1 user_home_t:file setattr_file_perms;
2138 ')
2139
2140 ########################################
2141 ## <summary>
2142 ##      Set the attributes of all user home directories.
2143 ## </summary>
2144 ## <param name="domain">
2145 ##      <summary>
2146 ##      Domain allowed access.
2147 ##      </summary>
2148 ## </param>
2149 ## <rolecap/>
2150 #
2151 interface(`userdom_setattr_all_user_home_content_dirs',`
2152         gen_require(`
2153                 attribute user_home_type;
2154         ')
2155
2156         allow $1 user_home_type:dir setattr_dir_perms;
2157 ')
2158
2159 ########################################
2160 ## <summary>
2161 ##      Mmap user home files.
2162 ## </summary>
2163 ## <param name="domain">
2164 ##      <summary>
2165 ##      Domain allowed access.
2166 ##      </summary>
2167 ## </param>
2168 #
2169 interface(`userdom_mmap_user_home_content_files',`
2170         gen_require(`
2171                 type user_home_dir_t, user_home_t;
2172         ')
2173
2174         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2175         files_search_home($1)
2176 ')
2177
2178 ########################################
2179 ## <summary>
2180 ##      Read user home files.
2181 ## </summary>
2182 ## <param name="domain">
2183 ##      <summary>
2184 ##      Domain allowed access.
2185 ##      </summary>
2186 ## </param>
2187 #
2188 interface(`userdom_read_user_home_content_files',`
2189         gen_require(`
2190                 type user_home_dir_t, user_home_t;
2191         ')
2192
2193         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2194         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2195         files_search_home($1)
2196 ')
2197
2198 ########################################
2199 ## <summary>
2200 ##      Do not audit attempts to getattr user home files.
2201 ## </summary>
2202 ## <param name="domain">
2203 ##      <summary>
2204 ##      Domain to not audit.
2205 ##      </summary>
2206 ## </param>
2207 #
2208 interface(`userdom_dontaudit_getattr_user_home_content',`
2209         gen_require(`
2210                 attribute user_home_type;
2211         ')
2212
2213         dontaudit $1 user_home_type:dir getattr;
2214         dontaudit $1 user_home_type:file getattr;
2215 ')
2216
2217 ########################################
2218 ## <summary>
2219 ##      Do not audit attempts to read user home files.
2220 ## </summary>
2221 ## <param name="domain">
2222 ##      <summary>
2223 ##      Domain to not audit.
2224 ##      </summary>
2225 ## </param>
2226 #
2227 interface(`userdom_dontaudit_read_user_home_content_files',`
2228         gen_require(`
2229                 attribute user_home_type;
2230                 type user_home_dir_t;
2231         ')
2232
2233         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2234         dontaudit $1 user_home_type:dir list_dir_perms;
2235         dontaudit $1 user_home_type:file read_file_perms;
2236         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2237 ')
2238
2239 ########################################
2240 ## <summary>
2241 ##      Do not audit attempts to append user home files.
2242 ## </summary>
2243 ## <param name="domain">
2244 ##      <summary>
2245 ##      Domain to not audit.
2246 ##      </summary>
2247 ## </param>
2248 #
2249 interface(`userdom_dontaudit_append_user_home_content_files',`
2250         gen_require(`
2251                 type user_home_t;
2252         ')
2253
2254         dontaudit $1 user_home_t:file append_file_perms;
2255 ')
2256
2257 ########################################
2258 ## <summary>
2259 ##      Do not audit attempts to write user home files.
2260 ## </summary>
2261 ## <param name="domain">
2262 ##      <summary>
2263 ##      Domain to not audit.
2264 ##      </summary>
2265 ## </param>
2266 #
2267 interface(`userdom_dontaudit_write_user_home_content_files',`
2268         gen_require(`
2269                 type user_home_t;
2270         ')
2271
2272         dontaudit $1 user_home_t:file write_file_perms;
2273 ')
2274
2275 ########################################
2276 ## <summary>
2277 ##      Delete files in a user home subdirectory.
2278 ## </summary>
2279 ## <param name="domain">
2280 ##      <summary>
2281 ##      Domain allowed access.
2282 ##      </summary>
2283 ## </param>
2284 #
2285 interface(`userdom_delete_user_home_content_files',`
2286         gen_require(`
2287                 type user_home_t;
2288         ')
2289
2290         allow $1 user_home_t:file delete_file_perms;
2291 ')
2292
2293 ########################################
2294 ## <summary>
2295 ##      Delete all files in a user home subdirectory.
2296 ## </summary>
2297 ## <param name="domain">
2298 ##      <summary>
2299 ##      Domain allowed access.
2300 ##      </summary>
2301 ## </param>
2302 #
2303 interface(`userdom_delete_all_user_home_content_files',`
2304         gen_require(`
2305                 attribute user_home_type;
2306         ')
2307
2308         allow $1 user_home_type:file delete_file_perms;
2309 ')
2310
2311 ########################################
2312 ## <summary>
2313 ##      Delete sock files in a user home subdirectory.
2314 ## </summary>
2315 ## <param name="domain">
2316 ##      <summary>
2317 ##      Domain allowed access.
2318 ##      </summary>
2319 ## </param>
2320 #
2321 interface(`userdom_delete_user_home_content_sock_files',`
2322         gen_require(`
2323                 type user_home_t;
2324         ')
2325
2326         allow $1 user_home_t:sock_file delete_file_perms;
2327 ')
2328
2329 ########################################
2330 ## <summary>
2331 ##      Delete all sock files in a user home subdirectory.
2332 ## </summary>
2333 ## <param name="domain">
2334 ##      <summary>
2335 ##      Domain allowed access.
2336 ##      </summary>
2337 ## </param>
2338 #
2339 interface(`userdom_delete_all_user_home_content_sock_files',`
2340         gen_require(`
2341                 attribute user_home_type;
2342         ')
2343
2344         allow $1 user_home_type:sock_file delete_file_perms;
2345 ')
2346
2347 ########################################
2348 ## <summary>
2349 ##      Do not audit attempts to write user home files.
2350 ## </summary>
2351 ## <param name="domain">
2352 ##      <summary>
2353 ##      Domain to not audit.
2354 ##      </summary>
2355 ## </param>
2356 #
2357 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2358         gen_require(`
2359                 type user_home_t;
2360         ')
2361
2362         dontaudit $1 user_home_t:file relabel_file_perms;
2363 ')
2364
2365 ########################################
2366 ## <summary>
2367 ##      Read user home subdirectory symbolic links.
2368 ## </summary>
2369 ## <param name="domain">
2370 ##      <summary>
2371 ##      Domain allowed access.
2372 ##      </summary>
2373 ## </param>
2374 #
2375 interface(`userdom_read_user_home_content_symlinks',`
2376         gen_require(`
2377                 type user_home_dir_t, user_home_t;
2378         ')
2379
2380         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2381 ')
2382
2383 ########################################
2384 ## <summary>
2385 ##      Execute user home files.
2386 ## </summary>
2387 ## <param name="domain">
2388 ##      <summary>
2389 ##      Domain allowed access.
2390 ##      </summary>
2391 ## </param>
2392 ## <rolecap/>
2393 #
2394 interface(`userdom_exec_user_home_content_files',`
2395         gen_require(`
2396                 type user_home_dir_t;
2397                 attribute user_home_type;
2398         ')
2399
2400         files_search_home($1)
2401         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2402         dontaudit $1 user_home_type:sock_file execute;
2403         ')
2404
2405 ########################################
2406 ## <summary>
2407 ##      Do not audit attempts to execute user home files.
2408 ## </summary>
2409 ## <param name="domain">
2410 ##      <summary>
2411 ##      Domain to not audit.
2412 ##      </summary>
2413 ## </param>
2414 #
2415 interface(`userdom_dontaudit_exec_user_home_content_files',`
2416         gen_require(`
2417                 type user_home_t;
2418         ')
2419
2420         dontaudit $1 user_home_t:file exec_file_perms;
2421 ')
2422
2423 ########################################
2424 ## <summary>
2425 ##      Create, read, write, and delete files
2426 ##      in a user home subdirectory.
2427 ## </summary>
2428 ## <param name="domain">
2429 ##      <summary>
2430 ##      Domain allowed access.
2431 ##      </summary>
2432 ## </param>
2433 #
2434 interface(`userdom_manage_user_home_content_files',`
2435         gen_require(`
2436                 type user_home_dir_t, user_home_t;
2437         ')
2438
2439         manage_files_pattern($1, user_home_t, user_home_t)
2440         allow $1 user_home_dir_t:dir search_dir_perms;
2441         files_search_home($1)
2442 ')
2443
2444 ########################################
2445 ## <summary>
2446 ##      Do not audit attempts to create, read, write, and delete directories
2447 ##      in a user home subdirectory.
2448 ## </summary>
2449 ## <param name="domain">
2450 ##      <summary>
2451 ##      Domain to not audit.
2452 ##      </summary>
2453 ## </param>
2454 #
2455 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2456         gen_require(`
2457                 type user_home_dir_t, user_home_t;
2458         ')
2459
2460         dontaudit $1 user_home_t:dir manage_dir_perms;
2461 ')
2462
2463 ########################################
2464 ## <summary>
2465 ##      Create, read, write, and delete symbolic links
2466 ##      in a user home subdirectory.
2467 ## </summary>
2468 ## <param name="domain">
2469 ##      <summary>
2470 ##      Domain allowed access.
2471 ##      </summary>
2472 ## </param>
2473 #
2474 interface(`userdom_manage_user_home_content_symlinks',`
2475         gen_require(`
2476                 type user_home_dir_t, user_home_t;
2477         ')
2478
2479         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2480         allow $1 user_home_dir_t:dir search_dir_perms;
2481         files_search_home($1)
2482 ')
2483
2484 ########################################
2485 ## <summary>
2486 ##      Delete symbolic links in a user home directory.
2487 ## </summary>
2488 ## <param name="domain">
2489 ##      <summary>
2490 ##      Domain allowed access.
2491 ##      </summary>
2492 ## </param>
2493 #
2494 interface(`userdom_delete_user_home_content_symlinks',`
2495         gen_require(`
2496                 type user_home_t;
2497         ')
2498
2499         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2500 ')
2501
2502 ########################################
2503 ## <summary>
2504 ##      Delete all symbolic links in a user home directory.
2505 ## </summary>
2506 ## <param name="domain">
2507 ##      <summary>
2508 ##      Domain allowed access.
2509 ##      </summary>
2510 ## </param>
2511 #
2512 interface(`userdom_delete_all_user_home_content_symlinks',`
2513         gen_require(`
2514                 attribute user_home_type;
2515         ')
2516
2517         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2518 ')
2519
2520 ########################################
2521 ## <summary>
2522 ##      Create, read, write, and delete named pipes
2523 ##      in a user home subdirectory.
2524 ## </summary>
2525 ## <param name="domain">
2526 ##      <summary>
2527 ##      Domain allowed access.
2528 ##      </summary>
2529 ## </param>
2530 #
2531 interface(`userdom_manage_user_home_content_pipes',`
2532         gen_require(`
2533                 type user_home_dir_t, user_home_t;
2534         ')
2535
2536         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2537         allow $1 user_home_dir_t:dir search_dir_perms;
2538         files_search_home($1)
2539 ')
2540
2541 ########################################
2542 ## <summary>
2543 ##      Create, read, write, and delete named sockets
2544 ##      in a user home subdirectory.
2545 ## </summary>
2546 ## <param name="domain">
2547 ##      <summary>
2548 ##      Domain allowed access.
2549 ##      </summary>
2550 ## </param>
2551 #
2552 interface(`userdom_manage_user_home_content_sockets',`
2553         gen_require(`
2554                 type user_home_dir_t, user_home_t;
2555         ')
2556
2557         allow $1 user_home_dir_t:dir search_dir_perms;
2558         manage_sock_files_pattern($1, user_home_t, user_home_t)
2559         files_search_home($1)
2560 ')
2561
2562 ########################################
2563 ## <summary>
2564 ##      Create objects in a user home directory
2565 ##      with an automatic type transition to
2566 ##      a specified private type.
2567 ## </summary>
2568 ## <param name="domain">
2569 ##      <summary>
2570 ##      Domain allowed access.
2571 ##      </summary>
2572 ## </param>
2573 ## <param name="private_type">
2574 ##      <summary>
2575 ##      The type of the object to create.
2576 ##      </summary>
2577 ## </param>
2578 ## <param name="object_class">
2579 ##      <summary>
2580 ##      The class of the object to be created.
2581 ##      </summary>
2582 ## </param>
2583 #
2584 interface(`userdom_user_home_dir_filetrans',`
2585         gen_require(`
2586                 type user_home_dir_t;
2587         ')
2588
2589         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2590         files_search_home($1)
2591 ')
2592
2593 ########################################
2594 ## <summary>
2595 ##      Create objects in a user home directory
2596 ##      with an automatic type transition to
2597 ##      a specified private type.
2598 ## </summary>
2599 ## <param name="domain">
2600 ##      <summary>
2601 ##      Domain allowed access.
2602 ##      </summary>
2603 ## </param>
2604 ## <param name="private_type">
2605 ##      <summary>
2606 ##      The type of the object to create.
2607 ##      </summary>
2608 ## </param>
2609 ## <param name="object_class">
2610 ##      <summary>
2611 ##      The class of the object to be created.
2612 ##      </summary>
2613 ## </param>
2614 #
2615 interface(`userdom_user_home_content_filetrans',`
2616         gen_require(`
2617                 type user_home_dir_t, user_home_t;
2618         ')
2619
2620         filetrans_pattern($1, user_home_t, $2, $3)
2621         allow $1 user_home_dir_t:dir search_dir_perms;
2622         files_search_home($1)
2623 ')
2624
2625 ########################################
2626 ## <summary>
2627 ##      Create objects in a user home directory
2628 ##      with an automatic type transition to
2629 ##      the user home file type.
2630 ## </summary>
2631 ## <param name="domain">
2632 ##      <summary>
2633 ##      Domain allowed access.
2634 ##      </summary>
2635 ## </param>
2636 ## <param name="object_class">
2637 ##      <summary>
2638 ##      The class of the object to be created.
2639 ##      </summary>
2640 ## </param>
2641 #
2642 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2643         gen_require(`
2644                 type user_home_dir_t, user_home_t;
2645         ')
2646
2647         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2648         files_search_home($1)
2649 ')
2650
2651 ########################################
2652 ## <summary>
2653 ##      Write to user temporary named sockets.
2654 ## </summary>
2655 ## <param name="domain">
2656 ##      <summary>
2657 ##      Domain allowed access.
2658 ##      </summary>
2659 ## </param>
2660 #
2661 interface(`userdom_write_user_tmp_sockets',`
2662         gen_require(`
2663                 type user_tmp_t;
2664         ')
2665
2666         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2667         files_search_tmp($1)
2668 ')
2669
2670 ########################################
2671 ## <summary>
2672 ##      List user temporary directories.
2673 ## </summary>
2674 ## <param name="domain">
2675 ##      <summary>
2676 ##      Domain allowed access.
2677 ##      </summary>
2678 ## </param>
2679 #
2680 interface(`userdom_list_user_tmp',`
2681         gen_require(`
2682                 type user_tmp_t;
2683         ')
2684
2685         allow $1 user_tmp_t:dir list_dir_perms;
2686         files_search_tmp($1)
2687 ')
2688
2689 ########################################
2690 ## <summary>
2691 ##      Do not audit attempts to list user
2692 ##      temporary directories.
2693 ## </summary>
2694 ## <param name="domain">
2695 ##      <summary>
2696 ##      Domain to not audit.
2697 ##      </summary>
2698 ## </param>
2699 #
2700 interface(`userdom_dontaudit_list_user_tmp',`
2701         gen_require(`
2702                 type user_tmp_t;
2703         ')
2704
2705         dontaudit $1 user_tmp_t:dir list_dir_perms;
2706 ')
2707
2708 ########################################
2709 ## <summary>
2710 ##      Do not audit attempts to manage users
2711 ##      temporary directories.
2712 ## </summary>
2713 ## <param name="domain">
2714 ##      <summary>
2715 ##      Domain to not audit.
2716 ##      </summary>
2717 ## </param>
2718 #
2719 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2720         gen_require(`
2721                 type user_tmp_t;
2722         ')
2723
2724         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2725 ')
2726
2727 ########################################
2728 ## <summary>
2729 ##      Read user temporary files.
2730 ## </summary>
2731 ## <param name="domain">
2732 ##      <summary>
2733 ##      Domain allowed access.
2734 ##      </summary>
2735 ## </param>
2736 #
2737 interface(`userdom_read_user_tmp_files',`
2738         gen_require(`
2739                 type user_tmp_t;
2740         ')
2741
2742         read_files_pattern($1, user_tmp_t, user_tmp_t)
2743         allow $1 user_tmp_t:dir list_dir_perms;
2744         files_search_tmp($1)
2745 ')
2746
2747 ########################################
2748 ## <summary>
2749 ##      Do not audit attempts to read users
2750 ##      temporary files.
2751 ## </summary>
2752 ## <param name="domain">
2753 ##      <summary>
2754 ##      Domain to not audit.
2755 ##      </summary>
2756 ## </param>
2757 #
2758 interface(`userdom_dontaudit_read_user_tmp_files',`
2759         gen_require(`
2760                 type user_tmp_t;
2761         ')
2762
2763         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2764 ')
2765
2766 ########################################
2767 ## <summary>
2768 ##      Do not audit attempts to append users
2769 ##      temporary files.
2770 ## </summary>
2771 ## <param name="domain">
2772 ##      <summary>
2773 ##      Domain to not audit.
2774 ##      </summary>
2775 ## </param>
2776 #
2777 interface(`userdom_dontaudit_append_user_tmp_files',`
2778         gen_require(`
2779                 type user_tmp_t;
2780         ')
2781
2782         dontaudit $1 user_tmp_t:file append_file_perms;
2783 ')
2784
2785 ########################################
2786 ## <summary>
2787 ##      Read and write user temporary files.
2788 ## </summary>
2789 ## <param name="domain">
2790 ##      <summary>
2791 ##      Domain allowed access.
2792 ##      </summary>
2793 ## </param>
2794 #
2795 interface(`userdom_rw_user_tmp_files',`
2796         gen_require(`
2797                 type user_tmp_t;
2798         ')
2799
2800         allow $1 user_tmp_t:dir list_dir_perms;
2801         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2802         files_search_tmp($1)
2803 ')
2804
2805 ########################################
2806 ## <summary>
2807 ##      Do not audit attempts to manage users
2808 ##      temporary files.
2809 ## </summary>
2810 ## <param name="domain">
2811 ##      <summary>
2812 ##      Domain to not audit.
2813 ##      </summary>
2814 ## </param>
2815 #
2816 interface(`userdom_dontaudit_manage_user_tmp_files',`
2817         gen_require(`
2818                 type user_tmp_t;
2819         ')
2820
2821         dontaudit $1 user_tmp_t:file manage_file_perms;
2822 ')
2823
2824 ########################################
2825 ## <summary>
2826 ##      Read user temporary symbolic links.
2827 ## </summary>
2828 ## <param name="domain">
2829 ##      <summary>
2830 ##      Domain allowed access.
2831 ##      </summary>
2832 ## </param>
2833 #
2834 interface(`userdom_read_user_tmp_symlinks',`
2835         gen_require(`
2836                 type user_tmp_t;
2837         ')
2838
2839         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2840         allow $1 user_tmp_t:dir list_dir_perms;
2841         files_search_tmp($1)
2842 ')
2843
2844 ########################################
2845 ## <summary>
2846 ##      Create, read, write, and delete user
2847 ##      temporary directories.
2848 ## </summary>
2849 ## <param name="domain">
2850 ##      <summary>
2851 ##      Domain allowed access.
2852 ##      </summary>
2853 ## </param>
2854 #
2855 interface(`userdom_manage_user_tmp_dirs',`
2856         gen_require(`
2857                 type user_tmp_t;
2858         ')
2859
2860         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2861         files_search_tmp($1)
2862 ')
2863
2864 ########################################
2865 ## <summary>
2866 ##      Create, read, write, and delete user
2867 ##      temporary files.
2868 ## </summary>
2869 ## <param name="domain">
2870 ##      <summary>
2871 ##      Domain allowed access.
2872 ##      </summary>
2873 ## </param>
2874 #
2875 interface(`userdom_manage_user_tmp_files',`
2876         gen_require(`
2877                 type user_tmp_t;
2878         ')
2879
2880         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2881         files_search_tmp($1)
2882 ')
2883
2884 ########################################
2885 ## <summary>
2886 ##      Create, read, write, and delete user
2887 ##      temporary symbolic links.
2888 ## </summary>
2889 ## <param name="domain">
2890 ##      <summary>
2891 ##      Domain allowed access.
2892 ##      </summary>
2893 ## </param>
2894 #
2895 interface(`userdom_manage_user_tmp_symlinks',`
2896         gen_require(`
2897                 type user_tmp_t;
2898         ')
2899
2900         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2901         files_search_tmp($1)
2902 ')
2903
2904 ########################################
2905 ## <summary>
2906 ##      Create, read, write, and delete user
2907 ##      temporary named pipes.
2908 ## </summary>
2909 ## <param name="domain">
2910 ##      <summary>
2911 ##      Domain allowed access.
2912 ##      </summary>
2913 ## </param>
2914 #
2915 interface(`userdom_manage_user_tmp_pipes',`
2916         gen_require(`
2917                 type user_tmp_t;
2918         ')
2919
2920         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2921         files_search_tmp($1)
2922 ')
2923
2924 ########################################
2925 ## <summary>
2926 ##      Create, read, write, and delete user
2927 ##      temporary named sockets.
2928 ## </summary>
2929 ## <param name="domain">
2930 ##      <summary>
2931 ##      Domain allowed access.
2932 ##      </summary>
2933 ## </param>
2934 #
2935 interface(`userdom_manage_user_tmp_sockets',`
2936         gen_require(`
2937                 type user_tmp_t;
2938         ')
2939
2940         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2941         files_search_tmp($1)
2942 ')
2943
2944 ########################################
2945 ## <summary>
2946 ##      Create objects in a user temporary directory
2947 ##      with an automatic type transition to
2948 ##      a specified private type.
2949 ## </summary>
2950 ## <param name="domain">
2951 ##      <summary>
2952 ##      Domain allowed access.
2953 ##      </summary>
2954 ## </param>
2955 ## <param name="private_type">
2956 ##      <summary>
2957 ##      The type of the object to create.
2958 ##      </summary>
2959 ## </param>
2960 ## <param name="object_class">
2961 ##      <summary>
2962 ##      The class of the object to be created.
2963 ##      </summary>
2964 ## </param>
2965 #
2966 interface(`userdom_user_tmp_filetrans',`
2967         gen_require(`
2968                 type user_tmp_t;
2969         ')
2970
2971         filetrans_pattern($1, user_tmp_t, $2, $3)
2972         files_search_tmp($1)
2973 ')
2974
2975 ########################################
2976 ## <summary>
2977 ##      Create objects in the temporary directory
2978 ##      with an automatic type transition to
2979 ##      the user temporary type.
2980 ## </summary>
2981 ## <param name="domain">
2982 ##      <summary>
2983 ##      Domain allowed access.
2984 ##      </summary>
2985 ## </param>
2986 ## <param name="object_class">
2987 ##      <summary>
2988 ##      The class of the object to be created.
2989 ##      </summary>
2990 ## </param>
2991 #
2992 interface(`userdom_tmp_filetrans_user_tmp',`
2993         gen_require(`
2994                 type user_tmp_t;
2995         ')
2996
2997         files_tmp_filetrans($1, user_tmp_t, $2)
2998 ')
2999
3000 ########################################
3001 ## <summary>
3002 ##      Read user tmpfs files.
3003 ## </summary>
3004 ## <param name="domain">
3005 ##      <summary>
3006 ##      Domain allowed access.
3007 ##      </summary>
3008 ## </param>
3009 #
3010 interface(`userdom_read_user_tmpfs_files',`
3011         gen_require(`
3012                 type user_tmpfs_t;
3013         ')
3014
3015         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3016         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3017         allow $1 user_tmpfs_t:dir list_dir_perms;
3018         fs_search_tmpfs($1)
3019 ')
3020
3021 ########################################
3022 ## <summary>
3023 ##      Read/Write user tmpfs files.
3024 ## </summary>
3025 ## <param name="domain">
3026 ##      <summary>
3027 ##      Domain allowed access.
3028 ##      </summary>
3029 ## </param>
3030 #
3031 interface(`userdom_rw_user_tmpfs_files',`
3032         gen_require(`
3033                 type user_tmpfs_t;
3034         ')
3035
3036         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3037         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3038         allow $1 user_tmpfs_t:dir list_dir_perms;
3039         fs_search_tmpfs($1)
3040 ')
3041
3042 ########################################
3043 ## <summary>
3044 ##      Get the attributes of a user domain tty.
3045 ## </summary>
3046 ## <param name="domain">
3047 ##      <summary>
3048 ##      Domain allowed access.
3049 ##      </summary>
3050 ## </param>
3051 #
3052 interface(`userdom_getattr_user_ttys',`
3053         gen_require(`
3054                 type user_tty_device_t;
3055         ')
3056
3057         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3058 ')
3059
3060 ########################################
3061 ## <summary>
3062 ##      Do not audit attempts to get the attributes of a user domain tty.
3063 ## </summary>
3064 ## <param name="domain">
3065 ##      <summary>
3066 ##      Domain to not audit.
3067 ##      </summary>
3068 ## </param>
3069 #
3070 interface(`userdom_dontaudit_getattr_user_ttys',`
3071         gen_require(`
3072                 type user_tty_device_t;
3073         ')
3074
3075         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3076 ')
3077
3078 ########################################
3079 ## <summary>
3080 ##      Set the attributes of a user domain tty.
3081 ## </summary>
3082 ## <param name="domain">
3083 ##      <summary>
3084 ##      Domain allowed access.
3085 ##      </summary>
3086 ## </param>
3087 #
3088 interface(`userdom_setattr_user_ttys',`
3089         gen_require(`
3090                 type user_tty_device_t;
3091         ')
3092
3093         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3094 ')
3095
3096 ########################################
3097 ## <summary>
3098 ##      Do not audit attempts to set the attributes of a user domain tty.
3099 ## </summary>
3100 ## <param name="domain">
3101 ##      <summary>
3102 ##      Domain to not audit.
3103 ##      </summary>
3104 ## </param>
3105 #
3106 interface(`userdom_dontaudit_setattr_user_ttys',`
3107         gen_require(`
3108                 type user_tty_device_t;
3109         ')
3110
3111         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3112 ')
3113
3114 ########################################
3115 ## <summary>
3116 ##      Read and write a user domain tty.
3117 ## </summary>
3118 ## <param name="domain">
3119 ##      <summary>
3120 ##      Domain allowed access.
3121 ##      </summary>
3122 ## </param>
3123 #
3124 interface(`userdom_use_user_ttys',`
3125         gen_require(`
3126                 type user_tty_device_t;
3127         ')
3128
3129         allow $1 user_tty_device_t:chr_file rw_term_perms;
3130 ')
3131
3132 ########################################
3133 ## <summary>
3134 ##      Read and write a inherited user domain tty.
3135 ## </summary>
3136 ## <param name="domain">
3137 ##      <summary>
3138 ##      Domain allowed access.
3139 ##      </summary>
3140 ## </param>
3141 #
3142 interface(`userdom_use_inherited_user_ttys',`
3143         gen_require(`
3144                 type user_tty_device_t;
3145         ')
3146
3147         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3148 ')
3149
3150 ########################################
3151 ## <summary>
3152 ##      Read and write a user domain pty.
3153 ## </summary>
3154 ## <param name="domain">
3155 ##      <summary>
3156 ##      Domain allowed access.
3157 ##      </summary>
3158 ## </param>
3159 #
3160 interface(`userdom_use_user_ptys',`
3161         gen_require(`
3162                 type user_devpts_t;
3163         ')
3164
3165         allow $1 user_devpts_t:chr_file rw_term_perms;
3166 ')
3167
3168 ########################################
3169 ## <summary>
3170 ##      Read and write a inherited user domain pty.
3171 ## </summary>
3172 ## <param name="domain">
3173 ##      <summary>
3174 ##      Domain allowed access.
3175 ##      </summary>
3176 ## </param>
3177 #
3178 interface(`userdom_use_inherited_user_ptys',`
3179         gen_require(`
3180                 type user_devpts_t;
3181         ')
3182
3183         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3184 ')
3185
3186 ########################################
3187 ## <summary>
3188 ##      Read and write a inherited user TTYs and PTYs.
3189 ## </summary>
3190 ## <desc>
3191 ##      <p>
3192 ##      Allow the specified domain to read and write inherited user
3193 ##      TTYs and PTYs. This will allow the domain to
3194 ##      interact with the user via the terminal. Typically
3195 ##      all interactive applications will require this
3196 ##      access.
3197 ##      </p>
3198 ## </desc>
3199 ## <param name="domain">
3200 ##      <summary>
3201 ##      Domain allowed access.
3202 ##      </summary>
3203 ## </param>
3204 ## <infoflow type="both" weight="10"/>
3205 #
3206 interface(`userdom_use_inherited_user_terminals',`
3207         gen_require(`
3208                 type user_tty_device_t, user_devpts_t;
3209         ')
3210
3211         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3212         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3213 ')
3214
3215 #######################################
3216 ## <summary>
3217 ##  Allow attempts to read and write
3218 ##  a user domain tty and pty.
3219 ## </summary>
3220 ## <param name="domain">
3221 ##  <summary>
3222 ##  Domain to not audit.
3223 ##  </summary>
3224 ## </param>
3225 #
3226 interface(`userdom_use_user_terminals',`
3227     gen_require(`
3228         type user_tty_device_t, user_devpts_t;
3229     ')
3230
3231     allow $1 user_tty_device_t:chr_file rw_term_perms;
3232     allow $1 user_devpts_t:chr_file rw_term_perms;
3233 ')
3234
3235 ########################################
3236 ## <summary>
3237 ##      Do not audit attempts to read and write
3238 ##      a user domain tty and pty.
3239 ## </summary>
3240 ## <param name="domain">
3241 ##      <summary>
3242 ##      Domain to not audit.
3243 ##      </summary>
3244 ## </param>
3245 #
3246 interface(`userdom_dontaudit_use_user_terminals',`
3247         gen_require(`
3248                 type user_tty_device_t, user_devpts_t;
3249         ')
3250
3251         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3252         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3253 ')
3254
3255
3256 ########################################
3257 ## <summary>
3258 ##      Get attributes of user domain tty and pty.
3259 ## </summary>
3260 ## <param name="domain">
3261 ##      <summary>
3262 ##      Domain allowed access.
3263 ##      </summary>
3264 ## </param>
3265 #
3266 interface(`userdom_getattr_user_terminals',`
3267         gen_require(`
3268                 type user_tty_device_t, user_devpts_t;
3269         ')
3270
3271         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3272 ')
3273
3274 ########################################
3275 ## <summary>
3276 ##      Execute a shell in all user domains.  This
3277 ##      is an explicit transition, requiring the
3278 ##      caller to use setexeccon().
3279 ## </summary>
3280 ## <param name="domain">
3281 ##      <summary>
3282 ##      Domain allowed to transition.
3283 ##      </summary>
3284 ## </param>
3285 #
3286 interface(`userdom_spec_domtrans_all_users',`
3287         gen_require(`
3288                 attribute userdomain;
3289         ')
3290
3291         corecmd_shell_spec_domtrans($1, userdomain)
3292         allow userdomain $1:fd use;
3293         allow userdomain $1:fifo_file rw_file_perms;
3294         allow userdomain $1:process sigchld;
3295 ')
3296
3297 ########################################
3298 ## <summary>
3299 ##      Execute an Xserver session in all unprivileged user domains.  This
3300 ##      is an explicit transition, requiring the
3301 ##      caller to use setexeccon().
3302 ## </summary>
3303 ## <param name="domain">
3304 ##      <summary>
3305 ##      Domain allowed to transition.
3306 ##      </summary>
3307 ## </param>
3308 #
3309 interface(`userdom_xsession_spec_domtrans_all_users',`
3310         gen_require(`
3311                 attribute userdomain;
3312         ')
3313
3314         xserver_xsession_spec_domtrans($1, userdomain)
3315         allow userdomain $1:fd use;
3316         allow userdomain $1:fifo_file rw_file_perms;
3317         allow userdomain $1:process sigchld;
3318 ')
3319
3320 ########################################
3321 ## <summary>
3322 ##      Execute a shell in all unprivileged user domains.  This
3323 ##      is an explicit transition, requiring the
3324 ##      caller to use setexeccon().
3325 ## </summary>
3326 ## <param name="domain">
3327 ##      <summary>
3328 ##      Domain allowed to transition.
3329 ##      </summary>
3330 ## </param>
3331 #
3332 interface(`userdom_spec_domtrans_unpriv_users',`
3333         gen_require(`
3334                 attribute unpriv_userdomain;
3335         ')
3336
3337         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3338         allow unpriv_userdomain $1:fd use;
3339         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3340         allow unpriv_userdomain $1:process sigchld;
3341 ')
3342
3343 ########################################
3344 ## <summary>
3345 ##      Execute an Xserver session in all unprivileged user domains.  This
3346 ##      is an explicit transition, requiring the
3347 ##      caller to use setexeccon().
3348 ## </summary>
3349 ## <param name="domain">
3350 ##      <summary>
3351 ##      Domain allowed to transition.
3352 ##      </summary>
3353 ## </param>
3354 #
3355 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3356         gen_require(`
3357                 attribute unpriv_userdomain;
3358         ')
3359
3360         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3361         allow unpriv_userdomain $1:fd use;
3362         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3363         allow unpriv_userdomain $1:process sigchld;
3364 ')
3365
3366 ########################################
3367 ## <summary>
3368 ##      Manage unpriviledged user SysV sempaphores.
3369 ## </summary>
3370 ## <param name="domain">
3371 ##      <summary>
3372 ##      Domain allowed access.
3373 ##      </summary>
3374 ## </param>
3375 #
3376 interface(`userdom_manage_unpriv_user_semaphores',`
3377         gen_require(`
3378                 attribute unpriv_userdomain;
3379         ')
3380
3381         allow $1 unpriv_userdomain:sem create_sem_perms;
3382 ')
3383
3384 ########################################
3385 ## <summary>
3386 ##      Manage unpriviledged user SysV shared
3387 ##      memory segments.
3388 ## </summary>
3389 ## <param name="domain">
3390 ##      <summary>
3391 ##      Domain allowed access.
3392 ##      </summary>
3393 ## </param>
3394 #
3395 interface(`userdom_manage_unpriv_user_shared_mem',`
3396         gen_require(`
3397                 attribute unpriv_userdomain;
3398         ')
3399
3400         allow $1 unpriv_userdomain:shm create_shm_perms;
3401 ')
3402
3403 ########################################
3404 ## <summary>
3405 ##      Execute bin_t in the unprivileged user domains. This
3406 ##      is an explicit transition, requiring the
3407 ##      caller to use setexeccon().
3408 ## </summary>
3409 ## <param name="domain">
3410 ##      <summary>
3411 ##      Domain allowed to transition.
3412 ##      </summary>
3413 ## </param>
3414 #
3415 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3416         gen_require(`
3417                 attribute unpriv_userdomain;
3418         ')
3419
3420         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3421         allow unpriv_userdomain $1:fd use;
3422         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3423         allow unpriv_userdomain $1:process sigchld;
3424 ')
3425
3426 ########################################
3427 ## <summary>
3428 ##      Execute all entrypoint files in unprivileged user
3429 ##      domains. This is an explicit transition, requiring the
3430 ##      caller to use setexeccon().
3431 ## </summary>
3432 ## <param name="domain">
3433 ##      <summary>
3434 ##      Domain allowed access.
3435 ##      </summary>
3436 ## </param>
3437 #
3438 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3439         gen_require(`
3440                 attribute unpriv_userdomain;
3441         ')
3442
3443         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3444         allow unpriv_userdomain $1:fd use;
3445         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3446         allow unpriv_userdomain $1:process sigchld;
3447 ')
3448
3449 ########################################
3450 ## <summary>
3451 ##      Search users home directories.
3452 ## </summary>
3453 ## <param name="domain">
3454 ##      <summary>
3455 ##      Domain allowed access.
3456 ##      </summary>
3457 ## </param>
3458 #
3459 interface(`userdom_search_user_home_content',`
3460         gen_require(`
3461                 type user_home_dir_t;
3462                 attribute user_home_type;
3463         ')
3464
3465         files_list_home($1)
3466         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3467         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3468 ')
3469
3470 ########################################
3471 ## <summary>
3472 ##      Send general signals to unprivileged user domains.
3473 ## </summary>
3474 ## <param name="domain">
3475 ##      <summary>
3476 ##      Domain allowed access.
3477 ##      </summary>
3478 ## </param>
3479 #
3480 interface(`userdom_signal_unpriv_users',`
3481         gen_require(`
3482                 attribute unpriv_userdomain;
3483         ')
3484
3485         allow $1 unpriv_userdomain:process signal;
3486 ')
3487
3488 ########################################
3489 ## <summary>
3490 ##      Inherit the file descriptors from unprivileged user domains.
3491 ## </summary>
3492 ## <param name="domain">
3493 ##      <summary>
3494 ##      Domain allowed access.
3495 ##      </summary>
3496 ## </param>
3497 #
3498 interface(`userdom_use_unpriv_users_fds',`
3499         gen_require(`
3500                 attribute unpriv_userdomain;
3501         ')
3502
3503         allow $1 unpriv_userdomain:fd use;
3504 ')
3505
3506 ########################################
3507 ## <summary>
3508 ##      Do not audit attempts to inherit the file descriptors
3509 ##      from unprivileged user domains.
3510 ## </summary>
3511 ## <desc>
3512 ##      <p>
3513 ##      Do not audit attempts to inherit the file descriptors
3514 ##      from unprivileged user domains. This will supress
3515 ##      SELinux denial messages when the specified domain is denied
3516 ##      the permission to inherit these file descriptors.
3517 ##      </p>
3518 ## </desc>
3519 ## <param name="domain">
3520 ##      <summary>
3521 ##      Domain to not audit.
3522 ##      </summary>
3523 ## </param>
3524 ## <infoflow type="none"/>
3525 #
3526 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3527         gen_require(`
3528                 attribute unpriv_userdomain;
3529         ')
3530
3531         dontaudit $1 unpriv_userdomain:fd use;
3532 ')
3533
3534 ########################################
3535 ## <summary>
3536 ##      Do not audit attempts to use user ptys.
3537 ## </summary>
3538 ## <param name="domain">
3539 ##      <summary>
3540 ##      Domain to not audit.
3541 ##      </summary>
3542 ## </param>
3543 #
3544 interface(`userdom_dontaudit_use_user_ptys',`
3545         gen_require(`
3546                 type user_devpts_t;
3547         ')
3548
3549         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3550 ')
3551
3552 ########################################
3553 ## <summary>
3554 ##      Relabel files to unprivileged user pty types.
3555 ## </summary>
3556 ## <param name="domain">
3557 ##      <summary>
3558 ##      Domain allowed access.
3559 ##      </summary>
3560 ## </param>
3561 #
3562 interface(`userdom_relabelto_user_ptys',`
3563         gen_require(`
3564                 type user_devpts_t;
3565         ')
3566
3567         allow $1 user_devpts_t:chr_file relabelto;
3568 ')
3569
3570 ########################################
3571 ## <summary>
3572 ##      Do not audit attempts to relabel files from
3573 ##      user pty types.
3574 ## </summary>
3575 ## <param name="domain">
3576 ##      <summary>
3577 ##      Domain to not audit.
3578 ##      </summary>
3579 ## </param>
3580 #
3581 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3582         gen_require(`
3583                 type user_devpts_t;
3584         ')
3585
3586         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3587 ')
3588
3589 ########################################
3590 ## <summary>
3591 ##      Write all users files in /tmp
3592 ## </summary>
3593 ## <param name="domain">
3594 ##      <summary>
3595 ##      Domain allowed access.
3596 ##      </summary>
3597 ## </param>
3598 #
3599 interface(`userdom_write_user_tmp_files',`
3600         gen_require(`
3601                 type user_tmp_t;
3602         ')
3603
3604         write_files_pattern($1, user_tmp_t, user_tmp_t)
3605 ')
3606
3607 ########################################
3608 ## <summary>
3609 ##      Do not audit attempts to write users
3610 ##      temporary files.
3611 ## </summary>
3612 ## <param name="domain">
3613 ##      <summary>
3614 ##      Domain to not audit.
3615 ##      </summary>
3616 ## </param>
3617 #
3618 interface(`userdom_dontaudit_write_user_tmp_files',`
3619         gen_require(`
3620                 type user_tmp_t;
3621         ')
3622
3623         dontaudit $1 user_tmp_t:file write;
3624 ')
3625
3626 ########################################
3627 ## <summary>
3628 ##      Do not audit attempts to read/write users
3629 ##      temporary fifo files.
3630 ## </summary>
3631 ## <param name="domain">
3632 ##      <summary>
3633 ##      Domain to not audit.
3634 ##      </summary>
3635 ## </param>
3636 #
3637 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3638         gen_require(`
3639                 type user_tmp_t;
3640         ')
3641
3642         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3643 ')
3644
3645 ########################################
3646 ## <summary>
3647 ##      Do not audit attempts to use user ttys.
3648 ## </summary>
3649 ## <param name="domain">
3650 ##      <summary>
3651 ##      Domain to not audit.
3652 ##      </summary>
3653 ## </param>
3654 #
3655 interface(`userdom_dontaudit_use_user_ttys',`
3656         gen_require(`
3657                 type user_tty_device_t;
3658         ')
3659
3660         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3661 ')
3662
3663 ########################################
3664 ## <summary>
3665 ##      Read the process state of all user domains.
3666 ## </summary>
3667 ## <param name="domain">
3668 ##      <summary>
3669 ##      Domain allowed access.
3670 ##      </summary>
3671 ## </param>
3672 #
3673 interface(`userdom_read_all_users_state',`
3674         gen_require(`
3675                 attribute userdomain;
3676         ')
3677
3678         read_files_pattern($1, userdomain, userdomain)
3679         read_lnk_files_pattern($1,userdomain,userdomain)
3680         kernel_search_proc($1)
3681 ')
3682
3683 ########################################
3684 ## <summary>
3685 ##      Get the attributes of all user domains.
3686 ## </summary>
3687 ## <param name="domain">
3688 ##      <summary>
3689 ##      Domain allowed access.
3690 ##      </summary>
3691 ## </param>
3692 #
3693 interface(`userdom_getattr_all_users',`
3694         gen_require(`
3695                 attribute userdomain;
3696         ')
3697
3698         allow $1 userdomain:process getattr;
3699 ')
3700
3701 ########################################
3702 ## <summary>
3703 ##      Inherit the file descriptors from all user domains
3704 ## </summary>
3705 ## <param name="domain">
3706 ##      <summary>
3707 ##      Domain allowed access.
3708 ##      </summary>
3709 ## </param>
3710 #
3711 interface(`userdom_use_all_users_fds',`
3712         gen_require(`
3713                 attribute userdomain;
3714         ')
3715
3716         allow $1 userdomain:fd use;
3717 ')
3718
3719 ########################################
3720 ## <summary>
3721 ##      Do not audit attempts to inherit the file
3722 ##      descriptors from any user domains.
3723 ## </summary>
3724 ## <param name="domain">
3725 ##      <summary>
3726 ##      Domain to not audit.
3727 ##      </summary>
3728 ## </param>
3729 #
3730 interface(`userdom_dontaudit_use_all_users_fds',`
3731         gen_require(`
3732                 attribute userdomain;
3733         ')
3734
3735         dontaudit $1 userdomain:fd use;
3736 ')
3737
3738 ########################################
3739 ## <summary>
3740 ##      Send general signals to all user domains.
3741 ## </summary>
3742 ## <param name="domain">
3743 ##      <summary>
3744 ##      Domain allowed access.
3745 ##      </summary>
3746 ## </param>
3747 #
3748 interface(`userdom_signal_all_users',`
3749         gen_require(`
3750                 attribute userdomain;
3751         ')
3752
3753         allow $1 userdomain:process signal;
3754 ')
3755
3756 ########################################
3757 ## <summary>
3758 ##      Send kill signals to all user domains.
3759 ## </summary>
3760 ## <param name="domain">
3761 ##      <summary>
3762 ##      Domain allowed access.
3763 ##      </summary>
3764 ## </param>
3765 #
3766 interface(`userdom_kill_all_users',`
3767         gen_require(`
3768                 attribute userdomain;
3769         ')
3770
3771         allow $1 userdomain:process sigkill;
3772 ')
3773
3774 ########################################
3775 ## <summary>
3776 ##      Send a SIGCHLD signal to all user domains.
3777 ## </summary>
3778 ## <param name="domain">
3779 ##      <summary>
3780 ##      Domain allowed access.
3781 ##      </summary>
3782 ## </param>
3783 #
3784 interface(`userdom_sigchld_all_users',`
3785         gen_require(`
3786                 attribute userdomain;
3787         ')
3788
3789         allow $1 userdomain:process sigchld;
3790 ')
3791
3792 ########################################
3793 ## <summary>
3794 ##      Create keys for all user domains.
3795 ## </summary>
3796 ## <param name="domain">
3797 ##      <summary>
3798 ##      Domain allowed access.
3799 ##      </summary>
3800 ## </param>
3801 #
3802 interface(`userdom_create_all_users_keys',`
3803         gen_require(`
3804                 attribute userdomain;
3805         ')
3806
3807         allow $1 userdomain:key create;
3808 ')
3809
3810 ########################################
3811 ## <summary>
3812 ##      Send a dbus message to all user domains.
3813 ## </summary>
3814 ## <param name="domain">
3815 ##      <summary>
3816 ##      Domain allowed access.
3817 ##      </summary>
3818 ## </param>
3819 #
3820 interface(`userdom_dbus_send_all_users',`
3821         gen_require(`
3822                 attribute userdomain;
3823                 class dbus send_msg;
3824         ')
3825
3826         allow $1 userdomain:dbus send_msg;
3827 ')
3828
3829 ########################################
3830 ## <summary>
3831 ##      Allow apps to set rlimits on userdomain
3832 ## </summary>
3833 ## <param name="domain">
3834 ##      <summary>
3835 ##      Domain allowed access.
3836 ##      </summary>
3837 ## </param>
3838 #
3839 interface(`userdom_set_rlimitnh',`
3840         gen_require(`
3841                 attribute userdomain;
3842         ')
3843
3844         allow $1 userdomain:process rlimitinh;
3845 ')
3846
3847 ########################################
3848 ## <summary>
3849 ##      Define this type as a Allow apps to set rlimits on userdomain
3850 ## </summary>
3851 ## <param name="domain">
3852 ##      <summary>
3853 ##      Domain allowed access.
3854 ##      </summary>
3855 ## </param>
3856 ## <param name="userdomain_prefix">
3857 ##      <summary>
3858 ##      The prefix of the user domain (e.g., user
3859 ##      is the prefix for user_t).
3860 ## </summary>
3861 ## </param>
3862 ## <param name="domain">
3863 ##      <summary>
3864 ##      Domain allowed access.
3865 ##      </summary>
3866 ## </param>
3867 #
3868 template(`userdom_unpriv_usertype',`
3869         gen_require(`
3870                 attribute unpriv_userdomain, userdomain;
3871                 attribute $1_usertype;
3872         ')
3873         typeattribute $2  $1_usertype;
3874         typeattribute $2  unpriv_userdomain;
3875         typeattribute $2  userdomain;
3876
3877         auth_use_nsswitch($2)
3878         ubac_constrained($2)
3879 ')
3880
3881 ########################################
3882 ## <summary>
3883 ##      Connect to users over an unix stream socket.
3884 ## </summary>
3885 ## <param name="domain">
3886 ##      <summary>
3887 ##      Domain allowed access.
3888 ##      </summary>
3889 ## </param>
3890 #
3891 interface(`userdom_stream_connect',`
3892         gen_require(`
3893                 type user_tmp_t;
3894                 attribute userdomain;
3895         ')
3896
3897         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3898 ')
3899
3900 ########################################
3901 ## <summary>
3902 ##      Ptrace user domains.
3903 ## </summary>
3904 ## <param name="domain">
3905 ##      <summary>
3906 ##      Domain allowed access.
3907 ##      </summary>
3908 ## </param>
3909 #
3910 interface(`userdom_ptrace_all_users',`
3911         gen_require(`
3912                 attribute userdomain;
3913         ')
3914
3915         allow $1 userdomain:process ptrace;
3916 ')
3917
3918 ########################################
3919 ## <summary>
3920 ##      dontaudit Search /root
3921 ## </summary>
3922 ## <param name="domain">
3923 ##      <summary>
3924 ##      Domain to not audit.
3925 ##      </summary>
3926 ## </param>
3927 #
3928 interface(`userdom_dontaudit_search_admin_dir',`
3929         gen_require(`
3930                 type admin_home_t;
3931         ')
3932
3933         dontaudit $1 admin_home_t:dir search_dir_perms;
3934 ')
3935
3936 ########################################
3937 ## <summary>
3938 ##      dontaudit list /root
3939 ## </summary>
3940 ## <param name="domain">
3941 ##      <summary>
3942 ##      Domain to not audit.
3943 ##      </summary>
3944 ## </param>
3945 #
3946 interface(`userdom_dontaudit_list_admin_dir',`
3947         gen_require(`
3948                 type admin_home_t;
3949         ')
3950
3951         dontaudit $1 admin_home_t:dir list_dir_perms;
3952 ')
3953
3954 ########################################
3955 ## <summary>
3956 ##      Allow domain to  list /root
3957 ## </summary>
3958 ## <param name="domain">
3959 ##      <summary>
3960 ##      Domain allowed access.
3961 ##      </summary>
3962 ## </param>
3963 #
3964 interface(`userdom_list_admin_dir',`
3965         gen_require(`
3966                 type admin_home_t;
3967         ')
3968
3969         allow $1 admin_home_t:dir list_dir_perms;
3970 ')
3971
3972 ########################################
3973 ## <summary>
3974 ##      Allow Search /root
3975 ## </summary>
3976 ## <param name="domain">
3977 ##      <summary>
3978 ##      Domain allowed access.
3979 ##      </summary>
3980 ## </param>
3981 #
3982 interface(`userdom_search_admin_dir',`
3983         gen_require(`
3984                 type admin_home_t;
3985         ')
3986
3987         allow $1 admin_home_t:dir search_dir_perms;
3988 ')
3989
3990 ########################################
3991 ## <summary>
3992 ##      RW unpriviledged user SysV sempaphores.
3993 ## </summary>
3994 ## <param name="domain">
3995 ##      <summary>
3996 ##      Domain allowed access.
3997 ##      </summary>
3998 ## </param>
3999 #
4000 interface(`userdom_rw_semaphores',`
4001         gen_require(`
4002                 attribute unpriv_userdomain;
4003         ')
4004
4005         allow $1 unpriv_userdomain:sem rw_sem_perms;
4006 ')
4007
4008 ########################################
4009 ## <summary>
4010 ##      Send a message to unpriv users over a unix domain
4011 ##      datagram socket.
4012 ## </summary>
4013 ## <param name="domain">
4014 ##      <summary>
4015 ##      Domain allowed access.
4016 ##      </summary>
4017 ## </param>
4018 #
4019 interface(`userdom_dgram_send',`
4020         gen_require(`
4021                 attribute unpriv_userdomain;
4022         ')
4023
4024         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4025 ')
4026
4027 ######################################
4028 ## <summary>
4029 ##      Send a message to users over a unix domain
4030 ##      datagram socket.
4031 ## </summary>
4032 ## <param name="domain">
4033 ##      <summary>
4034 ##      Domain allowed access.
4035 ##      </summary>
4036 ## </param>
4037 #
4038 interface(`userdom_users_dgram_send',`
4039         gen_require(`
4040                  attribute userdomain;
4041       ')
4042
4043        allow $1 userdomain:unix_dgram_socket sendto;
4044 ')
4045
4046 #######################################
4047 ## <summary>
4048 ##      Allow execmod on files in homedirectory
4049 ## </summary>
4050 ## <param name="domain">
4051 ##      <summary>
4052 ##      Domain allowed access.
4053 ##      </summary>
4054 ## </param>
4055 ## <rolebase/>
4056 #
4057 interface(`userdom_execmod_user_home_files',`
4058         gen_require(`
4059                 type user_home_type;
4060         ')
4061
4062         allow $1 user_home_type:file execmod;
4063 ')
4064
4065 ########################################
4066 ## <summary>
4067 ##      Read admin home files.
4068 ## </summary>
4069 ## <param name="domain">
4070 ##      <summary>
4071 ##      Domain allowed access.
4072 ##      </summary>
4073 ## </param>
4074 ## <rolecap/>
4075 #
4076 interface(`userdom_read_admin_home_files',`
4077         gen_require(`
4078                 type admin_home_t;
4079         ')
4080
4081         read_files_pattern($1, admin_home_t, admin_home_t)
4082 ')
4083
4084 ########################################
4085 ## <summary>
4086 ##      Execute admin home files.
4087 ## </summary>
4088 ## <param name="domain">
4089 ##      <summary>
4090 ##      Domain allowed access.
4091 ##      </summary>
4092 ## </param>
4093 ## <rolecap/>
4094 #
4095 interface(`userdom_exec_admin_home_files',`
4096         gen_require(`
4097                 type admin_home_t;
4098         ')
4099
4100         exec_files_pattern($1, admin_home_t, admin_home_t)
4101 ')
4102
4103 ########################################
4104 ## <summary>
4105 ##      Append files inherited
4106 ##      in the /root directory.
4107 ## </summary>
4108 ## <param name="domain">
4109 ##      <summary>
4110 ##      Domain allowed access.
4111 ##      </summary>
4112 ## </param>
4113 #
4114 interface(`userdom_inherit_append_admin_home_files',`
4115         gen_require(`
4116                 type admin_home_t;
4117         ')
4118
4119         allow $1 admin_home_t:file { getattr append };
4120 ')
4121
4122
4123 #######################################
4124 ## <summary>
4125 ##      Manage all files/directories in the homedir
4126 ## </summary>
4127 ## <param name="userdomain">
4128 ##      <summary>
4129 ##      The user domain
4130 ##      </summary>
4131 ## </param>
4132 ## <rolebase/>
4133 #
4134 interface(`userdom_manage_user_home_content',`
4135         gen_require(`
4136                 type user_home_dir_t, user_home_t;
4137                 attribute user_home_type;
4138         ')
4139
4140         files_list_home($1)
4141         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4142         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4143         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4144         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4145         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4146         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4147
4148 ')
4149
4150
4151 ########################################
4152 ## <summary>
4153 ##      Create objects in a user home directory
4154 ##      with an automatic type transition to
4155 ##      the user home file type.
4156 ## </summary>
4157 ## <param name="domain">
4158 ##      <summary>
4159 ##      Domain allowed access.
4160 ##      </summary>
4161 ## </param>
4162 ## <param name="object_class">
4163 ##      <summary>
4164 ##      The class of the object to be created.
4165 ##      </summary>
4166 ## </param>
4167 #
4168 interface(`userdom_user_home_dir_filetrans_pattern',`
4169         gen_require(`
4170                 type user_home_dir_t, user_home_t;
4171         ')
4172
4173         type_transition $1 user_home_dir_t:$2 user_home_t;
4174 ')
4175
4176 ########################################
4177 ## <summary>
4178 ##      Create objects in the /root directory
4179 ##      with an automatic type transition to
4180 ##      a specified private type.
4181 ## </summary>
4182 ## <param name="domain">
4183 ##      <summary>
4184 ##      Domain allowed access.
4185 ##      </summary>
4186 ## </param>
4187 ## <param name="private_type">
4188 ##      <summary>
4189 ##      The type of the object to create.
4190 ##      </summary>
4191 ## </param>
4192 ## <param name="object_class">
4193 ##      <summary>
4194 ##      The class of the object to be created.
4195 ##      </summary>
4196 ## </param>
4197 #
4198 interface(`userdom_admin_home_dir_filetrans',`
4199         gen_require(`
4200                 type admin_home_t;
4201         ')
4202
4203         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4204 ')
4205
4206 ########################################
4207 ## <summary>
4208 ##      Send signull to unprivileged user domains.
4209 ## </summary>
4210 ## <param name="domain">
4211 ##      <summary>
4212 ##      Domain allowed access.
4213 ##      </summary>
4214 ## </param>
4215 #
4216 interface(`userdom_signull_unpriv_users',`
4217         gen_require(`
4218                 attribute unpriv_userdomain;
4219         ')
4220
4221         allow $1 unpriv_userdomain:process signull;
4222 ')
4223
4224 ########################################
4225 ## <summary>
4226 ##      Write all users files in /tmp
4227 ## </summary>
4228 ## <param name="domain">
4229 ##      <summary>
4230 ##      Domain allowed access.
4231 ##      </summary>
4232 ## </param>
4233 #
4234 interface(`userdom_write_user_tmp_dirs',`
4235         gen_require(`
4236                 type user_tmp_t;
4237         ')
4238
4239         write_files_pattern($1, user_tmp_t, user_tmp_t)
4240 ')
4241
4242 ########################################
4243 ## <summary>
4244 ##      Manage keys for all user domains.
4245 ## </summary>
4246 ## <param name="domain">
4247 ##      <summary>
4248 ##      Domain allowed access.
4249 ##      </summary>
4250 ## </param>
4251 #
4252 interface(`userdom_manage_all_users_keys',`
4253         gen_require(`
4254                 attribute userdomain;
4255         ')
4256
4257         allow $1 userdomain:key manage_key_perms;
4258 ')
4259
4260
4261 ########################################
4262 ## <summary>
4263 ##      Do not audit attempts to read and write
4264 ##      unserdomain stream.
4265 ## </summary>
4266 ## <param name="domain">
4267 ##      <summary>
4268 ##      Domain to not audit.
4269 ##      </summary>
4270 ## </param>
4271 #
4272 interface(`userdom_dontaudit_rw_stream',`
4273         gen_require(`
4274                 attribute userdomain;
4275         ')
4276
4277         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4278 ')
4279
4280 ########################################
4281 ## <summary>
4282 ##      Do not audit attempts to read and write
4283 ##      unserdomain datagram socket.
4284 ## </summary>
4285 ## <param name="domain">
4286 ##      <summary>
4287 ##      Domain to not audit.
4288 ##      </summary>
4289 ## </param>
4290 #
4291 interface(`userdom_dontaudit_rw_dgram_socket',`
4292         gen_require(`
4293                 attribute userdomain;
4294         ')
4295
4296         dontaudit $1 userdomain:unix_dgram_socket { read write };
4297 ')
4298
4299 ########################################
4300 ## <summary>
4301 ##      Append files
4302 ##      in a user home subdirectory.
4303 ## </summary>
4304 ## <param name="domain">
4305 ##      <summary>
4306 ##      Domain allowed access.
4307 ##      </summary>
4308 ## </param>
4309 #
4310 interface(`userdom_append_user_home_content_files',`
4311         gen_require(`
4312                 type user_home_dir_t, user_home_t;
4313         ')
4314
4315         append_files_pattern($1, user_home_t, user_home_t)
4316         allow $1 user_home_dir_t:dir search_dir_perms;
4317         files_search_home($1)
4318 ')
4319
4320 ########################################
4321 ## <summary>
4322 ##      Read files inherited
4323 ##      in a user home subdirectory.
4324 ## </summary>
4325 ## <param name="domain">
4326 ##      <summary>
4327 ##      Domain allowed access.
4328 ##      </summary>
4329 ## </param>
4330 #
4331 interface(`userdom_read_inherited_user_home_content_files',`
4332         gen_require(`
4333                 attribute user_home_type;
4334         ')
4335
4336         allow $1 user_home_type:file { getattr read };
4337 ')
4338
4339 ########################################
4340 ## <summary>
4341 ##      Append files inherited
4342 ##      in a user home subdirectory.
4343 ## </summary>
4344 ## <param name="domain">
4345 ##      <summary>
4346 ##      Domain allowed access.
4347 ##      </summary>
4348 ## </param>
4349 #
4350 interface(`userdom_inherit_append_user_home_content_files',`
4351         gen_require(`
4352                 type user_home_t;
4353         ')
4354
4355         allow $1 user_home_t:file { getattr append };
4356 ')
4357
4358 ########################################
4359 ## <summary>
4360 ##      Append files inherited
4361 ##      in a user tmp files.
4362 ## </summary>
4363 ## <param name="domain">
4364 ##      <summary>
4365 ##      Domain allowed access.
4366 ##      </summary>
4367 ## </param>
4368 #
4369 interface(`userdom_inherit_append_user_tmp_files',`
4370         gen_require(`
4371                 type user_tmp_t;
4372         ')
4373
4374         allow $1 user_tmp_t:file { getattr append };
4375 ')
4376
4377 ######################################
4378 ## <summary>
4379 ##      Read audio files in the users homedir.
4380 ## </summary>
4381 ## <param name="domain">
4382 ##      <summary>
4383 ##      Domain allowed access.
4384 ##      </summary>
4385 ## </param>
4386 ## <rolecap/>
4387 #
4388 interface(`userdom_read_home_audio_files',`
4389         gen_require(`
4390                 type audio_home_t;
4391         ')
4392
4393         userdom_search_user_home_dirs($1)
4394         allow $1 audio_home_t:dir list_dir_perms;
4395         read_files_pattern($1, audio_home_t, audio_home_t)
4396         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4397 ')
4398
4399 ########################################
4400 ## <summary>
4401 ##      Do not audit attempts to write all user home content files.
4402 ## </summary>
4403 ## <param name="domain">
4404 ##      <summary>
4405 ##      Domain to not audit.
4406 ##      </summary>
4407 ## </param>
4408 #
4409 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4410         gen_require(`
4411                 attribute user_home_type;
4412         ')
4413
4414         dontaudit $1 user_home_type:file write_file_perms;
4415 ')
4416
4417 ########################################
4418 ## <summary>
4419 ##      Do not audit attempts to write all user tmp content files.
4420 ## </summary>
4421 ## <param name="domain">
4422 ##      <summary>
4423 ##      Domain to not audit.
4424 ##      </summary>
4425 ## </param>
4426 #
4427 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4428         gen_require(`
4429                 attribute user_tmp_type;
4430         ')
4431
4432         dontaudit $1 user_tmp_type:file write_file_perms;
4433 ')
4434
4435 ########################################
4436 ## <summary>
4437 ##      Manage all user temporary content.
4438 ## </summary>
4439 ## <param name="domain">
4440 ##      <summary>
4441 ##      Domain allowed access.
4442 ##      </summary>
4443 ## </param>
4444 #
4445 interface(`userdom_manage_all_user_tmp_content',`
4446         gen_require(`
4447                 attribute user_tmp_type;
4448         ')
4449
4450         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4451         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4452         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4453         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4454         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4455         files_search_tmp($1)
4456 ')
4457
4458 ########################################
4459 ## <summary>
4460 ##      List all user temporary content.
4461 ## </summary>
4462 ## <param name="domain">
4463 ##      <summary>
4464 ##      Domain allowed access.
4465 ##      </summary>
4466 ## </param>
4467 #
4468 interface(`userdom_list_all_user_tmp_content',`
4469         gen_require(`
4470                 attribute user_tmp_type;
4471         ')
4472
4473         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4474         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4475         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4476         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4477         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4478         files_search_var($1)
4479         files_search_tmp($1)
4480 ')
4481
4482 ########################################
4483 ## <summary>
4484 ##      Manage all user tmpfs content.
4485 ## </summary>
4486 ## <param name="domain">
4487 ##      <summary>
4488 ##      Domain allowed access.
4489 ##      </summary>
4490 ## </param>
4491 #
4492 interface(`userdom_manage_all_user_tmpfs_content',`
4493         gen_require(`
4494                 attribute user_tmpfs_type;
4495         ')
4496
4497         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4498         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4499         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4500         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4501         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4502         fs_search_tmpfs($1)
4503 ')
4504
4505 ########################################
4506 ## <summary>
4507 ##      Delete all user temporary content.
4508 ## </summary>
4509 ## <param name="domain">
4510 ##      <summary>
4511 ##      Domain allowed access.
4512 ##      </summary>
4513 ## </param>
4514 #
4515 interface(`userdom_delete_all_user_tmp_content',`
4516         gen_require(`
4517                 attribute user_tmp_type;
4518         ')
4519
4520         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4521         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4522         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4523         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4524         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4525         # /var/tmp
4526         files_search_var($1)
4527         files_delete_tmp_dir_entry($1)
4528 ')
4529
4530 ########################################
4531 ## <summary>
4532 ##      Read system SSL certificates in the users homedir.
4533 ## </summary>
4534 ## <param name="domain">
4535 ##      <summary>
4536 ##      Domain allowed access.
4537 ##      </summary>
4538 ## </param>
4539 #
4540 interface(`userdom_read_home_certs',`
4541         gen_require(`
4542                 type home_cert_t;
4543         ')
4544
4545         userdom_search_user_home_content($1)
4546         allow $1 home_cert_t:dir list_dir_perms;
4547         read_files_pattern($1, home_cert_t, home_cert_t)
4548         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4549 ')
4550
4551 #######################################
4552 ## <summary>
4553 ##  Dontaudit Write system SSL certificates in the users homedir.
4554 ## </summary>
4555 ## <param name="domain">
4556 ##  <summary>
4557 ##      Domain to not audit.
4558 ##  </summary>
4559 ## </param>
4560 #
4561 interface(`userdom_dontaudit_write_home_certs',`
4562     gen_require(`
4563         type home_cert_t;
4564     ')
4565
4566     dontaudit $1 home_cert_t:file write;
4567 ')
4568
4569 ########################################
4570 ## <summary>
4571 ##      dontaudit Search getatrr /root files
4572 ## </summary>
4573 ## <param name="domain">
4574 ##      <summary>
4575 ##      Domain to not audit.
4576 ##      </summary>
4577 ## </param>
4578 #
4579 interface(`userdom_dontaudit_getattr_admin_home_files',`
4580         gen_require(`
4581                 type admin_home_t;
4582         ')
4583
4584         dontaudit $1 admin_home_t:file getattr;
4585 ')
4586
4587 ########################################
4588 ## <summary>
4589 ##      dontaudit read /root lnk files
4590 ## </summary>
4591 ## <param name="domain">
4592 ##      <summary>
4593 ##      Domain to not audit.
4594 ##      </summary>
4595 ## </param>
4596 #
4597 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4598         gen_require(`
4599                 type admin_home_t;
4600         ')
4601
4602         dontaudit $1 admin_home_t:lnk_file read;
4603 ')
4604
4605 ########################################
4606 ## <summary>
4607 ##      dontaudit read /root files
4608 ## </summary>
4609 ## <param name="domain">
4610 ##      <summary>
4611 ##      Domain to not audit.
4612 ##      </summary>
4613 ## </param>
4614 #
4615 interface(`userdom_dontaudit_read_admin_home_files',`
4616         gen_require(`
4617                 type admin_home_t;
4618         ')
4619
4620         dontaudit $1 admin_home_t:file read_file_perms;
4621 ')
4622
4623 ########################################
4624 ## <summary>
4625 ##      Create, read, write, and delete user
4626 ##      temporary chr files.
4627 ## </summary>
4628 ## <param name="domain">
4629 ##      <summary>
4630 ##      Domain allowed access.
4631 ##      </summary>
4632 ## </param>
4633 #
4634 interface(`userdom_manage_user_tmp_chr_files',`
4635         gen_require(`
4636                 type user_tmp_t;
4637         ')
4638
4639         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4640         files_search_tmp($1)
4641 ')
4642
4643 ########################################
4644 ## <summary>
4645 ##      Create, read, write, and delete user
4646 ##      temporary blk files.
4647 ## </summary>
4648 ## <param name="domain">
4649 ##      <summary>
4650 ##      Domain allowed access.
4651 ##      </summary>
4652 ## </param>
4653 #
4654 interface(`userdom_manage_user_tmp_blk_files',`
4655         gen_require(`
4656                 type user_tmp_t;
4657         ')
4658
4659         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4660         files_search_tmp($1)
4661 ')
4662
4663 ########################################
4664 ## <summary>
4665 ##      Dontaudit attempt to set attributes on  user temporary directories.
4666 ## </summary>
4667 ## <param name="domain">
4668 ##      <summary>
4669 ##      Domain to not audit.
4670 ##      </summary>
4671 ## </param>
4672 #
4673 interface(`userdom_dontaudit_setattr_user_tmp',`
4674         gen_require(`
4675                 type user_tmp_t;
4676         ')
4677
4678         dontaudit $1 user_tmp_t:dir setattr;
4679 ')
4680
4681 ########################################
4682 ## <summary>
4683 ##      Write all inherited users files in /tmp
4684 ## </summary>
4685 ## <param name="domain">
4686 ##      <summary>
4687 ##      Domain allowed access.
4688 ##      </summary>
4689 ## </param>
4690 #
4691 interface(`userdom_write_inherited_user_tmp_files',`
4692         gen_require(`
4693                 type user_tmp_t;
4694         ')
4695
4696         allow $1 user_tmp_t:file write;
4697 ')
4698
4699 ########################################
4700 ## <summary>
4701 ##      Delete all users files in /tmp
4702 ## </summary>
4703 ## <param name="domain">
4704 ##      <summary>
4705 ##      Domain allowed access.
4706 ##      </summary>
4707 ## </param>
4708 #
4709 interface(`userdom_delete_user_tmp_files',`
4710         gen_require(`
4711                 type user_tmp_t;
4712         ')
4713
4714         allow $1 user_tmp_t:file delete_file_perms;
4715 ')
4716
4717 ########################################
4718 ## <summary>
4719 ##      Delete user tmpfs files.
4720 ## </summary>
4721 ## <param name="domain">
4722 ##      <summary>
4723 ##      Domain allowed access.
4724 ##      </summary>
4725 ## </param>
4726 #
4727 interface(`userdom_delete_user_tmpfs_files',`
4728         gen_require(`
4729                 type user_tmpfs_t;
4730         ')
4731
4732         allow $1 user_tmpfs_t:file delete_file_perms;
4733 ')
4734
4735 ########################################
4736 ## <summary>
4737 ##      Read/Write unpriviledged user SysV shared
4738 ##      memory segments.
4739 ## </summary>
4740 ## <param name="domain">
4741 ##      <summary>
4742 ##      Domain allowed access.
4743 ##      </summary>
4744 ## </param>
4745 #
4746 interface(`userdom_rw_unpriv_user_shared_mem',`
4747         gen_require(`
4748                 attribute unpriv_userdomain;
4749         ')
4750
4751         allow $1 unpriv_userdomain:shm rw_shm_perms;
4752 ')
4753
4754 ########################################
4755 ## <summary>
4756 ##      Do not audit attempts to search user
4757 ##      temporary directories.
4758 ## </summary>
4759 ## <param name="domain">
4760 ##      <summary>
4761 ##      Domain to not audit.
4762 ##      </summary>
4763 ## </param>
4764 #
4765 interface(`userdom_dontaudit_search_user_tmp',`
4766         gen_require(`
4767                 type user_tmp_t;
4768         ')
4769
4770         dontaudit $1 user_tmp_t:dir search_dir_perms;
4771 ')
4772
4773 ########################################
4774 ## <summary>
4775 ##      Execute a file in a user home directory
4776 ##      in the specified domain.
4777 ## </summary>
4778 ## <desc>
4779 ##      <p>
4780 ##      Execute a file in a user home directory
4781 ##      in the specified domain.
4782 ##      </p>
4783 ##      <p>
4784 ##      No interprocess communication (signals, pipes,
4785 ##      etc.) is provided by this interface since
4786 ##      the domains are not owned by this module.
4787 ##      </p>
4788 ## </desc>
4789 ## <param name="domain">
4790 ##      <summary>
4791 ##      Domain allowed access.
4792 ##      </summary>
4793 ## </param>
4794 ## <param name="target_domain">
4795 ##      <summary>
4796 ##      The type of the new process.
4797 ##      </summary>
4798 ## </param>
4799 #
4800 interface(`userdom_domtrans_user_home',`
4801         gen_require(`
4802                 type user_home_t;
4803         ')
4804
4805         read_lnk_files_pattern($1, user_home_t, user_home_t)
4806         domain_transition_pattern($1, user_home_t, $2)
4807         type_transition $1 user_home_t:process $2;
4808 ')
4809
4810 ########################################
4811 ## <summary>
4812 ##      Execute a file in a user tmp directory
4813 ##      in the specified domain.
4814 ## </summary>
4815 ## <desc>
4816 ##      <p>
4817 ##      Execute a file in a user tmp directory
4818 ##      in the specified domain.
4819 ##      </p>
4820 ##      <p>
4821 ##      No interprocess communication (signals, pipes,
4822 ##      etc.) is provided by this interface since
4823 ##      the domains are not owned by this module.
4824 ##      </p>
4825 ## </desc>
4826 ## <param name="domain">
4827 ##      <summary>
4828 ##      Domain allowed access.
4829 ##      </summary>
4830 ## </param>
4831 ## <param name="target_domain">
4832 ##      <summary>
4833 ##      The type of the new process.
4834 ##      </summary>
4835 ## </param>
4836 #
4837 interface(`userdom_domtrans_user_tmp',`
4838         gen_require(`
4839                 type user_tmp_t;
4840         ')
4841
4842         files_search_tmp($1)
4843         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4844         domain_transition_pattern($1, user_tmp_t, $2)
4845         type_transition $1 user_tmp_t:process $2;
4846 ')
4847
4848 ########################################
4849 ## <summary>
4850 ##      Do not audit attempts to read all user home content files.
4851 ## </summary>
4852 ## <param name="domain">
4853 ##      <summary>
4854 ##      Domain to not audit.
4855 ##      </summary>
4856 ## </param>
4857 #
4858 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4859         gen_require(`
4860                 attribute user_home_type;
4861         ')
4862
4863         dontaudit $1 user_home_type:file read_file_perms;
4864 ')
4865
4866 ########################################
4867 ## <summary>
4868 ##      Do not audit attempts to read all user tmp content files.
4869 ## </summary>
4870 ## <param name="domain">
4871 ##      <summary>
4872 ##      Domain to not audit.
4873 ##      </summary>
4874 ## </param>
4875 #
4876 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4877         gen_require(`
4878                 attribute user_tmp_type;
4879         ')
4880
4881         dontaudit $1 user_tmp_type:file read_file_perms;
4882 ')
4883
4884 #######################################
4885 ## <summary>
4886 ## Read and write unpriviledged user SysV sempaphores.
4887 ## </summary>
4888 ## <param name="domain">
4889 ## <summary>
4890 ## Domain allowed access.
4891 ## </summary>
4892 ## </param>
4893 #
4894 interface(`userdom_rw_unpriv_user_semaphores',`
4895    gen_require(`
4896        attribute unpriv_userdomain;
4897    ')
4898
4899    allow $1 unpriv_userdomain:sem rw_sem_perms;
4900 ')