policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         userdom_filetrans_home_content($2)
 285
 286         files_list_home($2)
 287
 288         # cjp: this should probably be removed:
 289         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 290
 291         tunable_policy(`use_nfs_home_dirs',`
 292                 fs_mount_nfs($2)
 293                 fs_mounton_nfs($2)
 294                 fs_manage_nfs_dirs($2)
 295                 fs_manage_nfs_files($2)
 296                 fs_manage_nfs_symlinks($2)
 297                 fs_manage_nfs_named_sockets($2)
 298                 fs_manage_nfs_named_pipes($2)
 299         ')
 300
 301         tunable_policy(`use_samba_home_dirs',`
 302                 fs_mount_cifs($2)
 303                 fs_mounton_cifs($2)
 304                 fs_manage_cifs_dirs($2)
 305                 fs_manage_cifs_files($2)
 306                 fs_manage_cifs_symlinks($2)
 307                 fs_manage_cifs_named_sockets($2)
 308                 fs_manage_cifs_named_pipes($2)
 309         ')
 310 ')
 311
 312 #######################################
 313 ## <summary>
 314 ##      Manage user temporary files
 315 ## </summary>
 316 ## <param name="role">
 317 ##      <summary>
 318 ##      Role allowed access.
 319 ##      </summary>
 320 ## </param>
 321 ## <param name="domain">
 322 ##      <summary>
 323 ##      Domain allowed access.
 324 ##      </summary>
 325 ## </param>
 326 ## <rolebase/>
 327 #
 328 interface(`userdom_manage_tmp_role',`
 329         gen_require(`
 330                 attribute user_tmp_type;
 331                 type user_tmp_t;
 332         ')
 333
 334         role $1 types user_tmp_t;
 335
 336         files_poly_member_tmp($2, user_tmp_t)
 337
 338         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 341         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 343         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 344         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 347         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 349 ')
 350
 351 #######################################
 352 ## <summary>
 353 ##      Dontaudit search of user bin dirs.
 354 ## </summary>
 355 ## <param name="domain">
 356 ##      <summary>
 357 ##      Domain to not audit.
 358 ##      </summary>
 359 ## </param>
 360 #
 361 interface(`userdom_dontaudit_search_user_bin_dirs',`
 362         gen_require(`
 363                 type home_bin_t;
 364         ')
 365
 366         dontaudit $1 home_bin_t:dir search_dir_perms;
 367 ')
 368
 369 #######################################
 370 ## <summary>
 371 ##      Execute user bin files.
 372 ## </summary>
 373 ## <param name="domain">
 374 ##      <summary>
 375 ##      Domain allowed access.
 376 ##      </summary>
 377 ## </param>
 378 #
 379 interface(`userdom_exec_user_bin_files',`
 380         gen_require(`
 381                 attribute user_home_type;
 382                 type home_bin_t, user_home_dir_t;
 383         ')
 384
 385         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 386         files_search_home($1)
 387 ')
 388
 389 #######################################
 390 ## <summary>
 391 ##      The execute access user temporary files.
 392 ## </summary>
 393 ## <param name="domain">
 394 ##      <summary>
 395 ##      Domain allowed access.
 396 ##      </summary>
 397 ## </param>
 398 ## <rolebase/>
 399 #
 400 interface(`userdom_exec_user_tmp_files',`
 401         gen_require(`
 402                 type user_tmp_t;
 403         ')
 404
 405         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 406         dontaudit $1 user_tmp_t:sock_file execute;
 407         files_search_tmp($1)
 408 ')
 409
 410 #######################################
 411 ## <summary>
 412 ##      Role access for the user tmpfs type
 413 ##      that the user has full access.
 414 ## </summary>
 415 ## <desc>
 416 ##      <p>
 417 ##      Role access for the user tmpfs type
 418 ##      that the user has full access.
 419 ##      </p>
 420 ##      <p>
 421 ##      This does not allow execute access.
 422 ##      </p>
 423 ## </desc>
 424 ## <param name="role">
 425 ##      <summary>
 426 ##      Role allowed access.
 427 ##      </summary>
 428 ## </param>
 429 ## <param name="domain">
 430 ##      <summary>
 431 ##      Domain allowed access.
 432 ##      </summary>
 433 ## </param>
 434 ## <rolecap/>
 435 #
 436 interface(`userdom_manage_tmpfs_role',`
 437         gen_require(`
 438                 attribute user_tmpfs_type;
 439                 type user_tmpfs_t;
 440         ')
 441
 442         role $1 types user_tmpfs_t;
 443
 444         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 450         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455 ')
 456
 457 #######################################
 458 ## <summary>
 459 ##      The interface allowing the user basic
 460 ##      network permissions
 461 ## </summary>
 462 ## <param name="userdomain">
 463 ##      <summary>
 464 ##      The user domain
 465 ##      </summary>
 466 ## </param>
 467 ## <rolebase/>
 468 #
 469 interface(`userdom_basic_networking',`
 470
 471         allow $1 self:tcp_socket create_stream_socket_perms;
 472         allow $1 self:udp_socket create_socket_perms;
 473
 474         corenet_all_recvfrom_unlabeled($1)
 475         corenet_all_recvfrom_netlabel($1)
 476         corenet_tcp_sendrecv_generic_if($1)
 477         corenet_udp_sendrecv_generic_if($1)
 478         corenet_tcp_sendrecv_generic_node($1)
 479         corenet_udp_sendrecv_generic_node($1)
 480         corenet_tcp_sendrecv_all_ports($1)
 481         corenet_udp_sendrecv_all_ports($1)
 482         corenet_tcp_connect_all_ports($1)
 483         corenet_sendrecv_all_client_packets($1)
 484
 485         optional_policy(`
 486                 init_tcp_recvfrom_all_daemons($1)
 487                 init_udp_recvfrom_all_daemons($1)
 488         ')
 489
 490         optional_policy(`
 491                 ipsec_match_default_spd($1)
 492         ')
 493
 494 ')
 495
 496 #######################################
 497 ## <summary>
 498 ##      The template for creating a user xwindows client.  (Deprecated)
 499 ## </summary>
 500 ## <param name="userdomain_prefix">
 501 ##      <summary>
 502 ##      The prefix of the user domain (e.g., user
 503 ##      is the prefix for user_t).
 504 ##      </summary>
 505 ## </param>
 506 ## <rolebase/>
 507 #
 508 template(`userdom_xwindows_client_template',`
 509         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 510         gen_require(`
 511                 type $1_t, user_tmpfs_t;
 512         ')
 513
 514         dev_rw_xserver_misc($1_t)
 515         dev_rw_power_management($1_t)
 516         dev_read_input($1_t)
 517         dev_read_misc($1_t)
 518         dev_write_misc($1_t)
 519         # open office is looking for the following
 520         dev_getattr_agp_dev($1_t)
 521         dev_dontaudit_rw_dri($1_t)
 522         # GNOME checks for usb and other devices:
 523         dev_rw_usbfs($1_t)
 524         dev_rw_generic_usb_dev($1_t)
 525
 526         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 527         xserver_xsession_entry_type($1_t)
 528         xserver_dontaudit_write_log($1_t)
 529         xserver_stream_connect_xdm($1_t)
 530         # certain apps want to read xdm.pid file
 531         xserver_read_xdm_pid($1_t)
 532         # gnome-session creates socket under /tmp/.ICE-unix/
 533         xserver_create_xdm_tmp_sockets($1_t)
 534         # Needed for escd, remove if we get escd policy
 535         xserver_manage_xdm_tmp_files($1_t)
 536 ')
 537
 538 #######################################
 539 ## <summary>
 540 ##      The template for allowing the user to change passwords.
 541 ## </summary>
 542 ## <param name="userdomain_prefix">
 543 ##      <summary>
 544 ##      The prefix of the user domain (e.g., user
 545 ##      is the prefix for user_t).
 546 ##      </summary>
 547 ## </param>
 548 ## <rolebase/>
 549 #
 550 template(`userdom_change_password_template',`
 551         gen_require(`
 552                 type $1_t;
 553                 role $1_r;
 554         ')
 555
 556         optional_policy(`
 557                 usermanage_run_chfn($1_t,$1_r)
 558                 usermanage_run_passwd($1_t,$1_r)
 559         ')
 560 ')
 561
 562 #######################################
 563 ## <summary>
 564 ##      The template containing rules common to unprivileged
 565 ##      users and administrative users.
 566 ## </summary>
 567 ## <desc>
 568 ##      <p>
 569 ##      This template creates a user domain, types, and
 570 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 571 ##      </p>
 572 ## </desc>
 573 ## <param name="userdomain_prefix">
 574 ##      <summary>
 575 ##      The prefix of the user domain (e.g., user
 576 ##      is the prefix for user_t).
 577 ##      </summary>
 578 ## </param>
 579 #
 580 template(`userdom_common_user_template',`
 581         gen_require(`
 582                 attribute unpriv_userdomain;
 583         ')
 584
 585         userdom_basic_networking($1_usertype)
 586
 587         ##############################
 588         #
 589         # User domain Local policy
 590         #
 591
 592         # evolution and gnome-session try to create a netlink socket
 593         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 594         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 595         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 596         allow $1_t self:socket create_socket_perms;
 597
 598         allow $1_usertype unpriv_userdomain:fd use;
 599
 600         kernel_read_system_state($1_usertype)
 601         kernel_read_network_state($1_usertype)
 602         kernel_read_software_raid_state($1_usertype)
 603         kernel_read_net_sysctls($1_usertype)
 604         # Very permissive allowing every domain to see every type:
 605         kernel_get_sysvipc_info($1_usertype)
 606         # Find CDROM devices:
 607         kernel_read_device_sysctls($1_usertype)
 608         kernel_request_load_module($1_usertype)
 609
 610         corenet_udp_bind_generic_node($1_usertype)
 611         corenet_udp_bind_generic_port($1_usertype)
 612
 613         dev_read_rand($1_usertype)
 614         dev_write_sound($1_usertype)
 615         dev_read_sound($1_usertype)
 616         dev_read_sound_mixer($1_usertype)
 617         dev_write_sound_mixer($1_usertype)
 618
 619         files_exec_etc_files($1_usertype)
 620         files_search_locks($1_usertype)
 621         # Check to see if cdrom is mounted
 622         files_search_mnt($1_usertype)
 623         # cjp: perhaps should cut back on file reads:
 624         files_read_var_files($1_usertype)
 625         files_read_var_symlinks($1_usertype)
 626         files_read_generic_spool($1_usertype)
 627         files_read_var_lib_files($1_usertype)
 628         # Stat lost+found.
 629         files_getattr_lost_found_dirs($1_usertype)
 630         files_read_config_files($1_usertype)
 631         fs_read_noxattr_fs_files($1_usertype)
 632         fs_read_noxattr_fs_symlinks($1_usertype)
 633         fs_rw_cgroup_files($1_usertype)
 634
 635         application_getattr_socket($1_usertype)
 636
 637         logging_send_syslog_msg($1_usertype)
 638         logging_send_audit_msgs($1_usertype)
 639         selinux_get_enforce_mode($1_usertype)
 640
 641         # cjp: some of this probably can be removed
 642         selinux_get_fs_mount($1_usertype)
 643         selinux_validate_context($1_usertype)
 644         selinux_compute_access_vector($1_usertype)
 645         selinux_compute_create_context($1_usertype)
 646         selinux_compute_relabel_context($1_usertype)
 647         selinux_compute_user_contexts($1_usertype)
 648
 649         # for eject
 650         storage_getattr_fixed_disk_dev($1_usertype)
 651
 652         auth_read_login_records($1_usertype)
 653         auth_run_pam($1_t,$1_r)
 654         auth_run_utempter($1_t,$1_r)
 655
 656         init_read_utmp($1_usertype)
 657
 658         seutil_read_file_contexts($1_usertype)
 659         seutil_read_default_contexts($1_usertype)
 660         seutil_run_newrole($1_t,$1_r)
 661         seutil_exec_checkpolicy($1_t)
 662         seutil_exec_setfiles($1_usertype)
 663         # for when the network connection is killed
 664         # this is needed when a login role can change
 665         # to this one.
 666         seutil_dontaudit_signal_newrole($1_t)
 667
 668         tunable_policy(`user_direct_mouse',`
 669                 dev_read_mouse($1_usertype)
 670         ')
 671
 672         tunable_policy(`user_ttyfile_stat',`
 673                 term_getattr_all_ttys($1_t)
 674         ')
 675
 676         optional_policy(`
 677                 # Allow graphical boot to check battery lifespan
 678                 apm_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 canna_stream_connect($1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 chrome_role($1_r, $1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 colord_read_lib_files($1_usertype)
 691         ')
 692
 693         optional_policy(`
 694                 dbus_system_bus_client($1_usertype)
 695
 696                 allow $1_usertype $1_usertype:dbus  send_msg;
 697
 698                 optional_policy(`
 699                         avahi_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         policykit_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         bluetooth_dbus_chat($1_usertype)
 708                 ')
 709
 710                 optional_policy(`
 711                         consolekit_dbus_chat($1_usertype)
 712                         consolekit_read_log($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         devicekit_dbus_chat($1_usertype)
 717                         devicekit_dbus_chat_power($1_usertype)
 718                         devicekit_dbus_chat_disk($1_usertype)
 719                 ')
 720
 721                 optional_policy(`
 722                         evolution_dbus_chat($1_usertype)
 723                         evolution_alarm_dbus_chat($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         gnome_dbus_chat_gconfdefault($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         hal_dbus_chat($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         kde_dbus_chat_backlighthelper($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         modemmanager_dbus_chat($1_usertype)
 740                 ')
 741
 742                 optional_policy(`
 743                         networkmanager_dbus_chat($1_usertype)
 744                         networkmanager_read_lib_files($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         vpn_dbus_chat($1_usertype)
 749                 ')
 750         ')
 751
 752         optional_policy(`
 753                 git_session_role($1_r, $1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 inetd_use_fds($1_usertype)
 758                 inetd_rw_tcp_sockets($1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inn_read_config($1_usertype)
 763                 inn_read_news_lib($1_usertype)
 764                 inn_read_news_spool($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 lircd_stream_connect($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 locate_read_lib_files($1_usertype)
 773         ')
 774
 775         # for running depmod as part of the kernel packaging process
 776         optional_policy(`
 777                 modutils_read_module_config($1_usertype)
 778         ')
 779
 780         optional_policy(`
 781                 mta_rw_spool($1_usertype)
 782                 mta_manage_queue($1_usertype)
 783                 mta_filetrans_home_content($1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 nsplugin_role($1_r, $1_usertype)
 788         ')
 789
 790         optional_policy(`
 791                 tunable_policy(`allow_user_mysql_connect',`
 792                         mysql_stream_connect($1_t)
 793                 ')
 794         ')
 795
 796         optional_policy(`
 797                 oident_manage_user_content($1_t)
 798                 oident_relabel_user_content($1_t)
 799         ')
 800
 801         optional_policy(`
 802                 # to allow monitoring of pcmcia status
 803                 pcmcia_read_pid($1_usertype)
 804         ')
 805
 806         optional_policy(`
 807                 pcscd_read_pub_files($1_usertype)
 808                 pcscd_stream_connect($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 tunable_policy(`allow_user_postgresql_connect',`
 813                         postgresql_stream_connect($1_usertype)
 814                         postgresql_tcp_connect($1_usertype)
 815                 ')
 816         ')
 817
 818         optional_policy(`
 819                 resmgr_stream_connect($1_usertype)
 820         ')
 821
 822         optional_policy(`
 823                 rpc_dontaudit_getattr_exports($1_usertype)
 824                 rpc_manage_nfs_rw_content($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpcbind_stream_connect($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 samba_stream_connect_winbind($1_usertype)
 833         ')
 834
 835         optional_policy(`
 836                 sandbox_transition($1_usertype, $1_r)
 837         ')
 838
 839         optional_policy(`
 840                 seunshare_role_template($1, $1_r, $1_t)
 841         ')
 842
 843         optional_policy(`
 844                 slrnpull_search_spool($1_usertype)
 845         ')
 846
 847         optional_policy(`
 848                 thumb_role($1_r, $1_usertype)
 849         ')
 850 ')
 851
 852 #######################################
 853 ## <summary>
 854 ##      The template for creating a login user.
 855 ## </summary>
 856 ## <desc>
 857 ##      <p>
 858 ##      This template creates a user domain, types, and
 859 ##      rules for the user's tty, pty, home directories,
 860 ##      tmp, and tmpfs files.
 861 ##      </p>
 862 ## </desc>
 863 ## <param name="userdomain_prefix">
 864 ##      <summary>
 865 ##      The prefix of the user domain (e.g., user
 866 ##      is the prefix for user_t).
 867 ##      </summary>
 868 ## </param>
 869 #
 870 template(`userdom_login_user_template', `
 871         gen_require(`
 872                 class context contains;
 873         ')
 874
 875         userdom_base_user_template($1)
 876
 877         userdom_manage_home_role($1_r, $1_usertype)
 878
 879         userdom_manage_tmp_role($1_r, $1_usertype)
 880         userdom_manage_tmpfs_role($1_r, $1_usertype)
 881
 882         ifelse(`$1',`unconfined',`',`
 883                 gen_tunable(allow_$1_exec_content, true)
 884
 885                 tunable_policy(`allow_$1_exec_content',`
 886                         userdom_exec_user_tmp_files($1_usertype)
 887                         userdom_exec_user_home_content_files($1_usertype)
 888                 ')
 889                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 890                         fs_exec_nfs_files($1_usertype)
 891                 ')
 892
 893                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 894                         fs_exec_cifs_files($1_usertype)
 895                 ')
 896         ')
 897
 898         userdom_change_password_template($1)
 899
 900         ##############################
 901         #
 902         # User domain Local policy
 903         #
 904
 905         allow $1_t self:capability { setgid chown fowner };
 906         dontaudit $1_t self:capability { sys_nice fsetid };
 907
 908         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 909         dontaudit $1_t self:process setrlimit;
 910         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 911
 912         allow $1_t self:context contains;
 913
 914         kernel_dontaudit_read_system_state($1_usertype)
 915         kernel_dontaudit_list_all_proc($1_usertype)
 916
 917         dev_read_sysfs($1_usertype)
 918         dev_read_urand($1_usertype)
 919
 920         domain_use_interactive_fds($1_usertype)
 921         # Command completion can fire hundreds of denials
 922         domain_dontaudit_exec_all_entry_files($1_usertype)
 923
 924         files_dontaudit_list_default($1_usertype)
 925         files_dontaudit_read_default_files($1_usertype)
 926         # Stat lost+found.
 927         files_getattr_lost_found_dirs($1_usertype)
 928
 929         fs_get_all_fs_quotas($1_usertype)
 930         fs_getattr_all_fs($1_usertype)
 931         fs_search_all($1_usertype)
 932         fs_list_inotifyfs($1_usertype)
 933         fs_rw_anon_inodefs_files($1_usertype)
 934
 935         auth_dontaudit_write_login_records($1_t)
 936         auth_rw_cache($1_t)
 937
 938         application_exec_all($1_t)
 939         # The library functions always try to open read-write first,
 940         # then fall back to read-only if it fails.
 941         init_dontaudit_rw_utmp($1_t)
 942
 943         # Stop warnings about access to /dev/console
 944         init_dontaudit_use_fds($1_usertype)
 945         init_dontaudit_use_script_fds($1_usertype)
 946
 947         libs_exec_lib_files($1_usertype)
 948
 949         logging_dontaudit_getattr_all_logs($1_usertype)
 950
 951         # for running TeX programs
 952         miscfiles_read_tetex_data($1_usertype)
 953         miscfiles_exec_tetex_data($1_usertype)
 954
 955         seutil_read_config($1_usertype)
 956
 957         optional_policy(`
 958                 cups_read_config($1_usertype)
 959                 cups_stream_connect($1_usertype)
 960                 cups_stream_connect_ptal($1_usertype)
 961         ')
 962
 963         optional_policy(`
 964                 kerberos_use($1_usertype)
 965                 kerberos_filetrans_home_content($1_usertype)
 966         ')
 967
 968         optional_policy(`
 969                 mta_dontaudit_read_spool_symlinks($1_usertype)
 970         ')
 971
 972         optional_policy(`
 973                 quota_dontaudit_getattr_db($1_usertype)
 974         ')
 975
 976         optional_policy(`
 977                 rpm_read_db($1_usertype)
 978                 rpm_dontaudit_manage_db($1_usertype)
 979                 rpm_read_cache($1_usertype)
 980         ')
 981
 982         optional_policy(`
 983                 oddjob_run_mkhomedir($1_t, $1_r)
 984         ')
 985 ')
 986
 987 #######################################
 988 ## <summary>
 989 ##      The template for creating a unprivileged login user.
 990 ## </summary>
 991 ## <desc>
 992 ##      <p>
 993 ##      This template creates a user domain, types, and
 994 ##      rules for the user's tty, pty, home directories,
 995 ##      tmp, and tmpfs files.
 996 ##      </p>
 997 ## </desc>
 998 ## <param name="userdomain_prefix">
 999 ##      <summary>
1000 ##      The prefix of the user domain (e.g., user
1001 ##      is the prefix for user_t).
1002 ##      </summary>
1003 ## </param>
1004 #
1005 template(`userdom_restricted_user_template',`
1006         gen_require(`
1007                 attribute unpriv_userdomain;
1008         ')
1009
1010         userdom_login_user_template($1)
1011
1012         typeattribute $1_t unpriv_userdomain;
1013         domain_interactive_fd($1_t)
1014
1015         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1016         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1017
1018         ##############################
1019         #
1020         # Local policy
1021         #
1022
1023         optional_policy(`
1024                 loadkeys_run($1_t, $1_r)
1025         ')
1026 ')
1027
1028 #######################################
1029 ## <summary>
1030 ##      The template for creating a unprivileged xwindows login user.
1031 ## </summary>
1032 ## <desc>
1033 ##      <p>
1034 ##      The template for creating a unprivileged xwindows login user.
1035 ##      </p>
1036 ##      <p>
1037 ##      This template creates a user domain, types, and
1038 ##      rules for the user's tty, pty, home directories,
1039 ##      tmp, and tmpfs files.
1040 ##      </p>
1041 ## </desc>
1042 ## <param name="userdomain_prefix">
1043 ##      <summary>
1044 ##      The prefix of the user domain (e.g., user
1045 ##      is the prefix for user_t).
1046 ##      </summary>
1047 ## </param>
1048 #
1049 template(`userdom_restricted_xwindows_user_template',`
1050
1051         userdom_restricted_user_template($1)
1052
1053         ##############################
1054         #
1055         # Local policy
1056         #
1057
1058         auth_role($1_r, $1_t)
1059         auth_search_pam_console_data($1_usertype)
1060         auth_dontaudit_read_login_records($1_usertype)
1061
1062         dev_read_sound($1_usertype)
1063         dev_write_sound($1_usertype)
1064         # gnome keyring wants to read this.
1065         dev_dontaudit_read_rand($1_usertype)
1066         # temporarily allow since openoffice requires this
1067         dev_read_rand($1_usertype)
1068
1069         dev_read_video_dev($1_usertype)
1070         dev_write_video_dev($1_usertype)
1071         dev_rw_wireless($1_usertype)
1072
1073         libs_dontaudit_setattr_lib_files($1_usertype)
1074
1075         tunable_policy(`user_rw_noexattrfile',`
1076                 dev_rw_usbfs($1_t)
1077                 dev_rw_generic_usb_dev($1_usertype)
1078
1079                 fs_manage_noxattr_fs_files($1_usertype)
1080                 fs_manage_noxattr_fs_dirs($1_usertype)
1081                 fs_manage_dos_dirs($1_usertype)
1082                 fs_manage_dos_files($1_usertype)
1083                 storage_raw_read_removable_device($1_usertype)
1084                 storage_raw_write_removable_device($1_usertype)
1085         ')
1086
1087         logging_send_syslog_msg($1_usertype)
1088         logging_dontaudit_send_audit_msgs($1_t)
1089
1090         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1091         logging_send_audit_msgs($1_t)
1092         selinux_get_enforce_mode($1_t)
1093         seutil_exec_restorecond($1_t)
1094         seutil_read_file_contexts($1_t)
1095         seutil_read_default_contexts($1_t)
1096
1097         xserver_restricted_role($1_r, $1_t)
1098
1099         optional_policy(`
1100                 alsa_read_rw_config($1_usertype)
1101         ')
1102
1103          # cjp: needed by KDE apps
1104          # bug: #682499
1105          optional_policy(`
1106                 gnome_read_usr_config($1_usertype)
1107                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1108                 # cjp: telepathy F15 bugs
1109                 telepathy_role($1_r, $1_t, $1)
1110         ')
1111
1112         optional_policy(`
1113                 dbus_role_template($1, $1_r, $1_usertype)
1114                 dbus_system_bus_client($1_usertype)
1115                 allow $1_usertype $1_usertype:dbus send_msg;
1116
1117                 optional_policy(`
1118                         abrt_dbus_chat($1_usertype)
1119                         abrt_run_helper($1_usertype, $1_r)
1120                 ')
1121
1122                 optional_policy(`
1123                         consolekit_dontaudit_read_log($1_usertype)
1124                         consolekit_dbus_chat($1_usertype)
1125                 ')
1126
1127                 optional_policy(`
1128                         cups_dbus_chat($1_usertype)
1129                         cups_dbus_chat_config($1_usertype)
1130                 ')
1131
1132                 optional_policy(`
1133                         devicekit_dbus_chat($1_usertype)
1134                         devicekit_dbus_chat_disk($1_usertype)
1135                         devicekit_dbus_chat_power($1_usertype)
1136                 ')
1137
1138                 optional_policy(`
1139                         fprintd_dbus_chat($1_t)
1140                 ')
1141         ')
1142
1143         optional_policy(`
1144                 openoffice_role_template($1, $1_r, $1_usertype)
1145         ')
1146
1147         optional_policy(`
1148                 policykit_role($1_r, $1_usertype)
1149         ')
1150
1151         optional_policy(`
1152                 pulseaudio_role($1_r, $1_usertype)
1153                 pulseaudio_filetrans_admin_home_content($1_usertype)
1154                 pulseaudio_filetrans_home_content($1_usertype)
1155         ')
1156
1157         optional_policy(`
1158                 rtkit_scheduled($1_usertype)
1159         ')
1160
1161         optional_policy(`
1162                 setroubleshoot_dontaudit_stream_connect($1_t)
1163         ')
1164
1165         optional_policy(`
1166                 udev_read_db($1_usertype)
1167         ')
1168
1169         optional_policy(`
1170                 wm_role_template($1, $1_r, $1_t)
1171         ')
1172 ')
1173
1174 #######################################
1175 ## <summary>
1176 ##      The template for creating a unprivileged user roughly
1177 ##      equivalent to a regular linux user.
1178 ## </summary>
1179 ## <desc>
1180 ##      <p>
1181 ##      The template for creating a unprivileged user roughly
1182 ##      equivalent to a regular linux user.
1183 ##      </p>
1184 ##      <p>
1185 ##      This template creates a user domain, types, and
1186 ##      rules for the user's tty, pty, home directories,
1187 ##      tmp, and tmpfs files.
1188 ##      </p>
1189 ## </desc>
1190 ## <param name="userdomain_prefix">
1191 ##      <summary>
1192 ##      The prefix of the user domain (e.g., user
1193 ##      is the prefix for user_t).
1194 ##      </summary>
1195 ## </param>
1196 #
1197 template(`userdom_unpriv_user_template', `
1198
1199         ##############################
1200         #
1201         # Declarations
1202         #
1203
1204         # Inherit rules for ordinary users.
1205         userdom_restricted_xwindows_user_template($1)
1206         userdom_common_user_template($1)
1207
1208         ##############################
1209         #
1210         # Local policy
1211         #
1212
1213         # port access is audited even if dac would not have allowed it, so dontaudit it here
1214 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1215         # Need the following rule to allow users to run vpnc
1216         corenet_tcp_bind_xserver_port($1_t)
1217         corenet_tcp_bind_generic_node($1_usertype)
1218
1219         storage_rw_fuse($1_t)
1220
1221         files_exec_usr_files($1_t)
1222    # cjp: why?
1223         files_read_kernel_symbol_table($1_t)
1224
1225         ifndef(`enable_mls',`
1226                 fs_exec_noxattr($1_t)
1227
1228                 tunable_policy(`user_rw_noexattrfile',`
1229                         fs_manage_noxattr_fs_files($1_t)
1230                         fs_manage_noxattr_fs_dirs($1_t)
1231                         # Write floppies
1232                         storage_raw_read_removable_device($1_t)
1233                         storage_raw_write_removable_device($1_t)
1234                 ',`
1235                         storage_raw_read_removable_device($1_t)
1236                 ')
1237         ')
1238
1239         miscfiles_read_hwdata($1_usertype)
1240
1241         # Allow users to run TCP servers (bind to ports and accept connection from
1242         # the same domain and outside users) disabling this forces FTP passive mode
1243         # and may change other protocols
1244
1245         tunable_policy(`user_share_music',`
1246                 corenet_tcp_bind_daap_port($1_usertype)
1247         ')
1248
1249         tunable_policy(`user_tcp_server',`
1250                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1251         ')
1252
1253         tunable_policy(`user_setrlimit',`
1254                 allow $1_usertype self:process setrlimit;
1255         ')
1256
1257         optional_policy(`
1258                 cdrecord_role($1_r, $1_t)
1259         ')
1260
1261         optional_policy(`
1262                 cron_role($1_r, $1_t)
1263         ')
1264
1265         optional_policy(`
1266                 games_rw_data($1_usertype)
1267         ')
1268
1269         optional_policy(`
1270                 gpg_role($1_r, $1_usertype)
1271         ')
1272
1273         optional_policy(`
1274                 gnomeclock_dbus_chat($1_t)
1275         ')
1276
1277         optional_policy(`
1278                 gpm_stream_connect($1_usertype)
1279         ')
1280
1281         optional_policy(`
1282                 execmem_role_template($1, $1_r, $1_t)
1283         ')
1284
1285         optional_policy(`
1286                 java_role_template($1, $1_r, $1_t)
1287         ')
1288
1289         optional_policy(`
1290                 mono_role_template($1, $1_r, $1_t)
1291         ')
1292
1293         optional_policy(`
1294                 mount_run_fusermount($1_t, $1_r)
1295                 mount_read_pid_files($1_t)
1296         ')
1297
1298         optional_policy(`
1299                 wine_role_template($1, $1_r, $1_t)
1300         ')
1301
1302         optional_policy(`
1303                 postfix_run_postdrop($1_t, $1_r)
1304                 postfix_search_spool($1_t)
1305         ')
1306
1307         # Run pppd in pppd_t by default for user
1308         optional_policy(`
1309                 ppp_run_cond($1_t, $1_r)
1310         ')
1311
1312         optional_policy(`
1313                 vdagent_getattr_log($1_t)
1314                 vdagent_getattr_exec($1_t)
1315                 vdagent_stream_connect($1_t)
1316         ')
1317 ')
1318
1319 #######################################
1320 ## <summary>
1321 ##      The template for creating an administrative user.
1322 ## </summary>
1323 ## <desc>
1324 ##      <p>
1325 ##      This template creates a user domain, types, and
1326 ##      rules for the user's tty, pty, home directories,
1327 ##      tmp, and tmpfs files.
1328 ##      </p>
1329 ##      <p>
1330 ##      The privileges given to administrative users are:
1331 ##      <ul>
1332 ##              <li>Raw disk access</li>
1333 ##              <li>Set all sysctls</li>
1334 ##              <li>All kernel ring buffer controls</li>
1335 ##              <li>Create, read, write, and delete all files but shadow</li>
1336 ##              <li>Manage source and binary format SELinux policy</li>
1337 ##              <li>Run insmod</li>
1338 ##      </ul>
1339 ##      </p>
1340 ## </desc>
1341 ## <param name="userdomain_prefix">
1342 ##      <summary>
1343 ##      The prefix of the user domain (e.g., sysadm
1344 ##      is the prefix for sysadm_t).
1345 ##      </summary>
1346 ## </param>
1347 #
1348 template(`userdom_admin_user_template',`
1349         gen_require(`
1350                 attribute admindomain;
1351                 class passwd { passwd chfn chsh rootok crontab };
1352         ')
1353
1354         ##############################
1355         #
1356         # Declarations
1357         #
1358
1359         # Inherit rules for ordinary users.
1360         userdom_login_user_template($1)
1361         userdom_common_user_template($1)
1362
1363         domain_obj_id_change_exemption($1_t)
1364         role system_r types $1_t;
1365
1366         typeattribute $1_t admindomain;
1367
1368         ifdef(`direct_sysadm_daemon',`
1369                 domain_system_change_exemption($1_t)
1370         ')
1371
1372         ##############################
1373         #
1374         # $1_t local policy
1375         #
1376
1377         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1378         allow $1_t self:capability2 syslog;
1379         allow $1_t self:process { setexec setfscreate };
1380         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1381         allow $1_t self:tun_socket create;
1382         # Set password information for other users.
1383         allow $1_t self:passwd { passwd chfn chsh };
1384         # Skip authentication when pam_rootok is specified.
1385         allow $1_t self:passwd rootok;
1386
1387         # Manipulate other users crontab.
1388         allow $1_t self:passwd crontab;
1389
1390         kernel_read_software_raid_state($1_t)
1391         kernel_getattr_core_if($1_t)
1392         kernel_getattr_message_if($1_t)
1393         kernel_change_ring_buffer_level($1_t)
1394         kernel_clear_ring_buffer($1_t)
1395         kernel_read_ring_buffer($1_t)
1396         kernel_get_sysvipc_info($1_t)
1397         kernel_rw_all_sysctls($1_t)
1398         # signal unlabeled processes:
1399         kernel_kill_unlabeled($1_t)
1400         kernel_signal_unlabeled($1_t)
1401         kernel_sigstop_unlabeled($1_t)
1402         kernel_signull_unlabeled($1_t)
1403         kernel_sigchld_unlabeled($1_t)
1404         kernel_signal($1_t)
1405
1406         corenet_tcp_bind_generic_port($1_t)
1407         # allow setting up tunnels
1408         corenet_rw_tun_tap_dev($1_t)
1409
1410         dev_getattr_generic_blk_files($1_t)
1411         dev_getattr_generic_chr_files($1_t)
1412         # for lsof
1413         dev_getattr_mtrr_dev($1_t)
1414         # Allow MAKEDEV to work
1415         dev_create_all_blk_files($1_t)
1416         dev_create_all_chr_files($1_t)
1417         dev_delete_all_blk_files($1_t)
1418         dev_delete_all_chr_files($1_t)
1419         dev_rename_all_blk_files($1_t)
1420         dev_rename_all_chr_files($1_t)
1421         dev_create_generic_symlinks($1_t)
1422         dev_rw_generic_usb_dev($1_t)
1423         dev_rw_usbfs($1_t)
1424
1425         domain_setpriority_all_domains($1_t)
1426         domain_read_all_domains_state($1_t)
1427         domain_getattr_all_domains($1_t)
1428         domain_getcap_all_domains($1_t)
1429         domain_dontaudit_ptrace_all_domains($1_t)
1430         # signal all domains:
1431         domain_kill_all_domains($1_t)
1432         domain_signal_all_domains($1_t)
1433         domain_signull_all_domains($1_t)
1434         domain_sigstop_all_domains($1_t)
1435         domain_sigstop_all_domains($1_t)
1436         domain_sigchld_all_domains($1_t)
1437         # for lsof
1438         domain_getattr_all_sockets($1_t)
1439         domain_dontaudit_getattr_all_sockets($1_t)
1440
1441         files_exec_usr_src_files($1_t)
1442
1443         fs_getattr_all_fs($1_t)
1444         fs_getattr_all_files($1_t)
1445         fs_list_all($1_t)
1446         fs_set_all_quotas($1_t)
1447         fs_exec_noxattr($1_t)
1448
1449         storage_raw_read_removable_device($1_t)
1450         storage_raw_write_removable_device($1_t)
1451         storage_dontaudit_read_fixed_disk($1_t)
1452
1453         term_use_all_inherited_terms($1_t)
1454         term_use_unallocated_ttys($1_t)
1455
1456         auth_getattr_shadow($1_t)
1457         # Manage almost all files
1458         files_manage_non_security_dirs($1_t)
1459         files_manage_non_security_files($1_t)
1460         # Relabel almost all files
1461         files_relabel_non_security_files($1_t)
1462
1463         init_telinit($1_t)
1464
1465         logging_send_syslog_msg($1_t)
1466
1467         optional_policy(`
1468                 modutils_domtrans_insmod($1_t)
1469                 modutils_domtrans_depmod($1_t)
1470         ')
1471
1472         # The following rule is temporary until such time that a complete
1473         # policy management infrastructure is in place so that an administrator
1474         # cannot directly manipulate policy files with arbitrary programs.
1475         seutil_manage_src_policy($1_t)
1476         # Violates the goal of limiting write access to checkpolicy.
1477         # But presently necessary for installing the file_contexts file.
1478         seutil_manage_bin_policy($1_t)
1479
1480         systemd_config_all_services($1_t)
1481
1482         userdom_manage_user_home_content_dirs($1_t)
1483         userdom_manage_user_home_content_files($1_t)
1484         userdom_manage_user_home_content_symlinks($1_t)
1485         userdom_manage_user_home_content_pipes($1_t)
1486         userdom_manage_user_home_content_sockets($1_t)
1487         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1488
1489         tunable_policy(`user_rw_noexattrfile',`
1490                 fs_manage_noxattr_fs_files($1_t)
1491                 fs_manage_noxattr_fs_dirs($1_t)
1492         ',`
1493                 fs_read_noxattr_fs_files($1_t)
1494         ')
1495
1496         optional_policy(`
1497                 postgresql_unconfined($1_t)
1498         ')
1499
1500         optional_policy(`
1501                 userhelper_exec($1_t)
1502         ')
1503 ')
1504
1505 ########################################
1506 ## <summary>
1507 ##      Allow user to run as a secadm
1508 ## </summary>
1509 ## <desc>
1510 ##      <p>
1511 ##      Create objects in a user home directory
1512 ##      with an automatic type transition to
1513 ##      a specified private type.
1514 ##      </p>
1515 ##      <p>
1516 ##      This is a templated interface, and should only
1517 ##      be called from a per-userdomain template.
1518 ##      </p>
1519 ## </desc>
1520 ## <param name="domain">
1521 ##      <summary>
1522 ##      Domain allowed access.
1523 ##      </summary>
1524 ## </param>
1525 ## <param name="role">
1526 ##      <summary>
1527 ##      The role  of the object to create.
1528 ##      </summary>
1529 ## </param>
1530 #
1531 template(`userdom_security_admin_template',`
1532         allow $1 self:capability { dac_read_search dac_override };
1533
1534         corecmd_exec_shell($1)
1535
1536         domain_obj_id_change_exemption($1)
1537
1538         dev_relabel_all_dev_nodes($1)
1539
1540         files_create_boot_flag($1)
1541         files_create_default_dir($1)
1542         files_root_filetrans_default($1, dir)
1543
1544         # Necessary for managing /boot/efi
1545         fs_manage_dos_files($1)
1546
1547         mls_process_read_up($1)
1548         mls_file_read_all_levels($1)
1549         mls_file_upgrade($1)
1550         mls_file_downgrade($1)
1551
1552         selinux_set_enforce_mode($1)
1553         selinux_set_all_booleans($1)
1554         selinux_set_parameters($1)
1555         selinux_read_policy($1)
1556
1557         files_relabel_all_files($1)
1558         auth_relabel_shadow($1)
1559
1560         init_exec($1)
1561
1562         logging_send_syslog_msg($1)
1563         logging_read_audit_log($1)
1564         logging_read_generic_logs($1)
1565         logging_read_audit_config($1)
1566
1567         seutil_manage_bin_policy($1)
1568         seutil_manage_default_contexts($1)
1569         seutil_manage_file_contexts($1)
1570         seutil_manage_module_store($1)
1571         seutil_manage_config($1)
1572         seutil_run_checkpolicy($1,$2)
1573         seutil_run_loadpolicy($1,$2)
1574         seutil_run_semanage($1,$2)
1575         seutil_run_setsebool($1,$2)
1576         seutil_run_setfiles($1, $2)
1577
1578         seutil_manage_bin_policy($1)
1579     seutil_manage_default_contexts($1)
1580     seutil_manage_file_contexts($1)
1581     seutil_manage_module_store($1)
1582     seutil_manage_config($1)
1583
1584         optional_policy(`
1585                 aide_run($1,$2)
1586         ')
1587
1588         optional_policy(`
1589                 consoletype_exec($1)
1590         ')
1591
1592         optional_policy(`
1593                 dmesg_exec($1)
1594         ')
1595
1596         optional_policy(`
1597                 ipsec_run_setkey($1,$2)
1598         ')
1599
1600         optional_policy(`
1601                 netlabel_run_mgmt($1,$2)
1602         ')
1603
1604         optional_policy(`
1605                 samhain_run($1, $2)
1606         ')
1607 ')
1608
1609 ########################################
1610 ## <summary>
1611 ##      Make the specified type usable in a
1612 ##      user home directory.
1613 ## </summary>
1614 ## <param name="type">
1615 ##      <summary>
1616 ##      Type to be used as a file in the
1617 ##      user home directory.
1618 ##      </summary>
1619 ## </param>
1620 #
1621 interface(`userdom_user_home_content',`
1622         gen_require(`
1623                 type user_home_t;
1624                 attribute user_home_type;
1625         ')
1626
1627         allow $1 user_home_t:filesystem associate;
1628         files_type($1)
1629         ubac_constrained($1)
1630
1631         files_poly_member($1)
1632         typeattribute $1  user_home_type;
1633 ')
1634
1635 ########################################
1636 ## <summary>
1637 ##      Make the specified type usable in a
1638 ##      generic temporary directory.
1639 ## </summary>
1640 ## <param name="type">
1641 ##      <summary>
1642 ##      Type to be used as a file in the
1643 ##      generic temporary directory.
1644 ##      </summary>
1645 ## </param>
1646 #
1647 interface(`userdom_user_tmp_content',`
1648         gen_require(`
1649                 attribute user_tmp_type;
1650         ')
1651
1652         typeattribute $1 user_tmp_type;
1653
1654         files_tmp_file($1)
1655         ubac_constrained($1)
1656 ')
1657
1658 ########################################
1659 ## <summary>
1660 ##      Make the specified type usable in a
1661 ##      generic tmpfs_t directory.
1662 ## </summary>
1663 ## <param name="type">
1664 ##      <summary>
1665 ##      Type to be used as a file in the
1666 ##      generic temporary directory.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_user_tmpfs_content',`
1671         gen_require(`
1672                 attribute user_tmpfs_type;
1673         ')
1674
1675         typeattribute $1 user_tmpfs_type;
1676
1677         files_tmpfs_file($1)
1678         ubac_constrained($1)
1679 ')
1680
1681 ########################################
1682 ## <summary>
1683 ##      Allow domain to attach to TUN devices created by administrative users.
1684 ## </summary>
1685 ## <param name="domain">
1686 ##      <summary>
1687 ##      Domain allowed access.
1688 ##      </summary>
1689 ## </param>
1690 #
1691 interface(`userdom_attach_admin_tun_iface',`
1692         gen_require(`
1693                 attribute admindomain;
1694         ')
1695
1696         allow $1 admindomain:tun_socket relabelfrom;
1697         allow $1 self:tun_socket relabelto;
1698 ')
1699
1700 ########################################
1701 ## <summary>
1702 ##      Set the attributes of a user pty.
1703 ## </summary>
1704 ## <param name="domain">
1705 ##      <summary>
1706 ##      Domain allowed access.
1707 ##      </summary>
1708 ## </param>
1709 #
1710 interface(`userdom_setattr_user_ptys',`
1711         gen_require(`
1712                 type user_devpts_t;
1713         ')
1714
1715         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1716 ')
1717
1718 ########################################
1719 ## <summary>
1720 ##      Create a user pty.
1721 ## </summary>
1722 ## <param name="domain">
1723 ##      <summary>
1724 ##      Domain allowed access.
1725 ##      </summary>
1726 ## </param>
1727 #
1728 interface(`userdom_create_user_pty',`
1729         gen_require(`
1730                 type user_devpts_t;
1731         ')
1732
1733         term_create_pty($1, user_devpts_t)
1734 ')
1735
1736 ########################################
1737 ## <summary>
1738 ##      Get the attributes of user home directories.
1739 ## </summary>
1740 ## <param name="domain">
1741 ##      <summary>
1742 ##      Domain allowed access.
1743 ##      </summary>
1744 ## </param>
1745 #
1746 interface(`userdom_getattr_user_home_dirs',`
1747         gen_require(`
1748                 type user_home_dir_t;
1749         ')
1750
1751         allow $1 user_home_dir_t:dir getattr_dir_perms;
1752         files_search_home($1)
1753 ')
1754
1755 ########################################
1756 ## <summary>
1757 ##      Do not audit attempts to get the attributes of user home directories.
1758 ## </summary>
1759 ## <param name="domain">
1760 ##      <summary>
1761 ##      Domain to not audit.
1762 ##      </summary>
1763 ## </param>
1764 #
1765 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1766         gen_require(`
1767                 type user_home_dir_t;
1768         ')
1769
1770         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1771 ')
1772
1773 ########################################
1774 ## <summary>
1775 ##      Search user home directories.
1776 ## </summary>
1777 ## <param name="domain">
1778 ##      <summary>
1779 ##      Domain allowed access.
1780 ##      </summary>
1781 ## </param>
1782 #
1783 interface(`userdom_search_user_home_dirs',`
1784         gen_require(`
1785                 type user_home_dir_t;
1786         ')
1787
1788         allow $1 user_home_dir_t:dir search_dir_perms;
1789         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1790         files_search_home($1)
1791 ')
1792
1793 ########################################
1794 ## <summary>
1795 ##      Do not audit attempts to search user home directories.
1796 ## </summary>
1797 ## <desc>
1798 ##      <p>
1799 ##      Do not audit attempts to search user home directories.
1800 ##      This will supress SELinux denial messages when the specified
1801 ##      domain is denied the permission to search these directories.
1802 ##      </p>
1803 ## </desc>
1804 ## <param name="domain">
1805 ##      <summary>
1806 ##      Domain to not audit.
1807 ##      </summary>
1808 ## </param>
1809 ## <infoflow type="none"/>
1810 #
1811 interface(`userdom_dontaudit_search_user_home_dirs',`
1812         gen_require(`
1813                 type user_home_dir_t;
1814         ')
1815
1816         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1817 ')
1818
1819 ########################################
1820 ## <summary>
1821 ##      List user home directories.
1822 ## </summary>
1823 ## <param name="domain">
1824 ##      <summary>
1825 ##      Domain allowed access.
1826 ##      </summary>
1827 ## </param>
1828 #
1829 interface(`userdom_list_user_home_dirs',`
1830         gen_require(`
1831                 type user_home_dir_t;
1832         ')
1833
1834         allow $1 user_home_dir_t:dir list_dir_perms;
1835         files_search_home($1)
1836
1837         tunable_policy(`use_nfs_home_dirs',`
1838                 fs_list_nfs($1)
1839         ')
1840
1841         tunable_policy(`use_samba_home_dirs',`
1842                 fs_list_cifs($1)
1843         ')
1844 ')
1845
1846 ########################################
1847 ## <summary>
1848 ##      Do not audit attempts to list user home subdirectories.
1849 ## </summary>
1850 ## <param name="domain">
1851 ##      <summary>
1852 ##      Domain to not audit.
1853 ##      </summary>
1854 ## </param>
1855 #
1856 interface(`userdom_dontaudit_list_user_home_dirs',`
1857         gen_require(`
1858                 type user_home_dir_t;
1859                 type user_home_t;
1860         ')
1861
1862         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1863         dontaudit $1 user_home_t:dir list_dir_perms;
1864 ')
1865
1866 ########################################
1867 ## <summary>
1868 ##      Create user home directories.
1869 ## </summary>
1870 ## <param name="domain">
1871 ##      <summary>
1872 ##      Domain allowed access.
1873 ##      </summary>
1874 ## </param>
1875 #
1876 interface(`userdom_create_user_home_dirs',`
1877         gen_require(`
1878                 type user_home_dir_t;
1879         ')
1880
1881         allow $1 user_home_dir_t:dir create_dir_perms;
1882 ')
1883
1884 ########################################
1885 ## <summary>
1886 ##      Create user home directories.
1887 ## </summary>
1888 ## <param name="domain">
1889 ##      <summary>
1890 ##      Domain allowed access.
1891 ##      </summary>
1892 ## </param>
1893 #
1894 interface(`userdom_manage_user_home_dirs',`
1895         gen_require(`
1896                 type user_home_dir_t;
1897         ')
1898
1899         allow $1 user_home_dir_t:dir manage_dir_perms;
1900 ')
1901
1902 ########################################
1903 ## <summary>
1904 ##      Relabel to user home directories.
1905 ## </summary>
1906 ## <param name="domain">
1907 ##      <summary>
1908 ##      Domain allowed access.
1909 ##      </summary>
1910 ## </param>
1911 #
1912 interface(`userdom_relabelto_user_home_dirs',`
1913         gen_require(`
1914                 type user_home_dir_t;
1915         ')
1916
1917         allow $1 user_home_dir_t:dir relabelto;
1918 ')
1919
1920
1921 ########################################
1922 ## <summary>
1923 ##      Relabel to user home files.
1924 ## </summary>
1925 ## <param name="domain">
1926 ##      <summary>
1927 ##      Domain allowed access.
1928 ##      </summary>
1929 ## </param>
1930 #
1931 interface(`userdom_relabelto_user_home_files',`
1932         gen_require(`
1933                 type user_home_t;
1934         ')
1935
1936         allow $1 user_home_t:file relabelto;
1937 ')
1938 ########################################
1939 ## <summary>
1940 ##      Relabel user home files.
1941 ## </summary>
1942 ## <param name="domain">
1943 ##      <summary>
1944 ##      Domain allowed access.
1945 ##      </summary>
1946 ## </param>
1947 #
1948 interface(`userdom_relabel_user_home_files',`
1949         gen_require(`
1950                 type user_home_t;
1951         ')
1952
1953         allow $1 user_home_t:file relabel_file_perms;
1954 ')
1955
1956 ########################################
1957 ## <summary>
1958 ##      Create directories in the home dir root with
1959 ##      the user home directory type.
1960 ## </summary>
1961 ## <param name="domain">
1962 ##      <summary>
1963 ##      Domain allowed access.
1964 ##      </summary>
1965 ## </param>
1966 #
1967 interface(`userdom_home_filetrans_user_home_dir',`
1968         gen_require(`
1969                 type user_home_dir_t;
1970         ')
1971
1972         files_home_filetrans($1, user_home_dir_t, dir)
1973 ')
1974
1975 ########################################
1976 ## <summary>
1977 ##      Do a domain transition to the specified
1978 ##      domain when executing a program in the
1979 ##      user home directory.
1980 ## </summary>
1981 ## <desc>
1982 ##      <p>
1983 ##      Do a domain transition to the specified
1984 ##      domain when executing a program in the
1985 ##      user home directory.
1986 ##      </p>
1987 ##      <p>
1988 ##      No interprocess communication (signals, pipes,
1989 ##      etc.) is provided by this interface since
1990 ##      the domains are not owned by this module.
1991 ##      </p>
1992 ## </desc>
1993 ## <param name="source_domain">
1994 ##      <summary>
1995 ##      Domain allowed to transition.
1996 ##      </summary>
1997 ## </param>
1998 ## <param name="target_domain">
1999 ##      <summary>
2000 ##      Domain to transition to.
2001 ##      </summary>
2002 ## </param>
2003 #
2004 interface(`userdom_user_home_domtrans',`
2005         gen_require(`
2006                 type user_home_dir_t, user_home_t;
2007         ')
2008
2009         domain_auto_trans($1, user_home_t, $2)
2010         allow $1 user_home_dir_t:dir search_dir_perms;
2011         files_search_home($1)
2012 ')
2013
2014 ########################################
2015 ## <summary>
2016 ##      Do not audit attempts to search user home content directories.
2017 ## </summary>
2018 ## <param name="domain">
2019 ##      <summary>
2020 ##      Domain to not audit.
2021 ##      </summary>
2022 ## </param>
2023 #
2024 interface(`userdom_dontaudit_search_user_home_content',`
2025         gen_require(`
2026                 type user_home_t;
2027         ')
2028
2029         dontaudit $1 user_home_t:dir search_dir_perms;
2030         fs_dontaudit_list_nfs($1)
2031         fs_dontaudit_list_cifs($1)
2032 ')
2033
2034 ########################################
2035 ## <summary>
2036 ##      List contents of users home directory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_list_user_home_content',`
2045         gen_require(`
2046                 type user_home_dir_t;
2047                 attribute user_home_type;
2048         ')
2049
2050         files_list_home($1)
2051         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2052 ')
2053
2054 ########################################
2055 ## <summary>
2056 ##      Create, read, write, and delete directories
2057 ##      in a user home subdirectory.
2058 ## </summary>
2059 ## <param name="domain">
2060 ##      <summary>
2061 ##      Domain allowed access.
2062 ##      </summary>
2063 ## </param>
2064 #
2065 interface(`userdom_manage_user_home_content_dirs',`
2066         gen_require(`
2067                 type user_home_dir_t, user_home_t;
2068         ')
2069
2070         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2071         files_search_home($1)
2072 ')
2073
2074 ########################################
2075 ## <summary>
2076 ##      Delete directories in a user home subdirectory.
2077 ## </summary>
2078 ## <param name="domain">
2079 ##      <summary>
2080 ##      Domain allowed access.
2081 ##      </summary>
2082 ## </param>
2083 #
2084 interface(`userdom_delete_user_home_content_dirs',`
2085         gen_require(`
2086                 type user_home_t;
2087         ')
2088
2089         allow $1 user_home_t:dir delete_dir_perms;
2090 ')
2091
2092 ########################################
2093 ## <summary>
2094 ##      Delete all directories in a user home subdirectory.
2095 ## </summary>
2096 ## <param name="domain">
2097 ##      <summary>
2098 ##      Domain allowed access.
2099 ##      </summary>
2100 ## </param>
2101 #
2102 interface(`userdom_delete_all_user_home_content_dirs',`
2103         gen_require(`
2104                 attribute user_home_type;
2105         ')
2106
2107         allow $1 user_home_type:dir delete_dir_perms;
2108 ')
2109
2110 ########################################
2111 ## <summary>
2112 ##      Set the attributes of user home files.
2113 ## </summary>
2114 ## <param name="domain">
2115 ##      <summary>
2116 ##      Domain allowed access.
2117 ##      </summary>
2118 ## </param>
2119 ## <rolecap/>
2120 #
2121 interface(`userdom_setattr_user_home_content_files',`
2122         gen_require(`
2123                 type user_home_t;
2124         ')
2125
2126         allow $1 user_home_t:file setattr;
2127 ')
2128
2129 ########################################
2130 ## <summary>
2131 ##      Do not audit attempts to set the
2132 ##      attributes of user home files.
2133 ## </summary>
2134 ## <param name="domain">
2135 ##      <summary>
2136 ##      Domain to not audit.
2137 ##      </summary>
2138 ## </param>
2139 #
2140 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2141         gen_require(`
2142                 type user_home_t;
2143         ')
2144
2145         dontaudit $1 user_home_t:file setattr_file_perms;
2146 ')
2147
2148 ########################################
2149 ## <summary>
2150 ##      Set the attributes of all user home directories.
2151 ## </summary>
2152 ## <param name="domain">
2153 ##      <summary>
2154 ##      Domain allowed access.
2155 ##      </summary>
2156 ## </param>
2157 ## <rolecap/>
2158 #
2159 interface(`userdom_setattr_all_user_home_content_dirs',`
2160         gen_require(`
2161                 attribute user_home_type;
2162         ')
2163
2164         allow $1 user_home_type:dir setattr_dir_perms;
2165 ')
2166
2167 ########################################
2168 ## <summary>
2169 ##      Mmap user home files.
2170 ## </summary>
2171 ## <param name="domain">
2172 ##      <summary>
2173 ##      Domain allowed access.
2174 ##      </summary>
2175 ## </param>
2176 #
2177 interface(`userdom_mmap_user_home_content_files',`
2178         gen_require(`
2179                 type user_home_dir_t, user_home_t;
2180         ')
2181
2182         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2183         files_search_home($1)
2184 ')
2185
2186 ########################################
2187 ## <summary>
2188 ##      Read user home files.
2189 ## </summary>
2190 ## <param name="domain">
2191 ##      <summary>
2192 ##      Domain allowed access.
2193 ##      </summary>
2194 ## </param>
2195 #
2196 interface(`userdom_read_user_home_content_files',`
2197         gen_require(`
2198                 type user_home_dir_t, user_home_t;
2199         ')
2200
2201         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2202         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2203         files_search_home($1)
2204 ')
2205
2206 ########################################
2207 ## <summary>
2208 ##      Do not audit attempts to getattr user home files.
2209 ## </summary>
2210 ## <param name="domain">
2211 ##      <summary>
2212 ##      Domain to not audit.
2213 ##      </summary>
2214 ## </param>
2215 #
2216 interface(`userdom_dontaudit_getattr_user_home_content',`
2217         gen_require(`
2218                 attribute user_home_type;
2219         ')
2220
2221         dontaudit $1 user_home_type:dir getattr;
2222         dontaudit $1 user_home_type:file getattr;
2223 ')
2224
2225 ########################################
2226 ## <summary>
2227 ##      Do not audit attempts to read user home files.
2228 ## </summary>
2229 ## <param name="domain">
2230 ##      <summary>
2231 ##      Domain to not audit.
2232 ##      </summary>
2233 ## </param>
2234 #
2235 interface(`userdom_dontaudit_read_user_home_content_files',`
2236         gen_require(`
2237                 attribute user_home_type;
2238                 type user_home_dir_t;
2239         ')
2240
2241         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2242         dontaudit $1 user_home_type:dir list_dir_perms;
2243         dontaudit $1 user_home_type:file read_file_perms;
2244         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2245 ')
2246
2247 ########################################
2248 ## <summary>
2249 ##      Do not audit attempts to append user home files.
2250 ## </summary>
2251 ## <param name="domain">
2252 ##      <summary>
2253 ##      Domain to not audit.
2254 ##      </summary>
2255 ## </param>
2256 #
2257 interface(`userdom_dontaudit_append_user_home_content_files',`
2258         gen_require(`
2259                 type user_home_t;
2260         ')
2261
2262         dontaudit $1 user_home_t:file append_file_perms;
2263 ')
2264
2265 ########################################
2266 ## <summary>
2267 ##      Do not audit attempts to write user home files.
2268 ## </summary>
2269 ## <param name="domain">
2270 ##      <summary>
2271 ##      Domain to not audit.
2272 ##      </summary>
2273 ## </param>
2274 #
2275 interface(`userdom_dontaudit_write_user_home_content_files',`
2276         gen_require(`
2277                 type user_home_t;
2278         ')
2279
2280         dontaudit $1 user_home_t:file write_file_perms;
2281 ')
2282
2283 ########################################
2284 ## <summary>
2285 ##      Delete files in a user home subdirectory.
2286 ## </summary>
2287 ## <param name="domain">
2288 ##      <summary>
2289 ##      Domain allowed access.
2290 ##      </summary>
2291 ## </param>
2292 #
2293 interface(`userdom_delete_user_home_content_files',`
2294         gen_require(`
2295                 type user_home_t;
2296         ')
2297
2298         allow $1 user_home_t:file delete_file_perms;
2299 ')
2300
2301 ########################################
2302 ## <summary>
2303 ##      Delete all files in a user home subdirectory.
2304 ## </summary>
2305 ## <param name="domain">
2306 ##      <summary>
2307 ##      Domain allowed access.
2308 ##      </summary>
2309 ## </param>
2310 #
2311 interface(`userdom_delete_all_user_home_content_files',`
2312         gen_require(`
2313                 attribute user_home_type;
2314         ')
2315
2316         allow $1 user_home_type:file delete_file_perms;
2317 ')
2318
2319 ########################################
2320 ## <summary>
2321 ##      Delete sock files in a user home subdirectory.
2322 ## </summary>
2323 ## <param name="domain">
2324 ##      <summary>
2325 ##      Domain allowed access.
2326 ##      </summary>
2327 ## </param>
2328 #
2329 interface(`userdom_delete_user_home_content_sock_files',`
2330         gen_require(`
2331                 type user_home_t;
2332         ')
2333
2334         allow $1 user_home_t:sock_file delete_file_perms;
2335 ')
2336
2337 ########################################
2338 ## <summary>
2339 ##      Delete all sock files in a user home subdirectory.
2340 ## </summary>
2341 ## <param name="domain">
2342 ##      <summary>
2343 ##      Domain allowed access.
2344 ##      </summary>
2345 ## </param>
2346 #
2347 interface(`userdom_delete_all_user_home_content_sock_files',`
2348         gen_require(`
2349                 attribute user_home_type;
2350         ')
2351
2352         allow $1 user_home_type:sock_file delete_file_perms;
2353 ')
2354
2355 ########################################
2356 ## <summary>
2357 ##      Do not audit attempts to write user home files.
2358 ## </summary>
2359 ## <param name="domain">
2360 ##      <summary>
2361 ##      Domain to not audit.
2362 ##      </summary>
2363 ## </param>
2364 #
2365 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2366         gen_require(`
2367                 type user_home_t;
2368         ')
2369
2370         dontaudit $1 user_home_t:file relabel_file_perms;
2371 ')
2372
2373 ########################################
2374 ## <summary>
2375 ##      Read user home subdirectory symbolic links.
2376 ## </summary>
2377 ## <param name="domain">
2378 ##      <summary>
2379 ##      Domain allowed access.
2380 ##      </summary>
2381 ## </param>
2382 #
2383 interface(`userdom_read_user_home_content_symlinks',`
2384         gen_require(`
2385                 type user_home_dir_t, user_home_t;
2386         ')
2387
2388         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2389 ')
2390
2391 ########################################
2392 ## <summary>
2393 ##      Execute user home files.
2394 ## </summary>
2395 ## <param name="domain">
2396 ##      <summary>
2397 ##      Domain allowed access.
2398 ##      </summary>
2399 ## </param>
2400 ## <rolecap/>
2401 #
2402 interface(`userdom_exec_user_home_content_files',`
2403         gen_require(`
2404                 type user_home_dir_t;
2405                 attribute user_home_type;
2406         ')
2407
2408         files_search_home($1)
2409         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2410         dontaudit $1 user_home_type:sock_file execute;
2411         ')
2412
2413 ########################################
2414 ## <summary>
2415 ##      Do not audit attempts to execute user home files.
2416 ## </summary>
2417 ## <param name="domain">
2418 ##      <summary>
2419 ##      Domain to not audit.
2420 ##      </summary>
2421 ## </param>
2422 #
2423 interface(`userdom_dontaudit_exec_user_home_content_files',`
2424         gen_require(`
2425                 type user_home_t;
2426         ')
2427
2428         dontaudit $1 user_home_t:file exec_file_perms;
2429 ')
2430
2431 ########################################
2432 ## <summary>
2433 ##      Create, read, write, and delete files
2434 ##      in a user home subdirectory.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      Domain allowed access.
2439 ##      </summary>
2440 ## </param>
2441 #
2442 interface(`userdom_manage_user_home_content_files',`
2443         gen_require(`
2444                 type user_home_dir_t, user_home_t;
2445         ')
2446
2447         manage_files_pattern($1, user_home_t, user_home_t)
2448         allow $1 user_home_dir_t:dir search_dir_perms;
2449         files_search_home($1)
2450 ')
2451
2452 ########################################
2453 ## <summary>
2454 ##      Do not audit attempts to create, read, write, and delete directories
2455 ##      in a user home subdirectory.
2456 ## </summary>
2457 ## <param name="domain">
2458 ##      <summary>
2459 ##      Domain to not audit.
2460 ##      </summary>
2461 ## </param>
2462 #
2463 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2464         gen_require(`
2465                 type user_home_dir_t, user_home_t;
2466         ')
2467
2468         dontaudit $1 user_home_t:dir manage_dir_perms;
2469 ')
2470
2471 ########################################
2472 ## <summary>
2473 ##      Create, read, write, and delete symbolic links
2474 ##      in a user home subdirectory.
2475 ## </summary>
2476 ## <param name="domain">
2477 ##      <summary>
2478 ##      Domain allowed access.
2479 ##      </summary>
2480 ## </param>
2481 #
2482 interface(`userdom_manage_user_home_content_symlinks',`
2483         gen_require(`
2484                 type user_home_dir_t, user_home_t;
2485         ')
2486
2487         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2488         allow $1 user_home_dir_t:dir search_dir_perms;
2489         files_search_home($1)
2490 ')
2491
2492 ########################################
2493 ## <summary>
2494 ##      Delete symbolic links in a user home directory.
2495 ## </summary>
2496 ## <param name="domain">
2497 ##      <summary>
2498 ##      Domain allowed access.
2499 ##      </summary>
2500 ## </param>
2501 #
2502 interface(`userdom_delete_user_home_content_symlinks',`
2503         gen_require(`
2504                 type user_home_t;
2505         ')
2506
2507         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2508 ')
2509
2510 ########################################
2511 ## <summary>
2512 ##      Delete all symbolic links in a user home directory.
2513 ## </summary>
2514 ## <param name="domain">
2515 ##      <summary>
2516 ##      Domain allowed access.
2517 ##      </summary>
2518 ## </param>
2519 #
2520 interface(`userdom_delete_all_user_home_content_symlinks',`
2521         gen_require(`
2522                 attribute user_home_type;
2523         ')
2524
2525         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2526 ')
2527
2528 ########################################
2529 ## <summary>
2530 ##      Create, read, write, and delete named pipes
2531 ##      in a user home subdirectory.
2532 ## </summary>
2533 ## <param name="domain">
2534 ##      <summary>
2535 ##      Domain allowed access.
2536 ##      </summary>
2537 ## </param>
2538 #
2539 interface(`userdom_manage_user_home_content_pipes',`
2540         gen_require(`
2541                 type user_home_dir_t, user_home_t;
2542         ')
2543
2544         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2545         allow $1 user_home_dir_t:dir search_dir_perms;
2546         files_search_home($1)
2547 ')
2548
2549 ########################################
2550 ## <summary>
2551 ##      Create, read, write, and delete named sockets
2552 ##      in a user home subdirectory.
2553 ## </summary>
2554 ## <param name="domain">
2555 ##      <summary>
2556 ##      Domain allowed access.
2557 ##      </summary>
2558 ## </param>
2559 #
2560 interface(`userdom_manage_user_home_content_sockets',`
2561         gen_require(`
2562                 type user_home_dir_t, user_home_t;
2563         ')
2564
2565         allow $1 user_home_dir_t:dir search_dir_perms;
2566         manage_sock_files_pattern($1, user_home_t, user_home_t)
2567         files_search_home($1)
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Create objects in a user home directory
2573 ##      with an automatic type transition to
2574 ##      a specified private type.
2575 ## </summary>
2576 ## <param name="domain">
2577 ##      <summary>
2578 ##      Domain allowed access.
2579 ##      </summary>
2580 ## </param>
2581 ## <param name="private_type">
2582 ##      <summary>
2583 ##      The type of the object to create.
2584 ##      </summary>
2585 ## </param>
2586 ## <param name="object_class">
2587 ##      <summary>
2588 ##      The class of the object to be created.
2589 ##      </summary>
2590 ## </param>
2591 #
2592 interface(`userdom_user_home_dir_filetrans',`
2593         gen_require(`
2594                 type user_home_dir_t;
2595         ')
2596
2597         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2598         files_search_home($1)
2599 ')
2600
2601 ########################################
2602 ## <summary>
2603 ##      Create objects in a user home directory
2604 ##      with an automatic type transition to
2605 ##      a specified private type.
2606 ## </summary>
2607 ## <param name="domain">
2608 ##      <summary>
2609 ##      Domain allowed access.
2610 ##      </summary>
2611 ## </param>
2612 ## <param name="private_type">
2613 ##      <summary>
2614 ##      The type of the object to create.
2615 ##      </summary>
2616 ## </param>
2617 ## <param name="object_class">
2618 ##      <summary>
2619 ##      The class of the object to be created.
2620 ##      </summary>
2621 ## </param>
2622 #
2623 interface(`userdom_user_home_content_filetrans',`
2624         gen_require(`
2625                 type user_home_dir_t, user_home_t;
2626         ')
2627
2628         filetrans_pattern($1, user_home_t, $2, $3, $4)
2629         allow $1 user_home_dir_t:dir search_dir_perms;
2630         files_search_home($1)
2631 ')
2632
2633 ########################################
2634 ## <summary>
2635 ##      Create objects in a user home directory
2636 ##      with an automatic type transition to
2637 ##      the user home file type.
2638 ## </summary>
2639 ## <param name="domain">
2640 ##      <summary>
2641 ##      Domain allowed access.
2642 ##      </summary>
2643 ## </param>
2644 ## <param name="object_class">
2645 ##      <summary>
2646 ##      The class of the object to be created.
2647 ##      </summary>
2648 ## </param>
2649 #
2650 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2651         gen_require(`
2652                 type user_home_dir_t, user_home_t;
2653         ')
2654
2655         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2656         files_search_home($1)
2657 ')
2658
2659 ########################################
2660 ## <summary>
2661 ##      Write to user temporary named sockets.
2662 ## </summary>
2663 ## <param name="domain">
2664 ##      <summary>
2665 ##      Domain allowed access.
2666 ##      </summary>
2667 ## </param>
2668 #
2669 interface(`userdom_write_user_tmp_sockets',`
2670         gen_require(`
2671                 type user_tmp_t;
2672         ')
2673
2674         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2675         files_search_tmp($1)
2676 ')
2677
2678 ########################################
2679 ## <summary>
2680 ##      List user temporary directories.
2681 ## </summary>
2682 ## <param name="domain">
2683 ##      <summary>
2684 ##      Domain allowed access.
2685 ##      </summary>
2686 ## </param>
2687 #
2688 interface(`userdom_list_user_tmp',`
2689         gen_require(`
2690                 type user_tmp_t;
2691         ')
2692
2693         allow $1 user_tmp_t:dir list_dir_perms;
2694         files_search_tmp($1)
2695 ')
2696
2697 ########################################
2698 ## <summary>
2699 ##      Do not audit attempts to list user
2700 ##      temporary directories.
2701 ## </summary>
2702 ## <param name="domain">
2703 ##      <summary>
2704 ##      Domain to not audit.
2705 ##      </summary>
2706 ## </param>
2707 #
2708 interface(`userdom_dontaudit_list_user_tmp',`
2709         gen_require(`
2710                 type user_tmp_t;
2711         ')
2712
2713         dontaudit $1 user_tmp_t:dir list_dir_perms;
2714 ')
2715
2716 ########################################
2717 ## <summary>
2718 ##      Do not audit attempts to manage users
2719 ##      temporary directories.
2720 ## </summary>
2721 ## <param name="domain">
2722 ##      <summary>
2723 ##      Domain to not audit.
2724 ##      </summary>
2725 ## </param>
2726 #
2727 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2728         gen_require(`
2729                 type user_tmp_t;
2730         ')
2731
2732         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2733 ')
2734
2735 ########################################
2736 ## <summary>
2737 ##      Read user temporary files.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain allowed access.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_read_user_tmp_files',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         read_files_pattern($1, user_tmp_t, user_tmp_t)
2751         allow $1 user_tmp_t:dir list_dir_perms;
2752         files_search_tmp($1)
2753 ')
2754
2755 ########################################
2756 ## <summary>
2757 ##      Do not audit attempts to read users
2758 ##      temporary files.
2759 ## </summary>
2760 ## <param name="domain">
2761 ##      <summary>
2762 ##      Domain to not audit.
2763 ##      </summary>
2764 ## </param>
2765 #
2766 interface(`userdom_dontaudit_read_user_tmp_files',`
2767         gen_require(`
2768                 type user_tmp_t;
2769         ')
2770
2771         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2772 ')
2773
2774 ########################################
2775 ## <summary>
2776 ##      Do not audit attempts to append users
2777 ##      temporary files.
2778 ## </summary>
2779 ## <param name="domain">
2780 ##      <summary>
2781 ##      Domain to not audit.
2782 ##      </summary>
2783 ## </param>
2784 #
2785 interface(`userdom_dontaudit_append_user_tmp_files',`
2786         gen_require(`
2787                 type user_tmp_t;
2788         ')
2789
2790         dontaudit $1 user_tmp_t:file append_file_perms;
2791 ')
2792
2793 ########################################
2794 ## <summary>
2795 ##      Read and write user temporary files.
2796 ## </summary>
2797 ## <param name="domain">
2798 ##      <summary>
2799 ##      Domain allowed access.
2800 ##      </summary>
2801 ## </param>
2802 #
2803 interface(`userdom_rw_user_tmp_files',`
2804         gen_require(`
2805                 type user_tmp_t;
2806         ')
2807
2808         allow $1 user_tmp_t:dir list_dir_perms;
2809         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2810         files_search_tmp($1)
2811 ')
2812
2813 ########################################
2814 ## <summary>
2815 ##      Do not audit attempts to manage users
2816 ##      temporary files.
2817 ## </summary>
2818 ## <param name="domain">
2819 ##      <summary>
2820 ##      Domain to not audit.
2821 ##      </summary>
2822 ## </param>
2823 #
2824 interface(`userdom_dontaudit_manage_user_tmp_files',`
2825         gen_require(`
2826                 type user_tmp_t;
2827         ')
2828
2829         dontaudit $1 user_tmp_t:file manage_file_perms;
2830 ')
2831
2832 ########################################
2833 ## <summary>
2834 ##      Read user temporary symbolic links.
2835 ## </summary>
2836 ## <param name="domain">
2837 ##      <summary>
2838 ##      Domain allowed access.
2839 ##      </summary>
2840 ## </param>
2841 #
2842 interface(`userdom_read_user_tmp_symlinks',`
2843         gen_require(`
2844                 type user_tmp_t;
2845         ')
2846
2847         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2848         allow $1 user_tmp_t:dir list_dir_perms;
2849         files_search_tmp($1)
2850 ')
2851
2852 ########################################
2853 ## <summary>
2854 ##      Create, read, write, and delete user
2855 ##      temporary directories.
2856 ## </summary>
2857 ## <param name="domain">
2858 ##      <summary>
2859 ##      Domain allowed access.
2860 ##      </summary>
2861 ## </param>
2862 #
2863 interface(`userdom_manage_user_tmp_dirs',`
2864         gen_require(`
2865                 type user_tmp_t;
2866         ')
2867
2868         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2869         files_search_tmp($1)
2870 ')
2871
2872 ########################################
2873 ## <summary>
2874 ##      Create, read, write, and delete user
2875 ##      temporary files.
2876 ## </summary>
2877 ## <param name="domain">
2878 ##      <summary>
2879 ##      Domain allowed access.
2880 ##      </summary>
2881 ## </param>
2882 #
2883 interface(`userdom_manage_user_tmp_files',`
2884         gen_require(`
2885                 type user_tmp_t;
2886         ')
2887
2888         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2889         files_search_tmp($1)
2890 ')
2891
2892 ########################################
2893 ## <summary>
2894 ##      Create, read, write, and delete user
2895 ##      temporary symbolic links.
2896 ## </summary>
2897 ## <param name="domain">
2898 ##      <summary>
2899 ##      Domain allowed access.
2900 ##      </summary>
2901 ## </param>
2902 #
2903 interface(`userdom_manage_user_tmp_symlinks',`
2904         gen_require(`
2905                 type user_tmp_t;
2906         ')
2907
2908         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2909         files_search_tmp($1)
2910 ')
2911
2912 ########################################
2913 ## <summary>
2914 ##      Create, read, write, and delete user
2915 ##      temporary named pipes.
2916 ## </summary>
2917 ## <param name="domain">
2918 ##      <summary>
2919 ##      Domain allowed access.
2920 ##      </summary>
2921 ## </param>
2922 #
2923 interface(`userdom_manage_user_tmp_pipes',`
2924         gen_require(`
2925                 type user_tmp_t;
2926         ')
2927
2928         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2929         files_search_tmp($1)
2930 ')
2931
2932 ########################################
2933 ## <summary>
2934 ##      Create, read, write, and delete user
2935 ##      temporary named sockets.
2936 ## </summary>
2937 ## <param name="domain">
2938 ##      <summary>
2939 ##      Domain allowed access.
2940 ##      </summary>
2941 ## </param>
2942 #
2943 interface(`userdom_manage_user_tmp_sockets',`
2944         gen_require(`
2945                 type user_tmp_t;
2946         ')
2947
2948         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2949         files_search_tmp($1)
2950 ')
2951
2952 ########################################
2953 ## <summary>
2954 ##      Create objects in a user temporary directory
2955 ##      with an automatic type transition to
2956 ##      a specified private type.
2957 ## </summary>
2958 ## <param name="domain">
2959 ##      <summary>
2960 ##      Domain allowed access.
2961 ##      </summary>
2962 ## </param>
2963 ## <param name="private_type">
2964 ##      <summary>
2965 ##      The type of the object to create.
2966 ##      </summary>
2967 ## </param>
2968 ## <param name="object_class">
2969 ##      <summary>
2970 ##      The class of the object to be created.
2971 ##      </summary>
2972 ## </param>
2973 #
2974 interface(`userdom_user_tmp_filetrans',`
2975         gen_require(`
2976                 type user_tmp_t;
2977         ')
2978
2979         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2980         files_search_tmp($1)
2981 ')
2982
2983 ########################################
2984 ## <summary>
2985 ##      Create objects in the temporary directory
2986 ##      with an automatic type transition to
2987 ##      the user temporary type.
2988 ## </summary>
2989 ## <param name="domain">
2990 ##      <summary>
2991 ##      Domain allowed access.
2992 ##      </summary>
2993 ## </param>
2994 ## <param name="object_class">
2995 ##      <summary>
2996 ##      The class of the object to be created.
2997 ##      </summary>
2998 ## </param>
2999 #
3000 interface(`userdom_tmp_filetrans_user_tmp',`
3001         gen_require(`
3002                 type user_tmp_t;
3003         ')
3004
3005         files_tmp_filetrans($1, user_tmp_t, $2)
3006 ')
3007
3008 #######################################
3009 ## <summary>
3010 ##  Getattr user tmpfs files.
3011 ## </summary>
3012 ## <param name="domain">
3013 ##  <summary>
3014 ##  Domain allowed access.
3015 ##  </summary>
3016 ## </param>
3017 #
3018 interface(`userdom_getattr_user_tmpfs_files',`
3019     gen_require(`
3020         type user_tmpfs_t;
3021     ')
3022
3023     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3024     fs_search_tmpfs($1)
3025 ')
3026
3027 ########################################
3028 ## <summary>
3029 ##      Read user tmpfs files.
3030 ## </summary>
3031 ## <param name="domain">
3032 ##      <summary>
3033 ##      Domain allowed access.
3034 ##      </summary>
3035 ## </param>
3036 #
3037 interface(`userdom_read_user_tmpfs_files',`
3038         gen_require(`
3039                 type user_tmpfs_t;
3040         ')
3041
3042         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3043         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3044         allow $1 user_tmpfs_t:dir list_dir_perms;
3045         fs_search_tmpfs($1)
3046 ')
3047
3048 ########################################
3049 ## <summary>
3050 ##      Read/Write user tmpfs files.
3051 ## </summary>
3052 ## <param name="domain">
3053 ##      <summary>
3054 ##      Domain allowed access.
3055 ##      </summary>
3056 ## </param>
3057 #
3058 interface(`userdom_rw_user_tmpfs_files',`
3059         gen_require(`
3060                 type user_tmpfs_t;
3061         ')
3062
3063         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3064         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3065         allow $1 user_tmpfs_t:dir list_dir_perms;
3066         fs_search_tmpfs($1)
3067 ')
3068
3069 ########################################
3070 ## <summary>
3071 ##      Read/Write inherited user tmpfs files.
3072 ## </summary>
3073 ## <param name="domain">
3074 ##      <summary>
3075 ##      Domain allowed access.
3076 ##      </summary>
3077 ## </param>
3078 #
3079 interface(`userdom_rw_inherited_user_tmpfs_files',`
3080         gen_require(`
3081                 type user_tmpfs_t;
3082         ')
3083
3084         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3085 ')
3086
3087 ########################################
3088 ## <summary>
3089 ##      Execute user tmpfs files.
3090 ## </summary>
3091 ## <param name="domain">
3092 ##      <summary>
3093 ##      Domain allowed access.
3094 ##      </summary>
3095 ## </param>
3096 #
3097 interface(`userdom_execute_user_tmpfs_files',`
3098         gen_require(`
3099                 type user_tmpfs_t;
3100         ')
3101
3102         allow $1 user_tmpfs_t:file execute;
3103 ')
3104
3105 ########################################
3106 ## <summary>
3107 ##      Get the attributes of a user domain tty.
3108 ## </summary>
3109 ## <param name="domain">
3110 ##      <summary>
3111 ##      Domain allowed access.
3112 ##      </summary>
3113 ## </param>
3114 #
3115 interface(`userdom_getattr_user_ttys',`
3116         gen_require(`
3117                 type user_tty_device_t;
3118         ')
3119
3120         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3121 ')
3122
3123 ########################################
3124 ## <summary>
3125 ##      Do not audit attempts to get the attributes of a user domain tty.
3126 ## </summary>
3127 ## <param name="domain">
3128 ##      <summary>
3129 ##      Domain to not audit.
3130 ##      </summary>
3131 ## </param>
3132 #
3133 interface(`userdom_dontaudit_getattr_user_ttys',`
3134         gen_require(`
3135                 type user_tty_device_t;
3136         ')
3137
3138         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3139 ')
3140
3141 ########################################
3142 ## <summary>
3143 ##      Set the attributes of a user domain tty.
3144 ## </summary>
3145 ## <param name="domain">
3146 ##      <summary>
3147 ##      Domain allowed access.
3148 ##      </summary>
3149 ## </param>
3150 #
3151 interface(`userdom_setattr_user_ttys',`
3152         gen_require(`
3153                 type user_tty_device_t;
3154         ')
3155
3156         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3157 ')
3158
3159 ########################################
3160 ## <summary>
3161 ##      Do not audit attempts to set the attributes of a user domain tty.
3162 ## </summary>
3163 ## <param name="domain">
3164 ##      <summary>
3165 ##      Domain to not audit.
3166 ##      </summary>
3167 ## </param>
3168 #
3169 interface(`userdom_dontaudit_setattr_user_ttys',`
3170         gen_require(`
3171                 type user_tty_device_t;
3172         ')
3173
3174         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3175 ')
3176
3177 ########################################
3178 ## <summary>
3179 ##      Read and write a user domain tty.
3180 ## </summary>
3181 ## <param name="domain">
3182 ##      <summary>
3183 ##      Domain allowed access.
3184 ##      </summary>
3185 ## </param>
3186 #
3187 interface(`userdom_use_user_ttys',`
3188         gen_require(`
3189                 type user_tty_device_t;
3190         ')
3191
3192         allow $1 user_tty_device_t:chr_file rw_term_perms;
3193 ')
3194
3195 ########################################
3196 ## <summary>
3197 ##      Read and write a inherited user domain tty.
3198 ## </summary>
3199 ## <param name="domain">
3200 ##      <summary>
3201 ##      Domain allowed access.
3202 ##      </summary>
3203 ## </param>
3204 #
3205 interface(`userdom_use_inherited_user_ttys',`
3206         gen_require(`
3207                 type user_tty_device_t;
3208         ')
3209
3210         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3211 ')
3212
3213 ########################################
3214 ## <summary>
3215 ##      Read and write a user domain pty.
3216 ## </summary>
3217 ## <param name="domain">
3218 ##      <summary>
3219 ##      Domain allowed access.
3220 ##      </summary>
3221 ## </param>
3222 #
3223 interface(`userdom_use_user_ptys',`
3224         gen_require(`
3225                 type user_devpts_t;
3226         ')
3227
3228         allow $1 user_devpts_t:chr_file rw_term_perms;
3229 ')
3230
3231 ########################################
3232 ## <summary>
3233 ##      Read and write a inherited user domain pty.
3234 ## </summary>
3235 ## <param name="domain">
3236 ##      <summary>
3237 ##      Domain allowed access.
3238 ##      </summary>
3239 ## </param>
3240 #
3241 interface(`userdom_use_inherited_user_ptys',`
3242         gen_require(`
3243                 type user_devpts_t;
3244         ')
3245
3246         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3247 ')
3248
3249 ########################################
3250 ## <summary>
3251 ##      Read and write a inherited user TTYs and PTYs.
3252 ## </summary>
3253 ## <desc>
3254 ##      <p>
3255 ##      Allow the specified domain to read and write inherited user
3256 ##      TTYs and PTYs. This will allow the domain to
3257 ##      interact with the user via the terminal. Typically
3258 ##      all interactive applications will require this
3259 ##      access.
3260 ##      </p>
3261 ## </desc>
3262 ## <param name="domain">
3263 ##      <summary>
3264 ##      Domain allowed access.
3265 ##      </summary>
3266 ## </param>
3267 ## <infoflow type="both" weight="10"/>
3268 #
3269 interface(`userdom_use_inherited_user_terminals',`
3270         gen_require(`
3271                 type user_tty_device_t, user_devpts_t;
3272         ')
3273
3274         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3275         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3276 ')
3277
3278 #######################################
3279 ## <summary>
3280 ##  Allow attempts to read and write
3281 ##  a user domain tty and pty.
3282 ## </summary>
3283 ## <param name="domain">
3284 ##  <summary>
3285 ##  Domain to not audit.
3286 ##  </summary>
3287 ## </param>
3288 #
3289 interface(`userdom_use_user_terminals',`
3290     gen_require(`
3291         type user_tty_device_t, user_devpts_t;
3292     ')
3293
3294     allow $1 user_tty_device_t:chr_file rw_term_perms;
3295     allow $1 user_devpts_t:chr_file rw_term_perms;
3296 ')
3297
3298 ########################################
3299 ## <summary>
3300 ##      Do not audit attempts to read and write
3301 ##      a user domain tty and pty.
3302 ## </summary>
3303 ## <param name="domain">
3304 ##      <summary>
3305 ##      Domain to not audit.
3306 ##      </summary>
3307 ## </param>
3308 #
3309 interface(`userdom_dontaudit_use_user_terminals',`
3310         gen_require(`
3311                 type user_tty_device_t, user_devpts_t;
3312         ')
3313
3314         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3315         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3316 ')
3317
3318
3319 ########################################
3320 ## <summary>
3321 ##      Get attributes of user domain tty and pty.
3322 ## </summary>
3323 ## <param name="domain">
3324 ##      <summary>
3325 ##      Domain allowed access.
3326 ##      </summary>
3327 ## </param>
3328 #
3329 interface(`userdom_getattr_user_terminals',`
3330         gen_require(`
3331                 type user_tty_device_t, user_devpts_t;
3332         ')
3333
3334         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3335 ')
3336
3337 ########################################
3338 ## <summary>
3339 ##      Execute a shell in all user domains.  This
3340 ##      is an explicit transition, requiring the
3341 ##      caller to use setexeccon().
3342 ## </summary>
3343 ## <param name="domain">
3344 ##      <summary>
3345 ##      Domain allowed to transition.
3346 ##      </summary>
3347 ## </param>
3348 #
3349 interface(`userdom_spec_domtrans_all_users',`
3350         gen_require(`
3351                 attribute userdomain;
3352         ')
3353
3354         corecmd_shell_spec_domtrans($1, userdomain)
3355         allow userdomain $1:fd use;
3356         allow userdomain $1:fifo_file rw_file_perms;
3357         allow userdomain $1:process sigchld;
3358 ')
3359
3360 ########################################
3361 ## <summary>
3362 ##      Execute an Xserver session in all unprivileged user domains.  This
3363 ##      is an explicit transition, requiring the
3364 ##      caller to use setexeccon().
3365 ## </summary>
3366 ## <param name="domain">
3367 ##      <summary>
3368 ##      Domain allowed to transition.
3369 ##      </summary>
3370 ## </param>
3371 #
3372 interface(`userdom_xsession_spec_domtrans_all_users',`
3373         gen_require(`
3374                 attribute userdomain;
3375         ')
3376
3377         xserver_xsession_spec_domtrans($1, userdomain)
3378         allow userdomain $1:fd use;
3379         allow userdomain $1:fifo_file rw_file_perms;
3380         allow userdomain $1:process sigchld;
3381 ')
3382
3383 ########################################
3384 ## <summary>
3385 ##      Execute a shell in all unprivileged user domains.  This
3386 ##      is an explicit transition, requiring the
3387 ##      caller to use setexeccon().
3388 ## </summary>
3389 ## <param name="domain">
3390 ##      <summary>
3391 ##      Domain allowed to transition.
3392 ##      </summary>
3393 ## </param>
3394 #
3395 interface(`userdom_spec_domtrans_unpriv_users',`
3396         gen_require(`
3397                 attribute unpriv_userdomain;
3398         ')
3399
3400         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3401         allow unpriv_userdomain $1:fd use;
3402         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3403         allow unpriv_userdomain $1:process sigchld;
3404 ')
3405
3406 #####################################
3407 ## <summary>
3408 ##  Allow domain dyntrans to unpriv userdomain.
3409 ## </summary>
3410 ## <param name="domain">
3411 ##  <summary>
3412 ##  Domain allowed access.
3413 ##  </summary>
3414 ## </param>
3415 #
3416 interface(`userdom_dyntransition_unpriv_users',`
3417     gen_require(`
3418         attribute unpriv_userdomain;
3419     ')
3420
3421     allow $1 unpriv_userdomain:process dyntransition;
3422 ')
3423
3424 ########################################
3425 ## <summary>
3426 ##      Execute an Xserver session in all unprivileged user domains.  This
3427 ##      is an explicit transition, requiring the
3428 ##      caller to use setexeccon().
3429 ## </summary>
3430 ## <param name="domain">
3431 ##      <summary>
3432 ##      Domain allowed to transition.
3433 ##      </summary>
3434 ## </param>
3435 #
3436 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3437         gen_require(`
3438                 attribute unpriv_userdomain;
3439         ')
3440
3441         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3442         allow unpriv_userdomain $1:fd use;
3443         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3444         allow unpriv_userdomain $1:process sigchld;
3445 ')
3446
3447 ########################################
3448 ## <summary>
3449 ##      Manage unpriviledged user SysV sempaphores.
3450 ## </summary>
3451 ## <param name="domain">
3452 ##      <summary>
3453 ##      Domain allowed access.
3454 ##      </summary>
3455 ## </param>
3456 #
3457 interface(`userdom_manage_unpriv_user_semaphores',`
3458         gen_require(`
3459                 attribute unpriv_userdomain;
3460         ')
3461
3462         allow $1 unpriv_userdomain:sem create_sem_perms;
3463 ')
3464
3465 ########################################
3466 ## <summary>
3467 ##      Manage unpriviledged user SysV shared
3468 ##      memory segments.
3469 ## </summary>
3470 ## <param name="domain">
3471 ##      <summary>
3472 ##      Domain allowed access.
3473 ##      </summary>
3474 ## </param>
3475 #
3476 interface(`userdom_manage_unpriv_user_shared_mem',`
3477         gen_require(`
3478                 attribute unpriv_userdomain;
3479         ')
3480
3481         allow $1 unpriv_userdomain:shm create_shm_perms;
3482 ')
3483
3484 ########################################
3485 ## <summary>
3486 ##      Execute bin_t in the unprivileged user domains. This
3487 ##      is an explicit transition, requiring the
3488 ##      caller to use setexeccon().
3489 ## </summary>
3490 ## <param name="domain">
3491 ##      <summary>
3492 ##      Domain allowed to transition.
3493 ##      </summary>
3494 ## </param>
3495 #
3496 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3497         gen_require(`
3498                 attribute unpriv_userdomain;
3499         ')
3500
3501         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3502         allow unpriv_userdomain $1:fd use;
3503         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3504         allow unpriv_userdomain $1:process sigchld;
3505 ')
3506
3507 ########################################
3508 ## <summary>
3509 ##      Execute all entrypoint files in unprivileged user
3510 ##      domains. This is an explicit transition, requiring the
3511 ##      caller to use setexeccon().
3512 ## </summary>
3513 ## <param name="domain">
3514 ##      <summary>
3515 ##      Domain allowed access.
3516 ##      </summary>
3517 ## </param>
3518 #
3519 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3520         gen_require(`
3521                 attribute unpriv_userdomain;
3522         ')
3523
3524         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3525         allow unpriv_userdomain $1:fd use;
3526         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3527         allow unpriv_userdomain $1:process sigchld;
3528 ')
3529
3530 ########################################
3531 ## <summary>
3532 ##      Search users home directories.
3533 ## </summary>
3534 ## <param name="domain">
3535 ##      <summary>
3536 ##      Domain allowed access.
3537 ##      </summary>
3538 ## </param>
3539 #
3540 interface(`userdom_search_user_home_content',`
3541         gen_require(`
3542                 type user_home_dir_t;
3543                 attribute user_home_type;
3544         ')
3545
3546         files_list_home($1)
3547         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3548         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3549 ')
3550
3551 ########################################
3552 ## <summary>
3553 ##      Send general signals to unprivileged user domains.
3554 ## </summary>
3555 ## <param name="domain">
3556 ##      <summary>
3557 ##      Domain allowed access.
3558 ##      </summary>
3559 ## </param>
3560 #
3561 interface(`userdom_signal_unpriv_users',`
3562         gen_require(`
3563                 attribute unpriv_userdomain;
3564         ')
3565
3566         allow $1 unpriv_userdomain:process signal;
3567 ')
3568
3569 ########################################
3570 ## <summary>
3571 ##      Inherit the file descriptors from unprivileged user domains.
3572 ## </summary>
3573 ## <param name="domain">
3574 ##      <summary>
3575 ##      Domain allowed access.
3576 ##      </summary>
3577 ## </param>
3578 #
3579 interface(`userdom_use_unpriv_users_fds',`
3580         gen_require(`
3581                 attribute unpriv_userdomain;
3582         ')
3583
3584         allow $1 unpriv_userdomain:fd use;
3585 ')
3586
3587 ########################################
3588 ## <summary>
3589 ##      Do not audit attempts to inherit the file descriptors
3590 ##      from unprivileged user domains.
3591 ## </summary>
3592 ## <desc>
3593 ##      <p>
3594 ##      Do not audit attempts to inherit the file descriptors
3595 ##      from unprivileged user domains. This will supress
3596 ##      SELinux denial messages when the specified domain is denied
3597 ##      the permission to inherit these file descriptors.
3598 ##      </p>
3599 ## </desc>
3600 ## <param name="domain">
3601 ##      <summary>
3602 ##      Domain to not audit.
3603 ##      </summary>
3604 ## </param>
3605 ## <infoflow type="none"/>
3606 #
3607 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3608         gen_require(`
3609                 attribute unpriv_userdomain;
3610         ')
3611
3612         dontaudit $1 unpriv_userdomain:fd use;
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Do not audit attempts to use user ptys.
3618 ## </summary>
3619 ## <param name="domain">
3620 ##      <summary>
3621 ##      Domain to not audit.
3622 ##      </summary>
3623 ## </param>
3624 #
3625 interface(`userdom_dontaudit_use_user_ptys',`
3626         gen_require(`
3627                 type user_devpts_t;
3628         ')
3629
3630         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3631 ')
3632
3633 ########################################
3634 ## <summary>
3635 ##      Relabel files to unprivileged user pty types.
3636 ## </summary>
3637 ## <param name="domain">
3638 ##      <summary>
3639 ##      Domain allowed access.
3640 ##      </summary>
3641 ## </param>
3642 #
3643 interface(`userdom_relabelto_user_ptys',`
3644         gen_require(`
3645                 type user_devpts_t;
3646         ')
3647
3648         allow $1 user_devpts_t:chr_file relabelto;
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Do not audit attempts to relabel files from
3654 ##      user pty types.
3655 ## </summary>
3656 ## <param name="domain">
3657 ##      <summary>
3658 ##      Domain to not audit.
3659 ##      </summary>
3660 ## </param>
3661 #
3662 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3663         gen_require(`
3664                 type user_devpts_t;
3665         ')
3666
3667         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3668 ')
3669
3670 ########################################
3671 ## <summary>
3672 ##      Write all users files in /tmp
3673 ## </summary>
3674 ## <param name="domain">
3675 ##      <summary>
3676 ##      Domain allowed access.
3677 ##      </summary>
3678 ## </param>
3679 #
3680 interface(`userdom_write_user_tmp_files',`
3681         gen_require(`
3682                 type user_tmp_t;
3683         ')
3684
3685         write_files_pattern($1, user_tmp_t, user_tmp_t)
3686 ')
3687
3688 ########################################
3689 ## <summary>
3690 ##      Do not audit attempts to write users
3691 ##      temporary files.
3692 ## </summary>
3693 ## <param name="domain">
3694 ##      <summary>
3695 ##      Domain to not audit.
3696 ##      </summary>
3697 ## </param>
3698 #
3699 interface(`userdom_dontaudit_write_user_tmp_files',`
3700         gen_require(`
3701                 type user_tmp_t;
3702         ')
3703
3704         dontaudit $1 user_tmp_t:file write;
3705 ')
3706
3707 ########################################
3708 ## <summary>
3709 ##      Do not audit attempts to read/write users
3710 ##      temporary fifo files.
3711 ## </summary>
3712 ## <param name="domain">
3713 ##      <summary>
3714 ##      Domain to not audit.
3715 ##      </summary>
3716 ## </param>
3717 #
3718 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3719         gen_require(`
3720                 type user_tmp_t;
3721         ')
3722
3723         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3724 ')
3725
3726 ########################################
3727 ## <summary>
3728 ##      Do not audit attempts to use user ttys.
3729 ## </summary>
3730 ## <param name="domain">
3731 ##      <summary>
3732 ##      Domain to not audit.
3733 ##      </summary>
3734 ## </param>
3735 #
3736 interface(`userdom_dontaudit_use_user_ttys',`
3737         gen_require(`
3738                 type user_tty_device_t;
3739         ')
3740
3741         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3742 ')
3743
3744 ########################################
3745 ## <summary>
3746 ##      Read the process state of all user domains.
3747 ## </summary>
3748 ## <param name="domain">
3749 ##      <summary>
3750 ##      Domain allowed access.
3751 ##      </summary>
3752 ## </param>
3753 #
3754 interface(`userdom_read_all_users_state',`
3755         gen_require(`
3756                 attribute userdomain;
3757         ')
3758
3759         read_files_pattern($1, userdomain, userdomain)
3760         read_lnk_files_pattern($1,userdomain,userdomain)
3761         kernel_search_proc($1)
3762 ')
3763
3764 ########################################
3765 ## <summary>
3766 ##      Get the attributes of all user domains.
3767 ## </summary>
3768 ## <param name="domain">
3769 ##      <summary>
3770 ##      Domain allowed access.
3771 ##      </summary>
3772 ## </param>
3773 #
3774 interface(`userdom_getattr_all_users',`
3775         gen_require(`
3776                 attribute userdomain;
3777         ')
3778
3779         allow $1 userdomain:process getattr;
3780 ')
3781
3782 ########################################
3783 ## <summary>
3784 ##      Inherit the file descriptors from all user domains
3785 ## </summary>
3786 ## <param name="domain">
3787 ##      <summary>
3788 ##      Domain allowed access.
3789 ##      </summary>
3790 ## </param>
3791 #
3792 interface(`userdom_use_all_users_fds',`
3793         gen_require(`
3794                 attribute userdomain;
3795         ')
3796
3797         allow $1 userdomain:fd use;
3798 ')
3799
3800 ########################################
3801 ## <summary>
3802 ##      Do not audit attempts to inherit the file
3803 ##      descriptors from any user domains.
3804 ## </summary>
3805 ## <param name="domain">
3806 ##      <summary>
3807 ##      Domain to not audit.
3808 ##      </summary>
3809 ## </param>
3810 #
3811 interface(`userdom_dontaudit_use_all_users_fds',`
3812         gen_require(`
3813                 attribute userdomain;
3814         ')
3815
3816         dontaudit $1 userdomain:fd use;
3817 ')
3818
3819 ########################################
3820 ## <summary>
3821 ##      Send general signals to all user domains.
3822 ## </summary>
3823 ## <param name="domain">
3824 ##      <summary>
3825 ##      Domain allowed access.
3826 ##      </summary>
3827 ## </param>
3828 #
3829 interface(`userdom_signal_all_users',`
3830         gen_require(`
3831                 attribute userdomain;
3832         ')
3833
3834         allow $1 userdomain:process signal;
3835 ')
3836
3837 ########################################
3838 ## <summary>
3839 ##      Send kill signals to all user domains.
3840 ## </summary>
3841 ## <param name="domain">
3842 ##      <summary>
3843 ##      Domain allowed access.
3844 ##      </summary>
3845 ## </param>
3846 #
3847 interface(`userdom_kill_all_users',`
3848         gen_require(`
3849                 attribute userdomain;
3850         ')
3851
3852         allow $1 userdomain:process sigkill;
3853 ')
3854
3855 ########################################
3856 ## <summary>
3857 ##      Send a SIGCHLD signal to all user domains.
3858 ## </summary>
3859 ## <param name="domain">
3860 ##      <summary>
3861 ##      Domain allowed access.
3862 ##      </summary>
3863 ## </param>
3864 #
3865 interface(`userdom_sigchld_all_users',`
3866         gen_require(`
3867                 attribute userdomain;
3868         ')
3869
3870         allow $1 userdomain:process sigchld;
3871 ')
3872
3873 ########################################
3874 ## <summary>
3875 ##      Read keys for all user domains.
3876 ## </summary>
3877 ## <param name="domain">
3878 ##      <summary>
3879 ##      Domain allowed access.
3880 ##      </summary>
3881 ## </param>
3882 #
3883 interface(`userdom_read_all_users_keys',`
3884         gen_require(`
3885                 attribute userdomain;
3886         ')
3887
3888         allow $1 userdomain:key read;
3889 ')
3890
3891 ########################################
3892 ## <summary>
3893 ##      Create keys for all user domains.
3894 ## </summary>
3895 ## <param name="domain">
3896 ##      <summary>
3897 ##      Domain allowed access.
3898 ##      </summary>
3899 ## </param>
3900 #
3901 interface(`userdom_create_all_users_keys',`
3902         gen_require(`
3903                 attribute userdomain;
3904         ')
3905
3906         allow $1 userdomain:key create;
3907 ')
3908
3909 ########################################
3910 ## <summary>
3911 ##      Send a dbus message to all user domains.
3912 ## </summary>
3913 ## <param name="domain">
3914 ##      <summary>
3915 ##      Domain allowed access.
3916 ##      </summary>
3917 ## </param>
3918 #
3919 interface(`userdom_dbus_send_all_users',`
3920         gen_require(`
3921                 attribute userdomain;
3922                 class dbus send_msg;
3923         ')
3924
3925         allow $1 userdomain:dbus send_msg;
3926 ')
3927
3928 ########################################
3929 ## <summary>
3930 ##      Allow apps to set rlimits on userdomain
3931 ## </summary>
3932 ## <param name="domain">
3933 ##      <summary>
3934 ##      Domain allowed access.
3935 ##      </summary>
3936 ## </param>
3937 #
3938 interface(`userdom_set_rlimitnh',`
3939         gen_require(`
3940                 attribute userdomain;
3941         ')
3942
3943         allow $1 userdomain:process rlimitinh;
3944 ')
3945
3946 ########################################
3947 ## <summary>
3948 ##      Define this type as a Allow apps to set rlimits on userdomain
3949 ## </summary>
3950 ## <param name="domain">
3951 ##      <summary>
3952 ##      Domain allowed access.
3953 ##      </summary>
3954 ## </param>
3955 ## <param name="userdomain_prefix">
3956 ##      <summary>
3957 ##      The prefix of the user domain (e.g., user
3958 ##      is the prefix for user_t).
3959 ## </summary>
3960 ## </param>
3961 ## <param name="domain">
3962 ##      <summary>
3963 ##      Domain allowed access.
3964 ##      </summary>
3965 ## </param>
3966 #
3967 template(`userdom_unpriv_usertype',`
3968         gen_require(`
3969                 attribute unpriv_userdomain, userdomain;
3970                 attribute $1_usertype;
3971         ')
3972         typeattribute $2  $1_usertype;
3973         typeattribute $2  unpriv_userdomain;
3974         typeattribute $2  userdomain;
3975
3976         auth_use_nsswitch($2)
3977         ubac_constrained($2)
3978 ')
3979
3980 ########################################
3981 ## <summary>
3982 ##      Connect to users over an unix stream socket.
3983 ## </summary>
3984 ## <param name="domain">
3985 ##      <summary>
3986 ##      Domain allowed access.
3987 ##      </summary>
3988 ## </param>
3989 #
3990 interface(`userdom_stream_connect',`
3991         gen_require(`
3992                 type user_tmp_t;
3993                 attribute userdomain;
3994         ')
3995
3996         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3997 ')
3998
3999 ########################################
4000 ## <summary>
4001 ##      Ptrace user domains.
4002 ## </summary>
4003 ## <param name="domain">
4004 ##      <summary>
4005 ##      Domain allowed access.
4006 ##      </summary>
4007 ## </param>
4008 #
4009 interface(`userdom_ptrace_all_users',`
4010         gen_require(`
4011                 attribute userdomain;
4012         ')
4013
4014         allow $1 userdomain:process ptrace;
4015 ')
4016
4017 ########################################
4018 ## <summary>
4019 ##      dontaudit Search /root
4020 ## </summary>
4021 ## <param name="domain">
4022 ##      <summary>
4023 ##      Domain to not audit.
4024 ##      </summary>
4025 ## </param>
4026 #
4027 interface(`userdom_dontaudit_search_admin_dir',`
4028         gen_require(`
4029                 type admin_home_t;
4030         ')
4031
4032         dontaudit $1 admin_home_t:dir search_dir_perms;
4033 ')
4034
4035 ########################################
4036 ## <summary>
4037 ##      dontaudit list /root
4038 ## </summary>
4039 ## <param name="domain">
4040 ##      <summary>
4041 ##      Domain to not audit.
4042 ##      </summary>
4043 ## </param>
4044 #
4045 interface(`userdom_dontaudit_list_admin_dir',`
4046         gen_require(`
4047                 type admin_home_t;
4048         ')
4049
4050         dontaudit $1 admin_home_t:dir list_dir_perms;
4051 ')
4052
4053 ########################################
4054 ## <summary>
4055 ##      Allow domain to  list /root
4056 ## </summary>
4057 ## <param name="domain">
4058 ##      <summary>
4059 ##      Domain allowed access.
4060 ##      </summary>
4061 ## </param>
4062 #
4063 interface(`userdom_list_admin_dir',`
4064         gen_require(`
4065                 type admin_home_t;
4066         ')
4067
4068         allow $1 admin_home_t:dir list_dir_perms;
4069 ')
4070
4071 ########################################
4072 ## <summary>
4073 ##      Allow Search /root
4074 ## </summary>
4075 ## <param name="domain">
4076 ##      <summary>
4077 ##      Domain allowed access.
4078 ##      </summary>
4079 ## </param>
4080 #
4081 interface(`userdom_search_admin_dir',`
4082         gen_require(`
4083                 type admin_home_t;
4084         ')
4085
4086         allow $1 admin_home_t:dir search_dir_perms;
4087 ')
4088
4089 ########################################
4090 ## <summary>
4091 ##      RW unpriviledged user SysV sempaphores.
4092 ## </summary>
4093 ## <param name="domain">
4094 ##      <summary>
4095 ##      Domain allowed access.
4096 ##      </summary>
4097 ## </param>
4098 #
4099 interface(`userdom_rw_semaphores',`
4100         gen_require(`
4101                 attribute unpriv_userdomain;
4102         ')
4103
4104         allow $1 unpriv_userdomain:sem rw_sem_perms;
4105 ')
4106
4107 ########################################
4108 ## <summary>
4109 ##      Send a message to unpriv users over a unix domain
4110 ##      datagram socket.
4111 ## </summary>
4112 ## <param name="domain">
4113 ##      <summary>
4114 ##      Domain allowed access.
4115 ##      </summary>
4116 ## </param>
4117 #
4118 interface(`userdom_dgram_send',`
4119         gen_require(`
4120                 attribute unpriv_userdomain;
4121         ')
4122
4123         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4124 ')
4125
4126 ######################################
4127 ## <summary>
4128 ##      Send a message to users over a unix domain
4129 ##      datagram socket.
4130 ## </summary>
4131 ## <param name="domain">
4132 ##      <summary>
4133 ##      Domain allowed access.
4134 ##      </summary>
4135 ## </param>
4136 #
4137 interface(`userdom_users_dgram_send',`
4138         gen_require(`
4139                  attribute userdomain;
4140       ')
4141
4142        allow $1 userdomain:unix_dgram_socket sendto;
4143 ')
4144
4145 #######################################
4146 ## <summary>
4147 ##      Allow execmod on files in homedirectory
4148 ## </summary>
4149 ## <param name="domain">
4150 ##      <summary>
4151 ##      Domain allowed access.
4152 ##      </summary>
4153 ## </param>
4154 ## <rolebase/>
4155 #
4156 interface(`userdom_execmod_user_home_files',`
4157         gen_require(`
4158                 type user_home_type;
4159         ')
4160
4161         allow $1 user_home_type:file execmod;
4162 ')
4163
4164 ########################################
4165 ## <summary>
4166 ##      Read admin home files.
4167 ## </summary>
4168 ## <param name="domain">
4169 ##      <summary>
4170 ##      Domain allowed access.
4171 ##      </summary>
4172 ## </param>
4173 ## <rolecap/>
4174 #
4175 interface(`userdom_read_admin_home_files',`
4176         gen_require(`
4177                 type admin_home_t;
4178         ')
4179
4180         read_files_pattern($1, admin_home_t, admin_home_t)
4181 ')
4182
4183 ########################################
4184 ## <summary>
4185 ##      Execute admin home files.
4186 ## </summary>
4187 ## <param name="domain">
4188 ##      <summary>
4189 ##      Domain allowed access.
4190 ##      </summary>
4191 ## </param>
4192 ## <rolecap/>
4193 #
4194 interface(`userdom_exec_admin_home_files',`
4195         gen_require(`
4196                 type admin_home_t;
4197         ')
4198
4199         exec_files_pattern($1, admin_home_t, admin_home_t)
4200 ')
4201
4202 ########################################
4203 ## <summary>
4204 ##      Append files inherited
4205 ##      in the /root directory.
4206 ## </summary>
4207 ## <param name="domain">
4208 ##      <summary>
4209 ##      Domain allowed access.
4210 ##      </summary>
4211 ## </param>
4212 #
4213 interface(`userdom_inherit_append_admin_home_files',`
4214         gen_require(`
4215                 type admin_home_t;
4216         ')
4217
4218         allow $1 admin_home_t:file { getattr append };
4219 ')
4220
4221
4222 #######################################
4223 ## <summary>
4224 ##      Manage all files/directories in the homedir
4225 ## </summary>
4226 ## <param name="userdomain">
4227 ##      <summary>
4228 ##      The user domain
4229 ##      </summary>
4230 ## </param>
4231 ## <rolebase/>
4232 #
4233 interface(`userdom_manage_user_home_content',`
4234         gen_require(`
4235                 type user_home_dir_t, user_home_t;
4236                 attribute user_home_type;
4237         ')
4238
4239         files_list_home($1)
4240         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4241         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4242         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4243         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4244         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4245         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4246
4247 ')
4248
4249
4250 ########################################
4251 ## <summary>
4252 ##      Create objects in a user home directory
4253 ##      with an automatic type transition to
4254 ##      the user home file type.
4255 ## </summary>
4256 ## <param name="domain">
4257 ##      <summary>
4258 ##      Domain allowed access.
4259 ##      </summary>
4260 ## </param>
4261 ## <param name="object_class">
4262 ##      <summary>
4263 ##      The class of the object to be created.
4264 ##      </summary>
4265 ## </param>
4266 #
4267 interface(`userdom_user_home_dir_filetrans_pattern',`
4268         gen_require(`
4269                 type user_home_dir_t, user_home_t;
4270         ')
4271
4272         type_transition $1 user_home_dir_t:$2 user_home_t;
4273 ')
4274
4275 ########################################
4276 ## <summary>
4277 ##      Create objects in the /root directory
4278 ##      with an automatic type transition to
4279 ##      a specified private type.
4280 ## </summary>
4281 ## <param name="domain">
4282 ##      <summary>
4283 ##      Domain allowed access.
4284 ##      </summary>
4285 ## </param>
4286 ## <param name="private_type">
4287 ##      <summary>
4288 ##      The type of the object to create.
4289 ##      </summary>
4290 ## </param>
4291 ## <param name="object_class">
4292 ##      <summary>
4293 ##      The class of the object to be created.
4294 ##      </summary>
4295 ## </param>
4296 #
4297 interface(`userdom_admin_home_dir_filetrans',`
4298         gen_require(`
4299                 type admin_home_t;
4300         ')
4301
4302         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4303 ')
4304
4305 ########################################
4306 ## <summary>
4307 ##      Send signull to unprivileged user domains.
4308 ## </summary>
4309 ## <param name="domain">
4310 ##      <summary>
4311 ##      Domain allowed access.
4312 ##      </summary>
4313 ## </param>
4314 #
4315 interface(`userdom_signull_unpriv_users',`
4316         gen_require(`
4317                 attribute unpriv_userdomain;
4318         ')
4319
4320         allow $1 unpriv_userdomain:process signull;
4321 ')
4322
4323 ########################################
4324 ## <summary>
4325 ##      Write all users files in /tmp
4326 ## </summary>
4327 ## <param name="domain">
4328 ##      <summary>
4329 ##      Domain allowed access.
4330 ##      </summary>
4331 ## </param>
4332 #
4333 interface(`userdom_write_user_tmp_dirs',`
4334         gen_require(`
4335                 type user_tmp_t;
4336         ')
4337
4338         write_files_pattern($1, user_tmp_t, user_tmp_t)
4339 ')
4340
4341 ########################################
4342 ## <summary>
4343 ##      Manage keys for all user domains.
4344 ## </summary>
4345 ## <param name="domain">
4346 ##      <summary>
4347 ##      Domain allowed access.
4348 ##      </summary>
4349 ## </param>
4350 #
4351 interface(`userdom_manage_all_users_keys',`
4352         gen_require(`
4353                 attribute userdomain;
4354         ')
4355
4356         allow $1 userdomain:key manage_key_perms;
4357 ')
4358
4359
4360 ########################################
4361 ## <summary>
4362 ##      Do not audit attempts to read and write
4363 ##      unserdomain stream.
4364 ## </summary>
4365 ## <param name="domain">
4366 ##      <summary>
4367 ##      Domain to not audit.
4368 ##      </summary>
4369 ## </param>
4370 #
4371 interface(`userdom_dontaudit_rw_stream',`
4372         gen_require(`
4373                 attribute userdomain;
4374         ')
4375
4376         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4377 ')
4378
4379 ########################################
4380 ## <summary>
4381 ##      Do not audit attempts to read and write
4382 ##      unserdomain datagram socket.
4383 ## </summary>
4384 ## <param name="domain">
4385 ##      <summary>
4386 ##      Domain to not audit.
4387 ##      </summary>
4388 ## </param>
4389 #
4390 interface(`userdom_dontaudit_rw_dgram_socket',`
4391         gen_require(`
4392                 attribute userdomain;
4393         ')
4394
4395         dontaudit $1 userdomain:unix_dgram_socket { read write };
4396 ')
4397
4398 ########################################
4399 ## <summary>
4400 ##      Append files
4401 ##      in a user home subdirectory.
4402 ## </summary>
4403 ## <param name="domain">
4404 ##      <summary>
4405 ##      Domain allowed access.
4406 ##      </summary>
4407 ## </param>
4408 #
4409 interface(`userdom_append_user_home_content_files',`
4410         gen_require(`
4411                 type user_home_dir_t, user_home_t;
4412         ')
4413
4414         append_files_pattern($1, user_home_t, user_home_t)
4415         allow $1 user_home_dir_t:dir search_dir_perms;
4416         files_search_home($1)
4417 ')
4418
4419 ########################################
4420 ## <summary>
4421 ##      Read files inherited
4422 ##      in a user home subdirectory.
4423 ## </summary>
4424 ## <param name="domain">
4425 ##      <summary>
4426 ##      Domain allowed access.
4427 ##      </summary>
4428 ## </param>
4429 #
4430 interface(`userdom_read_inherited_user_home_content_files',`
4431         gen_require(`
4432                 attribute user_home_type;
4433         ')
4434
4435         allow $1 user_home_type:file { getattr read };
4436 ')
4437
4438 ########################################
4439 ## <summary>
4440 ##      Append files inherited
4441 ##      in a user home subdirectory.
4442 ## </summary>
4443 ## <param name="domain">
4444 ##      <summary>
4445 ##      Domain allowed access.
4446 ##      </summary>
4447 ## </param>
4448 #
4449 interface(`userdom_inherit_append_user_home_content_files',`
4450         gen_require(`
4451                 type user_home_t;
4452         ')
4453
4454         allow $1 user_home_t:file { getattr append };
4455 ')
4456
4457 ########################################
4458 ## <summary>
4459 ##      Append files inherited
4460 ##      in a user tmp files.
4461 ## </summary>
4462 ## <param name="domain">
4463 ##      <summary>
4464 ##      Domain allowed access.
4465 ##      </summary>
4466 ## </param>
4467 #
4468 interface(`userdom_inherit_append_user_tmp_files',`
4469         gen_require(`
4470                 type user_tmp_t;
4471         ')
4472
4473         allow $1 user_tmp_t:file { getattr append };
4474 ')
4475
4476 ######################################
4477 ## <summary>
4478 ##      Read audio files in the users homedir.
4479 ## </summary>
4480 ## <param name="domain">
4481 ##      <summary>
4482 ##      Domain allowed access.
4483 ##      </summary>
4484 ## </param>
4485 ## <rolecap/>
4486 #
4487 interface(`userdom_read_home_audio_files',`
4488         gen_require(`
4489                 type audio_home_t;
4490         ')
4491
4492         userdom_search_user_home_dirs($1)
4493         allow $1 audio_home_t:dir list_dir_perms;
4494         read_files_pattern($1, audio_home_t, audio_home_t)
4495         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4496 ')
4497
4498 ########################################
4499 ## <summary>
4500 ##      Do not audit attempts to write all user home content files.
4501 ## </summary>
4502 ## <param name="domain">
4503 ##      <summary>
4504 ##      Domain to not audit.
4505 ##      </summary>
4506 ## </param>
4507 #
4508 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4509         gen_require(`
4510                 attribute user_home_type;
4511         ')
4512
4513         dontaudit $1 user_home_type:file write_file_perms;
4514 ')
4515
4516 ########################################
4517 ## <summary>
4518 ##      Do not audit attempts to write all user tmp content files.
4519 ## </summary>
4520 ## <param name="domain">
4521 ##      <summary>
4522 ##      Domain to not audit.
4523 ##      </summary>
4524 ## </param>
4525 #
4526 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4527         gen_require(`
4528                 attribute user_tmp_type;
4529         ')
4530
4531         dontaudit $1 user_tmp_type:file write_file_perms;
4532 ')
4533
4534 ########################################
4535 ## <summary>
4536 ##      Manage all user temporary content.
4537 ## </summary>
4538 ## <param name="domain">
4539 ##      <summary>
4540 ##      Domain allowed access.
4541 ##      </summary>
4542 ## </param>
4543 #
4544 interface(`userdom_manage_all_user_tmp_content',`
4545         gen_require(`
4546                 attribute user_tmp_type;
4547         ')
4548
4549         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4550         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4551         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4552         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4553         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4554         files_search_tmp($1)
4555 ')
4556
4557 ########################################
4558 ## <summary>
4559 ##      List all user temporary content.
4560 ## </summary>
4561 ## <param name="domain">
4562 ##      <summary>
4563 ##      Domain allowed access.
4564 ##      </summary>
4565 ## </param>
4566 #
4567 interface(`userdom_list_all_user_tmp_content',`
4568         gen_require(`
4569                 attribute user_tmp_type;
4570         ')
4571
4572         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4573         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4574         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4575         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4576         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4577         files_search_var($1)
4578         files_search_tmp($1)
4579 ')
4580
4581 ########################################
4582 ## <summary>
4583 ##      Manage all user tmpfs content.
4584 ## </summary>
4585 ## <param name="domain">
4586 ##      <summary>
4587 ##      Domain allowed access.
4588 ##      </summary>
4589 ## </param>
4590 #
4591 interface(`userdom_manage_all_user_tmpfs_content',`
4592         gen_require(`
4593                 attribute user_tmpfs_type;
4594         ')
4595
4596         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4597         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4598         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4599         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4600         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4601         fs_search_tmpfs($1)
4602 ')
4603
4604 ########################################
4605 ## <summary>
4606 ##      Delete all user temporary content.
4607 ## </summary>
4608 ## <param name="domain">
4609 ##      <summary>
4610 ##      Domain allowed access.
4611 ##      </summary>
4612 ## </param>
4613 #
4614 interface(`userdom_delete_all_user_tmp_content',`
4615         gen_require(`
4616                 attribute user_tmp_type;
4617         ')
4618
4619         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4620         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4621         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4622         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4623         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4624         # /var/tmp
4625         files_search_var($1)
4626         files_delete_tmp_dir_entry($1)
4627 ')
4628
4629 ########################################
4630 ## <summary>
4631 ##      Read system SSL certificates in the users homedir.
4632 ## </summary>
4633 ## <param name="domain">
4634 ##      <summary>
4635 ##      Domain allowed access.
4636 ##      </summary>
4637 ## </param>
4638 #
4639 interface(`userdom_read_home_certs',`
4640         gen_require(`
4641                 type home_cert_t;
4642         ')
4643
4644         userdom_search_user_home_content($1)
4645         allow $1 home_cert_t:dir list_dir_perms;
4646         read_files_pattern($1, home_cert_t, home_cert_t)
4647         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4648 ')
4649
4650 ########################################
4651 ## <summary>
4652 ##      Manage system SSL certificates in the users homedir.
4653 ## </summary>
4654 ## <param name="domain">
4655 ##      <summary>
4656 ##      Domain allowed access.
4657 ##      </summary>
4658 ## </param>
4659 #
4660 interface(`userdom_manage_home_certs',`
4661         gen_require(`
4662                 type home_cert_t;
4663         ')
4664
4665         allow $1 home_cert_t:dir list_dir_perms;
4666         manage_files_pattern($1, home_cert_t, home_cert_t)
4667         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4668
4669         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4670         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4671 ')
4672
4673 #######################################
4674 ## <summary>
4675 ##  Dontaudit Write system SSL certificates in the users homedir.
4676 ## </summary>
4677 ## <param name="domain">
4678 ##  <summary>
4679 ##      Domain to not audit.
4680 ##  </summary>
4681 ## </param>
4682 #
4683 interface(`userdom_dontaudit_write_home_certs',`
4684     gen_require(`
4685         type home_cert_t;
4686     ')
4687
4688     dontaudit $1 home_cert_t:file write;
4689 ')
4690
4691 ########################################
4692 ## <summary>
4693 ##      dontaudit Search getatrr /root files
4694 ## </summary>
4695 ## <param name="domain">
4696 ##      <summary>
4697 ##      Domain to not audit.
4698 ##      </summary>
4699 ## </param>
4700 #
4701 interface(`userdom_dontaudit_getattr_admin_home_files',`
4702         gen_require(`
4703                 type admin_home_t;
4704         ')
4705
4706         dontaudit $1 admin_home_t:file getattr;
4707 ')
4708
4709 ########################################
4710 ## <summary>
4711 ##      dontaudit read /root lnk files
4712 ## </summary>
4713 ## <param name="domain">
4714 ##      <summary>
4715 ##      Domain to not audit.
4716 ##      </summary>
4717 ## </param>
4718 #
4719 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4720         gen_require(`
4721                 type admin_home_t;
4722         ')
4723
4724         dontaudit $1 admin_home_t:lnk_file read;
4725 ')
4726
4727 ########################################
4728 ## <summary>
4729 ##      dontaudit read /root files
4730 ## </summary>
4731 ## <param name="domain">
4732 ##      <summary>
4733 ##      Domain to not audit.
4734 ##      </summary>
4735 ## </param>
4736 #
4737 interface(`userdom_dontaudit_read_admin_home_files',`
4738         gen_require(`
4739                 type admin_home_t;
4740         ')
4741
4742         dontaudit $1 admin_home_t:file read_file_perms;
4743 ')
4744
4745 ########################################
4746 ## <summary>
4747 ##      Create, read, write, and delete user
4748 ##      temporary chr files.
4749 ## </summary>
4750 ## <param name="domain">
4751 ##      <summary>
4752 ##      Domain allowed access.
4753 ##      </summary>
4754 ## </param>
4755 #
4756 interface(`userdom_manage_user_tmp_chr_files',`
4757         gen_require(`
4758                 type user_tmp_t;
4759         ')
4760
4761         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4762         files_search_tmp($1)
4763 ')
4764
4765 ########################################
4766 ## <summary>
4767 ##      Create, read, write, and delete user
4768 ##      temporary blk files.
4769 ## </summary>
4770 ## <param name="domain">
4771 ##      <summary>
4772 ##      Domain allowed access.
4773 ##      </summary>
4774 ## </param>
4775 #
4776 interface(`userdom_manage_user_tmp_blk_files',`
4777         gen_require(`
4778                 type user_tmp_t;
4779         ')
4780
4781         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4782         files_search_tmp($1)
4783 ')
4784
4785 ########################################
4786 ## <summary>
4787 ##      Dontaudit attempt to set attributes on  user temporary directories.
4788 ## </summary>
4789 ## <param name="domain">
4790 ##      <summary>
4791 ##      Domain to not audit.
4792 ##      </summary>
4793 ## </param>
4794 #
4795 interface(`userdom_dontaudit_setattr_user_tmp',`
4796         gen_require(`
4797                 type user_tmp_t;
4798         ')
4799
4800         dontaudit $1 user_tmp_t:dir setattr;
4801 ')
4802
4803 ########################################
4804 ## <summary>
4805 ##      Read all inherited users files in /tmp
4806 ## </summary>
4807 ## <param name="domain">
4808 ##      <summary>
4809 ##      Domain allowed access.
4810 ##      </summary>
4811 ## </param>
4812 #
4813 interface(`userdom_read_inherited_user_tmp_files',`
4814         gen_require(`
4815                 type user_tmp_t;
4816         ')
4817
4818         allow $1 user_tmp_t:file read_inherited_file_perms;
4819 ')
4820
4821 ########################################
4822 ## <summary>
4823 ##      Write all inherited users files in /tmp
4824 ## </summary>
4825 ## <param name="domain">
4826 ##      <summary>
4827 ##      Domain allowed access.
4828 ##      </summary>
4829 ## </param>
4830 #
4831 interface(`userdom_write_inherited_user_tmp_files',`
4832         gen_require(`
4833                 type user_tmp_t;
4834         ')
4835
4836         allow $1 user_tmp_t:file write;
4837 ')
4838
4839 ########################################
4840 ## <summary>
4841 ##      Delete all users files in /tmp
4842 ## </summary>
4843 ## <param name="domain">
4844 ##      <summary>
4845 ##      Domain allowed access.
4846 ##      </summary>
4847 ## </param>
4848 #
4849 interface(`userdom_delete_user_tmp_files',`
4850         gen_require(`
4851                 type user_tmp_t;
4852         ')
4853
4854         allow $1 user_tmp_t:file delete_file_perms;
4855 ')
4856
4857 ########################################
4858 ## <summary>
4859 ##      Delete user tmpfs files.
4860 ## </summary>
4861 ## <param name="domain">
4862 ##      <summary>
4863 ##      Domain allowed access.
4864 ##      </summary>
4865 ## </param>
4866 #
4867 interface(`userdom_delete_user_tmpfs_files',`
4868         gen_require(`
4869                 type user_tmpfs_t;
4870         ')
4871
4872         allow $1 user_tmpfs_t:file delete_file_perms;
4873 ')
4874
4875 ########################################
4876 ## <summary>
4877 ##      Read/Write unpriviledged user SysV shared
4878 ##      memory segments.
4879 ## </summary>
4880 ## <param name="domain">
4881 ##      <summary>
4882 ##      Domain allowed access.
4883 ##      </summary>
4884 ## </param>
4885 #
4886 interface(`userdom_rw_unpriv_user_shared_mem',`
4887         gen_require(`
4888                 attribute unpriv_userdomain;
4889         ')
4890
4891         allow $1 unpriv_userdomain:shm rw_shm_perms;
4892 ')
4893
4894 ########################################
4895 ## <summary>
4896 ##      Do not audit attempts to search user
4897 ##      temporary directories.
4898 ## </summary>
4899 ## <param name="domain">
4900 ##      <summary>
4901 ##      Domain to not audit.
4902 ##      </summary>
4903 ## </param>
4904 #
4905 interface(`userdom_dontaudit_search_user_tmp',`
4906         gen_require(`
4907                 type user_tmp_t;
4908         ')
4909
4910         dontaudit $1 user_tmp_t:dir search_dir_perms;
4911 ')
4912
4913 ########################################
4914 ## <summary>
4915 ##      Execute a file in a user home directory
4916 ##      in the specified domain.
4917 ## </summary>
4918 ## <desc>
4919 ##      <p>
4920 ##      Execute a file in a user home directory
4921 ##      in the specified domain.
4922 ##      </p>
4923 ##      <p>
4924 ##      No interprocess communication (signals, pipes,
4925 ##      etc.) is provided by this interface since
4926 ##      the domains are not owned by this module.
4927 ##      </p>
4928 ## </desc>
4929 ## <param name="domain">
4930 ##      <summary>
4931 ##      Domain allowed access.
4932 ##      </summary>
4933 ## </param>
4934 ## <param name="target_domain">
4935 ##      <summary>
4936 ##      The type of the new process.
4937 ##      </summary>
4938 ## </param>
4939 #
4940 interface(`userdom_domtrans_user_home',`
4941         gen_require(`
4942                 type user_home_t;
4943         ')
4944
4945         read_lnk_files_pattern($1, user_home_t, user_home_t)
4946         domain_transition_pattern($1, user_home_t, $2)
4947         type_transition $1 user_home_t:process $2;
4948 ')
4949
4950 ########################################
4951 ## <summary>
4952 ##      Execute a file in a user tmp directory
4953 ##      in the specified domain.
4954 ## </summary>
4955 ## <desc>
4956 ##      <p>
4957 ##      Execute a file in a user tmp directory
4958 ##      in the specified domain.
4959 ##      </p>
4960 ##      <p>
4961 ##      No interprocess communication (signals, pipes,
4962 ##      etc.) is provided by this interface since
4963 ##      the domains are not owned by this module.
4964 ##      </p>
4965 ## </desc>
4966 ## <param name="domain">
4967 ##      <summary>
4968 ##      Domain allowed access.
4969 ##      </summary>
4970 ## </param>
4971 ## <param name="target_domain">
4972 ##      <summary>
4973 ##      The type of the new process.
4974 ##      </summary>
4975 ## </param>
4976 #
4977 interface(`userdom_domtrans_user_tmp',`
4978         gen_require(`
4979                 type user_tmp_t;
4980         ')
4981
4982         files_search_tmp($1)
4983         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4984         domain_transition_pattern($1, user_tmp_t, $2)
4985         type_transition $1 user_tmp_t:process $2;
4986 ')
4987
4988 ########################################
4989 ## <summary>
4990 ##      Do not audit attempts to read all user home content files.
4991 ## </summary>
4992 ## <param name="domain">
4993 ##      <summary>
4994 ##      Domain to not audit.
4995 ##      </summary>
4996 ## </param>
4997 #
4998 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4999         gen_require(`
5000                 attribute user_home_type;
5001         ')
5002
5003         dontaudit $1 user_home_type:file read_file_perms;
5004 ')
5005
5006 ########################################
5007 ## <summary>
5008 ##      Do not audit attempts to read all user tmp content files.
5009 ## </summary>
5010 ## <param name="domain">
5011 ##      <summary>
5012 ##      Domain to not audit.
5013 ##      </summary>
5014 ## </param>
5015 #
5016 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5017         gen_require(`
5018                 attribute user_tmp_type;
5019         ')
5020
5021         dontaudit $1 user_tmp_type:file read_file_perms;
5022 ')
5023
5024 #######################################
5025 ## <summary>
5026 ## Read and write unpriviledged user SysV sempaphores.
5027 ## </summary>
5028 ## <param name="domain">
5029 ## <summary>
5030 ## Domain allowed access.
5031 ## </summary>
5032 ## </param>
5033 #
5034 interface(`userdom_rw_unpriv_user_semaphores',`
5035    gen_require(`
5036        attribute unpriv_userdomain;
5037    ')
5038
5039    allow $1 unpriv_userdomain:sem rw_sem_perms;
5040 ')
5041
5042 ########################################
5043 ## <summary>
5044 ##      Transition to userdom named content
5045 ## </summary>
5046 ## <param name="domain">
5047 ##      <summary>
5048 ##      Domain allowed access.
5049 ##      </summary>
5050 ## </param>
5051 #
5052 interface(`userdom_filetrans_home_content',`
5053         gen_require(`
5054                 type home_bin_t, home_cert_t;
5055                 type audio_home_t;
5056         ')
5057
5058         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5059         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5060         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5061         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5062         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5063
5064         #optional_policy(`
5065         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5066         #')
5067 ')