policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33
  34         type $1_t, userdomain;
  35         domain_type($1_t)
  36         corecmd_shell_entry_type($1_t)
  37         corecmd_bin_entry_type($1_t)
  38         domain_user_exemption_target($1_t)
  39         ubac_constrained($1_t)
  40         role $1_r types $1_t;
  41         allow system_r $1_r;
  42
  43         term_user_pty($1_t, user_devpts_t)
  44
  45         term_user_tty($1_t, user_tty_device_t)
  46
  47         allow $1_t self:process { signal_perms getsched setsched share getpgid setpgid setcap getsession getattr };
  48         allow $1_t self:fd use;
  49         allow $1_t self:fifo_file rw_fifo_file_perms;
  50         allow $1_t self:unix_dgram_socket { create_socket_perms sendto };
  51         allow $1_t self:unix_stream_socket { create_stream_socket_perms connectto };
  52         allow $1_t self:shm create_shm_perms;
  53         allow $1_t self:sem create_sem_perms;
  54         allow $1_t self:msgq create_msgq_perms;
  55         allow $1_t self:msg { send receive };
  56         allow $1_t self:context contains;
  57         dontaudit $1_t self:socket create;
  58
  59         allow $1_t user_devpts_t:chr_file { setattr rw_chr_file_perms };
  60         term_create_pty($1_t, user_devpts_t)
  61         # avoid annoying messages on terminal hangup on role change
  62         dontaudit $1_t user_devpts_t:chr_file ioctl;
  63
  64         allow $1_t user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_t user_tty_device_t:chr_file ioctl;
  67
  68         kernel_read_kernel_sysctls($1_t)
  69         kernel_dontaudit_list_unlabeled($1_t)
  70         kernel_dontaudit_getattr_unlabeled_files($1_t)
  71         kernel_dontaudit_getattr_unlabeled_symlinks($1_t)
  72         kernel_dontaudit_getattr_unlabeled_pipes($1_t)
  73         kernel_dontaudit_getattr_unlabeled_sockets($1_t)
  74         kernel_dontaudit_getattr_unlabeled_blk_files($1_t)
  75         kernel_dontaudit_getattr_unlabeled_chr_files($1_t)
  76
  77         dev_dontaudit_getattr_all_blk_files($1_t)
  78         dev_dontaudit_getattr_all_chr_files($1_t)
  79
  80         # When the user domain runs ps, there will be a number of access
  81         # denials when ps tries to search /proc. Do not audit these denials.
  82         domain_dontaudit_read_all_domains_state($1_t)
  83         domain_dontaudit_getattr_all_domains($1_t)
  84         domain_dontaudit_getsession_all_domains($1_t)
  85
  86         files_read_etc_files($1_t)
  87         files_read_etc_runtime_files($1_t)
  88         files_read_usr_files($1_t)
  89         # Read directories and files with the readable_t type.
  90         # This type is a general type for "world"-readable files.
  91         files_list_world_readable($1_t)
  92         files_read_world_readable_files($1_t)
  93         files_read_world_readable_symlinks($1_t)
  94         files_read_world_readable_pipes($1_t)
  95         files_read_world_readable_sockets($1_t)
  96         # old broswer_domain():
  97         files_dontaudit_list_non_security($1_t)
  98         files_dontaudit_getattr_non_security_files($1_t)
  99         files_dontaudit_getattr_non_security_symlinks($1_t)
 100         files_dontaudit_getattr_non_security_pipes($1_t)
 101         files_dontaudit_getattr_non_security_sockets($1_t)
 102
 103         libs_exec_ld_so($1_t)
 104
 105         miscfiles_read_localization($1_t)
 106         miscfiles_read_generic_certs($1_t)
 107
 108         sysnet_read_config($1_t)
 109
 110         tunable_policy(`allow_execmem',`
 111                 # Allow loading DSOs that require executable stack.
 112                 allow $1_t self:process execmem;
 113         ')
 114
 115         tunable_policy(`allow_execmem && allow_execstack',`
 116                 # Allow making the stack executable via mprotect.
 117                 allow $1_t self:process execstack;
 118         ')
 119 ')
 120
 121 #######################################
 122 ## <summary>
 123 ##      Allow a home directory for which the
 124 ##      role has read-only access.
 125 ## </summary>
 126 ## <desc>
 127 ##      <p>
 128 ##      Allow a home directory for which the
 129 ##      role has read-only access.
 130 ##      </p>
 131 ##      <p>
 132 ##      This does not allow execute access.
 133 ##      </p>
 134 ## </desc>
 135 ## <param name="role">
 136 ##      <summary>
 137 ##      The user role
 138 ##      </summary>
 139 ## </param>
 140 ## <param name="userdomain">
 141 ##      <summary>
 142 ##      The user domain
 143 ##      </summary>
 144 ## </param>
 145 ## <rolebase/>
 146 #
 147 interface(`userdom_ro_home_role',`
 148         gen_require(`
 149                 type user_home_t, user_home_dir_t;
 150         ')
 151
 152         ##############################
 153         #
 154         # Domain access to home dir
 155         #
 156
 157         type_member $2 user_home_dir_t:dir user_home_dir_t;
 158
 159         # read-only home directory
 160         allow $2 user_home_dir_t:dir list_dir_perms;
 161         allow $2 user_home_t:dir list_dir_perms;
 162         allow $2 user_home_t:file entrypoint;
 163         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 164         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 165         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 166         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 167         files_list_home($2)
 168
 169         tunable_policy(`use_nfs_home_dirs',`
 170                 fs_list_nfs($2)
 171                 fs_read_nfs_files($2)
 172                 fs_read_nfs_symlinks($2)
 173                 fs_read_nfs_named_sockets($2)
 174                 fs_read_nfs_named_pipes($2)
 175         ',`
 176                 fs_dontaudit_list_nfs($2)
 177                 fs_dontaudit_read_nfs_files($2)
 178         ')
 179
 180         tunable_policy(`use_samba_home_dirs',`
 181                 fs_list_cifs($2)
 182                 fs_read_cifs_files($2)
 183                 fs_read_cifs_symlinks($2)
 184                 fs_read_cifs_named_sockets($2)
 185                 fs_read_cifs_named_pipes($2)
 186         ',`
 187                 fs_dontaudit_list_cifs($2)
 188                 fs_dontaudit_read_cifs_files($2)
 189         ')
 190 ')
 191
 192 #######################################
 193 ## <summary>
 194 ##      Allow a home directory for which the
 195 ##      role has full access.
 196 ## </summary>
 197 ## <desc>
 198 ##      <p>
 199 ##      Allow a home directory for which the
 200 ##      role has full access.
 201 ##      </p>
 202 ##      <p>
 203 ##      This does not allow execute access.
 204 ##      </p>
 205 ## </desc>
 206 ## <param name="role">
 207 ##      <summary>
 208 ##      The user role
 209 ##      </summary>
 210 ## </param>
 211 ## <param name="userdomain">
 212 ##      <summary>
 213 ##      The user domain
 214 ##      </summary>
 215 ## </param>
 216 ## <rolebase/>
 217 #
 218 interface(`userdom_manage_home_role',`
 219         gen_require(`
 220                 type user_home_t, user_home_dir_t;
 221         ')
 222
 223         ##############################
 224         #
 225         # Domain access to home dir
 226         #
 227
 228         type_member $2 user_home_dir_t:dir user_home_dir_t;
 229
 230         # full control of the home directory
 231         allow $2 user_home_t:file entrypoint;
 232         manage_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 233         manage_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 234         manage_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 235         manage_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 236         manage_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 237         relabel_dirs_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 238         relabel_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 239         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 240         relabel_sock_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 241         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_t }, user_home_t)
 242         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 243         files_list_home($2)
 244
 245         # cjp: this should probably be removed:
 246         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 247
 248         tunable_policy(`use_nfs_home_dirs',`
 249                 fs_manage_nfs_dirs($2)
 250                 fs_manage_nfs_files($2)
 251                 fs_manage_nfs_symlinks($2)
 252                 fs_manage_nfs_named_sockets($2)
 253                 fs_manage_nfs_named_pipes($2)
 254         ',`
 255                 fs_dontaudit_manage_nfs_dirs($2)
 256                 fs_dontaudit_manage_nfs_files($2)
 257         ')
 258
 259         tunable_policy(`use_samba_home_dirs',`
 260                 fs_manage_cifs_dirs($2)
 261                 fs_manage_cifs_files($2)
 262                 fs_manage_cifs_symlinks($2)
 263                 fs_manage_cifs_named_sockets($2)
 264                 fs_manage_cifs_named_pipes($2)
 265         ',`
 266                 fs_dontaudit_manage_cifs_dirs($2)
 267                 fs_dontaudit_manage_cifs_files($2)
 268         ')
 269 ')
 270
 271 #######################################
 272 ## <summary>
 273 ##      Manage user temporary files
 274 ## </summary>
 275 ## <param name="role">
 276 ##      <summary>
 277 ##      Role allowed access.
 278 ##      </summary>
 279 ## </param>
 280 ## <param name="domain">
 281 ##      <summary>
 282 ##      Domain allowed access.
 283 ##      </summary>
 284 ## </param>
 285 ## <rolebase/>
 286 #
 287 interface(`userdom_manage_tmp_role',`
 288         gen_require(`
 289                 type user_tmp_t;
 290         ')
 291
 292         files_poly_member_tmp($2, user_tmp_t)
 293
 294         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 295         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 296         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 297         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 298         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 299         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      The execute access user temporary files.
 305 ## </summary>
 306 ## <param name="domain">
 307 ##      <summary>
 308 ##      Domain allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <rolebase/>
 312 #
 313 interface(`userdom_exec_user_tmp_files',`
 314         gen_require(`
 315                 type user_tmp_t;
 316         ')
 317
 318         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 319         files_search_tmp($1)
 320 ')
 321
 322 #######################################
 323 ## <summary>
 324 ##      Role access for the user tmpfs type
 325 ##      that the user has full access.
 326 ## </summary>
 327 ## <desc>
 328 ##      <p>
 329 ##      Role access for the user tmpfs type
 330 ##      that the user has full access.
 331 ##      </p>
 332 ##      <p>
 333 ##      This does not allow execute access.
 334 ##      </p>
 335 ## </desc>
 336 ## <param name="role">
 337 ##      <summary>
 338 ##      Role allowed access.
 339 ##      </summary>
 340 ## </param>
 341 ## <param name="domain">
 342 ##      <summary>
 343 ##      Domain allowed access.
 344 ##      </summary>
 345 ## </param>
 346 ## <rolecap/>
 347 #
 348 interface(`userdom_manage_tmpfs_role',`
 349         gen_require(`
 350                 type user_tmpfs_t;
 351         ')
 352
 353         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 354         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 355         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 356         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 357         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 358         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 359 ')
 360
 361 #######################################
 362 ## <summary>
 363 ##      The template allowing the user basic
 364 ##      network permissions
 365 ## </summary>
 366 ## <param name="userdomain_prefix">
 367 ##      <summary>
 368 ##      The prefix of the user domain (e.g., user
 369 ##      is the prefix for user_t).
 370 ##      </summary>
 371 ## </param>
 372 ## <rolebase/>
 373 #
 374 template(`userdom_basic_networking_template',`
 375         gen_require(`
 376                 type $1_t;
 377         ')
 378
 379         allow $1_t self:tcp_socket create_stream_socket_perms;
 380         allow $1_t self:udp_socket create_socket_perms;
 381
 382         corenet_all_recvfrom_unlabeled($1_t)
 383         corenet_all_recvfrom_netlabel($1_t)
 384         corenet_tcp_sendrecv_generic_if($1_t)
 385         corenet_udp_sendrecv_generic_if($1_t)
 386         corenet_tcp_sendrecv_generic_node($1_t)
 387         corenet_udp_sendrecv_generic_node($1_t)
 388         corenet_tcp_sendrecv_all_ports($1_t)
 389         corenet_udp_sendrecv_all_ports($1_t)
 390         corenet_tcp_connect_all_ports($1_t)
 391         corenet_sendrecv_all_client_packets($1_t)
 392
 393         corenet_all_recvfrom_labeled($1_t, $1_t)
 394
 395         optional_policy(`
 396                 init_tcp_recvfrom_all_daemons($1_t)
 397                 init_udp_recvfrom_all_daemons($1_t)
 398         ')
 399
 400         optional_policy(`
 401                 ipsec_match_default_spd($1_t)
 402         ')
 403 ')
 404
 405 #######################################
 406 ## <summary>
 407 ##      The template for creating a user xwindows client.  (Deprecated)
 408 ## </summary>
 409 ## <param name="userdomain_prefix">
 410 ##      <summary>
 411 ##      The prefix of the user domain (e.g., user
 412 ##      is the prefix for user_t).
 413 ##      </summary>
 414 ## </param>
 415 ## <rolebase/>
 416 #
 417 template(`userdom_xwindows_client_template',`
 418         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 419         gen_require(`
 420                 type $1_t, user_tmpfs_t;
 421         ')
 422
 423         dev_rw_xserver_misc($1_t)
 424         dev_rw_power_management($1_t)
 425         dev_read_input($1_t)
 426         dev_read_misc($1_t)
 427         dev_write_misc($1_t)
 428         # open office is looking for the following
 429         dev_getattr_agp_dev($1_t)
 430         dev_dontaudit_rw_dri($1_t)
 431         # GNOME checks for usb and other devices:
 432         dev_rw_usbfs($1_t)
 433
 434         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 435         xserver_xsession_entry_type($1_t)
 436         xserver_dontaudit_write_log($1_t)
 437         xserver_stream_connect_xdm($1_t)
 438         # certain apps want to read xdm.pid file
 439         xserver_read_xdm_pid($1_t)
 440         # gnome-session creates socket under /tmp/.ICE-unix/
 441         xserver_create_xdm_tmp_sockets($1_t)
 442         # Needed for escd, remove if we get escd policy
 443         xserver_manage_xdm_tmp_files($1_t)
 444 ')
 445
 446 #######################################
 447 ## <summary>
 448 ##      The template for allowing the user to change passwords.
 449 ## </summary>
 450 ## <param name="userdomain_prefix">
 451 ##      <summary>
 452 ##      The prefix of the user domain (e.g., user
 453 ##      is the prefix for user_t).
 454 ##      </summary>
 455 ## </param>
 456 ## <rolebase/>
 457 #
 458 template(`userdom_change_password_template',`
 459         gen_require(`
 460                 type $1_t;
 461                 role $1_r;
 462         ')
 463
 464         optional_policy(`
 465                 usermanage_run_chfn($1_t, $1_r)
 466                 usermanage_run_passwd($1_t, $1_r)
 467         ')
 468 ')
 469
 470 #######################################
 471 ## <summary>
 472 ##      The template containing rules common to unprivileged
 473 ##      users and administrative users.
 474 ## </summary>
 475 ## <desc>
 476 ##      <p>
 477 ##      This template creates a user domain, types, and
 478 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 479 ##      </p>
 480 ## </desc>
 481 ## <param name="userdomain_prefix">
 482 ##      <summary>
 483 ##      The prefix of the user domain (e.g., user
 484 ##      is the prefix for user_t).
 485 ##      </summary>
 486 ## </param>
 487 #
 488 template(`userdom_common_user_template',`
 489         gen_require(`
 490                 attribute unpriv_userdomain;
 491         ')
 492
 493         userdom_basic_networking_template($1)
 494
 495         ##############################
 496         #
 497         # User domain Local policy
 498         #
 499
 500         # evolution and gnome-session try to create a netlink socket
 501         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 502         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 503
 504         allow $1_t unpriv_userdomain:fd use;
 505
 506         kernel_read_system_state($1_t)
 507         kernel_read_network_state($1_t)
 508         kernel_read_net_sysctls($1_t)
 509         # Very permissive allowing every domain to see every type:
 510         kernel_get_sysvipc_info($1_t)
 511         # Find CDROM devices:
 512         kernel_read_device_sysctls($1_t)
 513
 514         corecmd_exec_bin($1_t)
 515
 516         corenet_udp_bind_generic_node($1_t)
 517         corenet_udp_bind_generic_port($1_t)
 518
 519         dev_read_rand($1_t)
 520         dev_write_sound($1_t)
 521         dev_read_sound($1_t)
 522         dev_read_sound_mixer($1_t)
 523         dev_write_sound_mixer($1_t)
 524
 525         files_exec_etc_files($1_t)
 526         files_search_locks($1_t)
 527         # Check to see if cdrom is mounted
 528         files_search_mnt($1_t)
 529         # cjp: perhaps should cut back on file reads:
 530         files_read_var_files($1_t)
 531         files_read_var_symlinks($1_t)
 532         files_read_generic_spool($1_t)
 533         files_read_var_lib_files($1_t)
 534         # Stat lost+found.
 535         files_getattr_lost_found_dirs($1_t)
 536
 537         fs_rw_cgroup_files($1_t)
 538
 539         # cjp: some of this probably can be removed
 540         selinux_get_fs_mount($1_t)
 541         selinux_validate_context($1_t)
 542         selinux_compute_access_vector($1_t)
 543         selinux_compute_create_context($1_t)
 544         selinux_compute_relabel_context($1_t)
 545         selinux_compute_user_contexts($1_t)
 546
 547         # for eject
 548         storage_getattr_fixed_disk_dev($1_t)
 549
 550         auth_use_nsswitch($1_t)
 551         auth_read_login_records($1_t)
 552         auth_search_pam_console_data($1_t)
 553         auth_run_pam($1_t, $1_r)
 554         auth_run_utempter($1_t, $1_r)
 555
 556         init_read_utmp($1_t)
 557
 558         seutil_read_file_contexts($1_t)
 559         seutil_read_default_contexts($1_t)
 560         seutil_run_newrole($1_t, $1_r)
 561         seutil_exec_checkpolicy($1_t)
 562         seutil_exec_setfiles($1_t)
 563         # for when the network connection is killed
 564         # this is needed when a login role can change
 565         # to this one.
 566         seutil_dontaudit_signal_newrole($1_t)
 567
 568         tunable_policy(`user_direct_mouse',`
 569                 dev_read_mouse($1_t)
 570         ')
 571
 572         tunable_policy(`user_ttyfile_stat',`
 573                 term_getattr_all_ttys($1_t)
 574         ')
 575
 576         optional_policy(`
 577                 alsa_manage_home_files($1_t)
 578                 alsa_read_rw_config($1_t)
 579                 alsa_relabel_home_files($1_t)
 580         ')
 581
 582         optional_policy(`
 583                 # Allow graphical boot to check battery lifespan
 584                 apm_stream_connect($1_t)
 585         ')
 586
 587         optional_policy(`
 588                 canna_stream_connect($1_t)
 589         ')
 590
 591         optional_policy(`
 592                 dbus_system_bus_client($1_t)
 593
 594                 optional_policy(`
 595                         bluetooth_dbus_chat($1_t)
 596                 ')
 597
 598                 optional_policy(`
 599                         evolution_dbus_chat($1_t)
 600                         evolution_alarm_dbus_chat($1_t)
 601                 ')
 602
 603                 optional_policy(`
 604                         cups_dbus_chat_config($1_t)
 605                 ')
 606
 607                 optional_policy(`
 608                         hal_dbus_chat($1_t)
 609                 ')
 610
 611                 optional_policy(`
 612                         networkmanager_dbus_chat($1_t)
 613                 ')
 614         ')
 615
 616         optional_policy(`
 617                 inetd_use_fds($1_t)
 618                 inetd_rw_tcp_sockets($1_t)
 619         ')
 620
 621         optional_policy(`
 622                 inn_read_config($1_t)
 623                 inn_read_news_lib($1_t)
 624                 inn_read_news_spool($1_t)
 625         ')
 626
 627         optional_policy(`
 628                 locate_read_lib_files($1_t)
 629         ')
 630
 631         # for running depmod as part of the kernel packaging process
 632         optional_policy(`
 633                 modutils_read_module_config($1_t)
 634         ')
 635
 636         optional_policy(`
 637                 mta_rw_spool($1_t)
 638         ')
 639
 640         optional_policy(`
 641                 tunable_policy(`allow_user_mysql_connect',`
 642                         mysql_stream_connect($1_t)
 643                 ')
 644         ')
 645
 646         optional_policy(`
 647                 oident_manage_user_content($1_t)
 648                 oident_relabel_user_content($1_t)
 649         ')
 650
 651         optional_policy(`
 652                 # to allow monitoring of pcmcia status
 653                 pcmcia_read_pid($1_t)
 654         ')
 655
 656         optional_policy(`
 657                 pcscd_read_pub_files($1_t)
 658                 pcscd_stream_connect($1_t)
 659         ')
 660
 661         optional_policy(`
 662                 tunable_policy(`allow_user_postgresql_connect',`
 663                         postgresql_stream_connect($1_t)
 664                         postgresql_tcp_connect($1_t)
 665                 ')
 666         ')
 667
 668         optional_policy(`
 669                 resmgr_stream_connect($1_t)
 670         ')
 671
 672         optional_policy(`
 673                 rpc_dontaudit_getattr_exports($1_t)
 674                 rpc_manage_nfs_rw_content($1_t)
 675         ')
 676
 677         optional_policy(`
 678                 samba_stream_connect_winbind($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 slrnpull_search_spool($1_t)
 683         ')
 684
 685         optional_policy(`
 686                 usernetctl_run($1_t, $1_r)
 687         ')
 688 ')
 689
 690 #######################################
 691 ## <summary>
 692 ##      The template for creating a login user.
 693 ## </summary>
 694 ## <desc>
 695 ##      <p>
 696 ##      This template creates a user domain, types, and
 697 ##      rules for the user's tty, pty, home directories,
 698 ##      tmp, and tmpfs files.
 699 ##      </p>
 700 ## </desc>
 701 ## <param name="userdomain_prefix">
 702 ##      <summary>
 703 ##      The prefix of the user domain (e.g., user
 704 ##      is the prefix for user_t).
 705 ##      </summary>
 706 ## </param>
 707 #
 708 template(`userdom_login_user_template', `
 709         gen_require(`
 710                 class context contains;
 711         ')
 712
 713         userdom_base_user_template($1)
 714
 715         userdom_manage_home_role($1_r, $1_t)
 716
 717         userdom_manage_tmp_role($1_r, $1_t)
 718         userdom_manage_tmpfs_role($1_r, $1_t)
 719
 720         userdom_exec_user_tmp_files($1_t)
 721         userdom_exec_user_home_content_files($1_t)
 722
 723         userdom_change_password_template($1)
 724
 725         ##############################
 726         #
 727         # User domain Local policy
 728         #
 729
 730         allow $1_t self:capability { setgid chown fowner };
 731         dontaudit $1_t self:capability { sys_nice fsetid };
 732
 733         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 734         dontaudit $1_t self:process setrlimit;
 735         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 736
 737         allow $1_t self:context contains;
 738
 739         kernel_dontaudit_read_system_state($1_t)
 740
 741         dev_read_sysfs($1_t)
 742         dev_read_urand($1_t)
 743
 744         domain_use_interactive_fds($1_t)
 745         # Command completion can fire hundreds of denials
 746         domain_dontaudit_exec_all_entry_files($1_t)
 747
 748         files_dontaudit_list_default($1_t)
 749         files_dontaudit_read_default_files($1_t)
 750         # Stat lost+found.
 751         files_getattr_lost_found_dirs($1_t)
 752
 753         fs_get_all_fs_quotas($1_t)
 754         fs_getattr_all_fs($1_t)
 755         fs_getattr_all_dirs($1_t)
 756         fs_search_auto_mountpoints($1_t)
 757         fs_list_cgroup_dirs($1_t)
 758         fs_list_inotifyfs($1_t)
 759         fs_rw_anon_inodefs_files($1_t)
 760         fs_dontaudit_rw_cgroup_files($1_t)
 761
 762         auth_dontaudit_write_login_records($1_t)
 763
 764         application_exec_all($1_t)
 765
 766         # The library functions always try to open read-write first,
 767         # then fall back to read-only if it fails.
 768         init_dontaudit_rw_utmp($1_t)
 769         # Stop warnings about access to /dev/console
 770         init_dontaudit_use_fds($1_t)
 771         init_dontaudit_use_script_fds($1_t)
 772
 773         libs_exec_lib_files($1_t)
 774
 775         logging_dontaudit_getattr_all_logs($1_t)
 776
 777         miscfiles_read_man_pages($1_t)
 778         # for running TeX programs
 779         miscfiles_read_tetex_data($1_t)
 780         miscfiles_exec_tetex_data($1_t)
 781
 782         seutil_read_config($1_t)
 783
 784         optional_policy(`
 785                 cups_read_config($1_t)
 786                 cups_stream_connect($1_t)
 787                 cups_stream_connect_ptal($1_t)
 788         ')
 789
 790         optional_policy(`
 791                 kerberos_use($1_t)
 792         ')
 793
 794         optional_policy(`
 795                 mta_dontaudit_read_spool_symlinks($1_t)
 796         ')
 797
 798         optional_policy(`
 799                 quota_dontaudit_getattr_db($1_t)
 800         ')
 801
 802         optional_policy(`
 803                 rpm_read_db($1_t)
 804                 rpm_dontaudit_manage_db($1_t)
 805         ')
 806 ')
 807
 808 #######################################
 809 ## <summary>
 810 ##      The template for creating a unprivileged login user.
 811 ## </summary>
 812 ## <desc>
 813 ##      <p>
 814 ##      This template creates a user domain, types, and
 815 ##      rules for the user's tty, pty, home directories,
 816 ##      tmp, and tmpfs files.
 817 ##      </p>
 818 ## </desc>
 819 ## <param name="userdomain_prefix">
 820 ##      <summary>
 821 ##      The prefix of the user domain (e.g., user
 822 ##      is the prefix for user_t).
 823 ##      </summary>
 824 ## </param>
 825 #
 826 template(`userdom_restricted_user_template',`
 827         gen_require(`
 828                 attribute unpriv_userdomain;
 829         ')
 830
 831         userdom_login_user_template($1)
 832
 833         typeattribute $1_t unpriv_userdomain;
 834         domain_interactive_fd($1_t)
 835
 836         ##############################
 837         #
 838         # Local policy
 839         #
 840
 841         optional_policy(`
 842                 loadkeys_run($1_t, $1_r)
 843         ')
 844 ')
 845
 846 #######################################
 847 ## <summary>
 848 ##      The template for creating a unprivileged xwindows login user.
 849 ## </summary>
 850 ## <desc>
 851 ##      <p>
 852 ##      The template for creating a unprivileged xwindows login user.
 853 ##      </p>
 854 ##      <p>
 855 ##      This template creates a user domain, types, and
 856 ##      rules for the user's tty, pty, home directories,
 857 ##      tmp, and tmpfs files.
 858 ##      </p>
 859 ## </desc>
 860 ## <param name="userdomain_prefix">
 861 ##      <summary>
 862 ##      The prefix of the user domain (e.g., user
 863 ##      is the prefix for user_t).
 864 ##      </summary>
 865 ## </param>
 866 #
 867 template(`userdom_restricted_xwindows_user_template',`
 868
 869         userdom_restricted_user_template($1)
 870
 871         ##############################
 872         #
 873         # Local policy
 874         #
 875
 876         auth_role($1_r, $1_t)
 877         auth_search_pam_console_data($1_t)
 878
 879         dev_read_sound($1_t)
 880         dev_write_sound($1_t)
 881         # gnome keyring wants to read this.
 882         dev_dontaudit_read_rand($1_t)
 883
 884         logging_send_syslog_msg($1_t)
 885         logging_dontaudit_send_audit_msgs($1_t)
 886
 887         # Need to to this just so screensaver will work. Should be moved to screensaver domain
 888         logging_send_audit_msgs($1_t)
 889         selinux_get_enforce_mode($1_t)
 890
 891         xserver_restricted_role($1_r, $1_t)
 892
 893         optional_policy(`
 894                 alsa_read_rw_config($1_t)
 895         ')
 896
 897         optional_policy(`
 898                 dbus_role_template($1, $1_r, $1_t)
 899                 dbus_system_bus_client($1_t)
 900
 901                 optional_policy(`
 902                         consolekit_dbus_chat($1_t)
 903                 ')
 904
 905                 optional_policy(`
 906                         cups_dbus_chat($1_t)
 907                 ')
 908         ')
 909
 910         optional_policy(`
 911                 java_role($1_r, $1_t)
 912         ')
 913
 914         optional_policy(`
 915                 setroubleshoot_dontaudit_stream_connect($1_t)
 916         ')
 917 ')
 918
 919 #######################################
 920 ## <summary>
 921 ##      The template for creating a unprivileged user roughly
 922 ##      equivalent to a regular linux user.
 923 ## </summary>
 924 ## <desc>
 925 ##      <p>
 926 ##      The template for creating a unprivileged user roughly
 927 ##      equivalent to a regular linux user.
 928 ##      </p>
 929 ##      <p>
 930 ##      This template creates a user domain, types, and
 931 ##      rules for the user's tty, pty, home directories,
 932 ##      tmp, and tmpfs files.
 933 ##      </p>
 934 ## </desc>
 935 ## <param name="userdomain_prefix">
 936 ##      <summary>
 937 ##      The prefix of the user domain (e.g., user
 938 ##      is the prefix for user_t).
 939 ##      </summary>
 940 ## </param>
 941 #
 942 template(`userdom_unpriv_user_template', `
 943
 944         ##############################
 945         #
 946         # Declarations
 947         #
 948
 949         # Inherit rules for ordinary users.
 950         userdom_restricted_user_template($1)
 951         userdom_common_user_template($1)
 952
 953         ##############################
 954         #
 955         # Local policy
 956         #
 957
 958         # port access is audited even if dac would not have allowed it, so dontaudit it here
 959         corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
 960         # Need the following rule to allow users to run vpnc
 961         corenet_tcp_bind_xserver_port($1_t)
 962
 963         files_exec_usr_files($1_t)
 964         # cjp: why?
 965         files_read_kernel_symbol_table($1_t)
 966
 967         ifndef(`enable_mls',`
 968                 fs_exec_noxattr($1_t)
 969
 970                 tunable_policy(`user_rw_noexattrfile',`
 971                         fs_manage_noxattr_fs_files($1_t)
 972                         fs_manage_noxattr_fs_dirs($1_t)
 973                         # Write floppies
 974                         storage_raw_read_removable_device($1_t)
 975                         storage_raw_write_removable_device($1_t)
 976                 ',`
 977                         storage_raw_read_removable_device($1_t)
 978                 ')
 979         ')
 980
 981         tunable_policy(`user_dmesg',`
 982                 kernel_read_ring_buffer($1_t)
 983         ',`
 984                 kernel_dontaudit_read_ring_buffer($1_t)
 985         ')
 986
 987         # Allow users to run TCP servers (bind to ports and accept connection from
 988         # the same domain and outside users) disabling this forces FTP passive mode
 989         # and may change other protocols
 990         tunable_policy(`user_tcp_server',`
 991                 corenet_tcp_bind_generic_node($1_t)
 992                 corenet_tcp_bind_generic_port($1_t)
 993         ')
 994
 995         optional_policy(`
 996                 netutils_run_ping_cond($1_t, $1_r)
 997                 netutils_run_traceroute_cond($1_t, $1_r)
 998         ')
 999
1000         # Run pppd in pppd_t by default for user
1001         optional_policy(`
1002                 ppp_run_cond($1_t, $1_r)
1003         ')
1004
1005         optional_policy(`
1006                 setroubleshoot_stream_connect($1_t)
1007         ')
1008 ')
1009
1010 #######################################
1011 ## <summary>
1012 ##      The template for creating an administrative user.
1013 ## </summary>
1014 ## <desc>
1015 ##      <p>
1016 ##      This template creates a user domain, types, and
1017 ##      rules for the user's tty, pty, home directories,
1018 ##      tmp, and tmpfs files.
1019 ##      </p>
1020 ##      <p>
1021 ##      The privileges given to administrative users are:
1022 ##      <ul>
1023 ##              <li>Raw disk access</li>
1024 ##              <li>Set all sysctls</li>
1025 ##              <li>All kernel ring buffer controls</li>
1026 ##              <li>Create, read, write, and delete all files but shadow</li>
1027 ##              <li>Manage source and binary format SELinux policy</li>
1028 ##              <li>Run insmod</li>
1029 ##      </ul>
1030 ##      </p>
1031 ## </desc>
1032 ## <param name="userdomain_prefix">
1033 ##      <summary>
1034 ##      The prefix of the user domain (e.g., sysadm
1035 ##      is the prefix for sysadm_t).
1036 ##      </summary>
1037 ## </param>
1038 #
1039 template(`userdom_admin_user_template',`
1040         gen_require(`
1041                 attribute admindomain;
1042                 class passwd { passwd chfn chsh rootok };
1043         ')
1044
1045         ##############################
1046         #
1047         # Declarations
1048         #
1049
1050         # Inherit rules for ordinary users.
1051         userdom_login_user_template($1)
1052         userdom_common_user_template($1)
1053
1054         domain_obj_id_change_exemption($1_t)
1055         role system_r types $1_t;
1056
1057         typeattribute $1_t admindomain;
1058
1059         ifdef(`direct_sysadm_daemon',`
1060                 domain_system_change_exemption($1_t)
1061         ')
1062
1063         ##############################
1064         #
1065         # $1_t local policy
1066         #
1067
1068         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1069         allow $1_t self:process { setexec setfscreate };
1070         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1071         allow $1_t self:tun_socket create;
1072         # Set password information for other users.
1073         allow $1_t self:passwd { passwd chfn chsh };
1074         # Skip authentication when pam_rootok is specified.
1075         allow $1_t self:passwd rootok;
1076
1077         kernel_read_software_raid_state($1_t)
1078         kernel_getattr_core_if($1_t)
1079         kernel_getattr_message_if($1_t)
1080         kernel_change_ring_buffer_level($1_t)
1081         kernel_clear_ring_buffer($1_t)
1082         kernel_read_ring_buffer($1_t)
1083         kernel_get_sysvipc_info($1_t)
1084         kernel_rw_all_sysctls($1_t)
1085         # signal unlabeled processes:
1086         kernel_kill_unlabeled($1_t)
1087         kernel_signal_unlabeled($1_t)
1088         kernel_sigstop_unlabeled($1_t)
1089         kernel_signull_unlabeled($1_t)
1090         kernel_sigchld_unlabeled($1_t)
1091
1092         corenet_tcp_bind_generic_port($1_t)
1093         # allow setting up tunnels
1094         corenet_rw_tun_tap_dev($1_t)
1095
1096         dev_getattr_generic_blk_files($1_t)
1097         dev_getattr_generic_chr_files($1_t)
1098         # for lsof
1099         dev_getattr_mtrr_dev($1_t)
1100         # Allow MAKEDEV to work
1101         dev_create_all_blk_files($1_t)
1102         dev_create_all_chr_files($1_t)
1103         dev_delete_all_blk_files($1_t)
1104         dev_delete_all_chr_files($1_t)
1105         dev_rename_all_blk_files($1_t)
1106         dev_rename_all_chr_files($1_t)
1107         dev_create_generic_symlinks($1_t)
1108
1109         domain_setpriority_all_domains($1_t)
1110         domain_read_all_domains_state($1_t)
1111         domain_getattr_all_domains($1_t)
1112         domain_dontaudit_ptrace_all_domains($1_t)
1113         # signal all domains:
1114         domain_kill_all_domains($1_t)
1115         domain_signal_all_domains($1_t)
1116         domain_signull_all_domains($1_t)
1117         domain_sigstop_all_domains($1_t)
1118         domain_sigstop_all_domains($1_t)
1119         domain_sigchld_all_domains($1_t)
1120         # for lsof
1121         domain_getattr_all_sockets($1_t)
1122
1123         files_exec_usr_src_files($1_t)
1124
1125         fs_getattr_all_fs($1_t)
1126         fs_set_all_quotas($1_t)
1127         fs_exec_noxattr($1_t)
1128
1129         storage_raw_read_removable_device($1_t)
1130         storage_raw_write_removable_device($1_t)
1131
1132         term_use_all_terms($1_t)
1133
1134         auth_getattr_shadow($1_t)
1135         # Manage almost all files
1136         auth_manage_all_files_except_shadow($1_t)
1137         # Relabel almost all files
1138         auth_relabel_all_files_except_shadow($1_t)
1139
1140         init_telinit($1_t)
1141
1142         logging_send_syslog_msg($1_t)
1143
1144         modutils_domtrans_insmod($1_t)
1145
1146         # The following rule is temporary until such time that a complete
1147         # policy management infrastructure is in place so that an administrator
1148         # cannot directly manipulate policy files with arbitrary programs.
1149         seutil_manage_src_policy($1_t)
1150         # Violates the goal of limiting write access to checkpolicy.
1151         # But presently necessary for installing the file_contexts file.
1152         seutil_manage_bin_policy($1_t)
1153
1154         userdom_manage_user_home_content_dirs($1_t)
1155         userdom_manage_user_home_content_files($1_t)
1156         userdom_manage_user_home_content_symlinks($1_t)
1157         userdom_manage_user_home_content_pipes($1_t)
1158         userdom_manage_user_home_content_sockets($1_t)
1159         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1160
1161         tunable_policy(`user_rw_noexattrfile',`
1162                 fs_manage_noxattr_fs_files($1_t)
1163                 fs_manage_noxattr_fs_dirs($1_t)
1164         ',`
1165                 fs_read_noxattr_fs_files($1_t)
1166         ')
1167
1168         optional_policy(`
1169                 postgresql_unconfined($1_t)
1170         ')
1171
1172         optional_policy(`
1173                 userhelper_exec($1_t)
1174         ')
1175 ')
1176
1177 ########################################
1178 ## <summary>
1179 ##      Allow user to run as a secadm
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      Create objects in a user home directory
1184 ##      with an automatic type transition to
1185 ##      a specified private type.
1186 ##      </p>
1187 ##      <p>
1188 ##      This is a templated interface, and should only
1189 ##      be called from a per-userdomain template.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="domain">
1193 ##      <summary>
1194 ##      Domain allowed access.
1195 ##      </summary>
1196 ## </param>
1197 ## <param name="role">
1198 ##      <summary>
1199 ##      The role  of the object to create.
1200 ##      </summary>
1201 ## </param>
1202 #
1203 template(`userdom_security_admin_template',`
1204         allow $1 self:capability { dac_read_search dac_override };
1205
1206         corecmd_exec_shell($1)
1207
1208         domain_obj_id_change_exemption($1)
1209
1210         dev_relabel_all_dev_nodes($1)
1211
1212         files_create_boot_flag($1)
1213
1214         # Necessary for managing /boot/efi
1215         fs_manage_dos_files($1)
1216
1217         mls_process_read_up($1)
1218         mls_file_read_all_levels($1)
1219         mls_file_upgrade($1)
1220         mls_file_downgrade($1)
1221
1222         selinux_set_enforce_mode($1)
1223         selinux_set_all_booleans($1)
1224         selinux_set_parameters($1)
1225
1226         auth_relabel_all_files_except_shadow($1)
1227         auth_relabel_shadow($1)
1228
1229         init_exec($1)
1230
1231         logging_send_syslog_msg($1)
1232         logging_read_audit_log($1)
1233         logging_read_generic_logs($1)
1234         logging_read_audit_config($1)
1235
1236         seutil_manage_bin_policy($1)
1237         seutil_run_checkpolicy($1, $2)
1238         seutil_run_loadpolicy($1, $2)
1239         seutil_run_semanage($1, $2)
1240         seutil_run_setfiles($1, $2)
1241
1242         optional_policy(`
1243                 aide_run($1, $2)
1244         ')
1245
1246         optional_policy(`
1247                 consoletype_exec($1)
1248         ')
1249
1250         optional_policy(`
1251                 dmesg_exec($1)
1252         ')
1253
1254         optional_policy(`
1255                 ipsec_run_setkey($1, $2)
1256         ')
1257
1258         optional_policy(`
1259                 netlabel_run_mgmt($1, $2)
1260         ')
1261
1262         optional_policy(`
1263                 samhain_run($1, $2)
1264         ')
1265 ')
1266
1267 ########################################
1268 ## <summary>
1269 ##      Make the specified type usable in a
1270 ##      user home directory.
1271 ## </summary>
1272 ## <param name="type">
1273 ##      <summary>
1274 ##      Type to be used as a file in the
1275 ##      user home directory.
1276 ##      </summary>
1277 ## </param>
1278 #
1279 interface(`userdom_user_home_content',`
1280         gen_require(`
1281                 type user_home_t;
1282         ')
1283
1284         allow $1 user_home_t:filesystem associate;
1285         files_type($1)
1286         files_poly_member($1)
1287         ubac_constrained($1)
1288 ')
1289
1290 ########################################
1291 ## <summary>
1292 ##      Allow domain to attach to TUN devices created by administrative users.
1293 ## </summary>
1294 ## <param name="domain">
1295 ##      <summary>
1296 ##      Domain allowed access.
1297 ##      </summary>
1298 ## </param>
1299 #
1300 interface(`userdom_attach_admin_tun_iface',`
1301         gen_require(`
1302                 attribute admindomain;
1303         ')
1304
1305         allow $1 admindomain:tun_socket relabelfrom;
1306         allow $1 self:tun_socket relabelto;
1307 ')
1308
1309 ########################################
1310 ## <summary>
1311 ##      Set the attributes of a user pty.
1312 ## </summary>
1313 ## <param name="domain">
1314 ##      <summary>
1315 ##      Domain allowed access.
1316 ##      </summary>
1317 ## </param>
1318 #
1319 interface(`userdom_setattr_user_ptys',`
1320         gen_require(`
1321                 type user_devpts_t;
1322         ')
1323
1324         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1325 ')
1326
1327 ########################################
1328 ## <summary>
1329 ##      Create a user pty.
1330 ## </summary>
1331 ## <param name="domain">
1332 ##      <summary>
1333 ##      Domain allowed access.
1334 ##      </summary>
1335 ## </param>
1336 #
1337 interface(`userdom_create_user_pty',`
1338         gen_require(`
1339                 type user_devpts_t;
1340         ')
1341
1342         term_create_pty($1, user_devpts_t)
1343 ')
1344
1345 ########################################
1346 ## <summary>
1347 ##      Get the attributes of user home directories.
1348 ## </summary>
1349 ## <param name="domain">
1350 ##      <summary>
1351 ##      Domain allowed access.
1352 ##      </summary>
1353 ## </param>
1354 #
1355 interface(`userdom_getattr_user_home_dirs',`
1356         gen_require(`
1357                 type user_home_dir_t;
1358         ')
1359
1360         allow $1 user_home_dir_t:dir getattr_dir_perms;
1361         files_search_home($1)
1362 ')
1363
1364 ########################################
1365 ## <summary>
1366 ##      Do not audit attempts to get the attributes of user home directories.
1367 ## </summary>
1368 ## <param name="domain">
1369 ##      <summary>
1370 ##      Domain to not audit.
1371 ##      </summary>
1372 ## </param>
1373 #
1374 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1375         gen_require(`
1376                 type user_home_dir_t;
1377         ')
1378
1379         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1380 ')
1381
1382 ########################################
1383 ## <summary>
1384 ##      Search user home directories.
1385 ## </summary>
1386 ## <param name="domain">
1387 ##      <summary>
1388 ##      Domain allowed access.
1389 ##      </summary>
1390 ## </param>
1391 #
1392 interface(`userdom_search_user_home_dirs',`
1393         gen_require(`
1394                 type user_home_dir_t;
1395         ')
1396
1397         allow $1 user_home_dir_t:dir search_dir_perms;
1398         files_search_home($1)
1399 ')
1400
1401 ########################################
1402 ## <summary>
1403 ##      Do not audit attempts to search user home directories.
1404 ## </summary>
1405 ## <desc>
1406 ##      <p>
1407 ##      Do not audit attempts to search user home directories.
1408 ##      This will supress SELinux denial messages when the specified
1409 ##      domain is denied the permission to search these directories.
1410 ##      </p>
1411 ## </desc>
1412 ## <param name="domain">
1413 ##      <summary>
1414 ##      Domain to not audit.
1415 ##      </summary>
1416 ## </param>
1417 ## <infoflow type="none"/>
1418 #
1419 interface(`userdom_dontaudit_search_user_home_dirs',`
1420         gen_require(`
1421                 type user_home_dir_t;
1422         ')
1423
1424         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1425 ')
1426
1427 ########################################
1428 ## <summary>
1429 ##      List user home directories.
1430 ## </summary>
1431 ## <param name="domain">
1432 ##      <summary>
1433 ##      Domain allowed access.
1434 ##      </summary>
1435 ## </param>
1436 #
1437 interface(`userdom_list_user_home_dirs',`
1438         gen_require(`
1439                 type user_home_dir_t;
1440         ')
1441
1442         allow $1 user_home_dir_t:dir list_dir_perms;
1443         files_search_home($1)
1444 ')
1445
1446 ########################################
1447 ## <summary>
1448 ##      Do not audit attempts to list user home subdirectories.
1449 ## </summary>
1450 ## <param name="domain">
1451 ##      <summary>
1452 ##      Domain to not audit.
1453 ##      </summary>
1454 ## </param>
1455 #
1456 interface(`userdom_dontaudit_list_user_home_dirs',`
1457         gen_require(`
1458                 type user_home_dir_t;
1459         ')
1460
1461         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1462 ')
1463
1464 ########################################
1465 ## <summary>
1466 ##      Create user home directories.
1467 ## </summary>
1468 ## <param name="domain">
1469 ##      <summary>
1470 ##      Domain allowed access.
1471 ##      </summary>
1472 ## </param>
1473 #
1474 interface(`userdom_create_user_home_dirs',`
1475         gen_require(`
1476                 type user_home_dir_t;
1477         ')
1478
1479         allow $1 user_home_dir_t:dir create_dir_perms;
1480 ')
1481
1482 ########################################
1483 ## <summary>
1484 ##      Create user home directories.
1485 ## </summary>
1486 ## <param name="domain">
1487 ##      <summary>
1488 ##      Domain allowed access.
1489 ##      </summary>
1490 ## </param>
1491 #
1492 interface(`userdom_manage_user_home_dirs',`
1493         gen_require(`
1494                 type user_home_dir_t;
1495         ')
1496
1497         allow $1 user_home_dir_t:dir manage_dir_perms;
1498 ')
1499
1500 ########################################
1501 ## <summary>
1502 ##      Relabel to user home directories.
1503 ## </summary>
1504 ## <param name="domain">
1505 ##      <summary>
1506 ##      Domain allowed access.
1507 ##      </summary>
1508 ## </param>
1509 #
1510 interface(`userdom_relabelto_user_home_dirs',`
1511         gen_require(`
1512                 type user_home_dir_t;
1513         ')
1514
1515         allow $1 user_home_dir_t:dir relabelto;
1516 ')
1517
1518 ########################################
1519 ## <summary>
1520 ##      Create directories in the home dir root with
1521 ##      the user home directory type.
1522 ## </summary>
1523 ## <param name="domain">
1524 ##      <summary>
1525 ##      Domain allowed access.
1526 ##      </summary>
1527 ## </param>
1528 #
1529 interface(`userdom_home_filetrans_user_home_dir',`
1530         gen_require(`
1531                 type user_home_dir_t;
1532         ')
1533
1534         files_home_filetrans($1, user_home_dir_t, dir)
1535 ')
1536
1537 ########################################
1538 ## <summary>
1539 ##      Do a domain transition to the specified
1540 ##      domain when executing a program in the
1541 ##      user home directory.
1542 ## </summary>
1543 ## <desc>
1544 ##      <p>
1545 ##      Do a domain transition to the specified
1546 ##      domain when executing a program in the
1547 ##      user home directory.
1548 ##      </p>
1549 ##      <p>
1550 ##      No interprocess communication (signals, pipes,
1551 ##      etc.) is provided by this interface since
1552 ##      the domains are not owned by this module.
1553 ##      </p>
1554 ## </desc>
1555 ## <param name="source_domain">
1556 ##      <summary>
1557 ##      Domain allowed to transition.
1558 ##      </summary>
1559 ## </param>
1560 ## <param name="target_domain">
1561 ##      <summary>
1562 ##      Domain to transition to.
1563 ##      </summary>
1564 ## </param>
1565 #
1566 interface(`userdom_user_home_domtrans',`
1567         gen_require(`
1568                 type user_home_dir_t, user_home_t;
1569         ')
1570
1571         domain_auto_trans($1, user_home_t, $2)
1572         allow $1 user_home_dir_t:dir search_dir_perms;
1573         files_search_home($1)
1574 ')
1575
1576 ########################################
1577 ## <summary>
1578 ##      Do not audit attempts to search user home content directories.
1579 ## </summary>
1580 ## <param name="domain">
1581 ##      <summary>
1582 ##      Domain to not audit.
1583 ##      </summary>
1584 ## </param>
1585 #
1586 interface(`userdom_dontaudit_search_user_home_content',`
1587         gen_require(`
1588                 type user_home_t;
1589         ')
1590
1591         dontaudit $1 user_home_t:dir search_dir_perms;
1592 ')
1593
1594 ########################################
1595 ## <summary>
1596 ##      List contents of users home directory.
1597 ## </summary>
1598 ## <param name="domain">
1599 ##      <summary>
1600 ##      Domain allowed access.
1601 ##      </summary>
1602 ## </param>
1603 #
1604 interface(`userdom_list_user_home_content',`
1605         gen_require(`
1606                 type user_home_t;
1607         ')
1608
1609         allow $1 user_home_t:dir list_dir_perms;
1610 ')
1611
1612 ########################################
1613 ## <summary>
1614 ##      Create, read, write, and delete directories
1615 ##      in a user home subdirectory.
1616 ## </summary>
1617 ## <param name="domain">
1618 ##      <summary>
1619 ##      Domain allowed access.
1620 ##      </summary>
1621 ## </param>
1622 #
1623 interface(`userdom_manage_user_home_content_dirs',`
1624         gen_require(`
1625                 type user_home_dir_t, user_home_t;
1626         ')
1627
1628         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1629         files_search_home($1)
1630 ')
1631
1632 ########################################
1633 ## <summary>
1634 ##      Delete directories in a user home subdirectory.
1635 ## </summary>
1636 ## <param name="domain">
1637 ##      <summary>
1638 ##      Domain allowed access.
1639 ##      </summary>
1640 ## </param>
1641 #
1642 interface(`userdom_delete_user_home_content_dirs',`
1643         gen_require(`
1644                 type user_home_t;
1645         ')
1646
1647         allow $1 user_home_t:dir delete_dir_perms;
1648 ')
1649
1650 ########################################
1651 ## <summary>
1652 ##      Do not audit attempts to set the
1653 ##      attributes of user home files.
1654 ## </summary>
1655 ## <param name="domain">
1656 ##      <summary>
1657 ##      Domain to not audit.
1658 ##      </summary>
1659 ## </param>
1660 #
1661 interface(`userdom_dontaudit_setattr_user_home_content_files',`
1662         gen_require(`
1663                 type user_home_t;
1664         ')
1665
1666         dontaudit $1 user_home_t:file setattr_file_perms;
1667 ')
1668
1669 ########################################
1670 ## <summary>
1671 ##      Mmap user home files.
1672 ## </summary>
1673 ## <param name="domain">
1674 ##      <summary>
1675 ##      Domain allowed access.
1676 ##      </summary>
1677 ## </param>
1678 #
1679 interface(`userdom_mmap_user_home_content_files',`
1680         gen_require(`
1681                 type user_home_dir_t, user_home_t;
1682         ')
1683
1684         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1685         files_search_home($1)
1686 ')
1687
1688 ########################################
1689 ## <summary>
1690 ##      Read user home files.
1691 ## </summary>
1692 ## <param name="domain">
1693 ##      <summary>
1694 ##      Domain allowed access.
1695 ##      </summary>
1696 ## </param>
1697 #
1698 interface(`userdom_read_user_home_content_files',`
1699         gen_require(`
1700                 type user_home_dir_t, user_home_t;
1701         ')
1702
1703         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1704         files_search_home($1)
1705 ')
1706
1707 ########################################
1708 ## <summary>
1709 ##      Do not audit attempts to read user home files.
1710 ## </summary>
1711 ## <param name="domain">
1712 ##      <summary>
1713 ##      Domain to not audit.
1714 ##      </summary>
1715 ## </param>
1716 #
1717 interface(`userdom_dontaudit_read_user_home_content_files',`
1718         gen_require(`
1719                 type user_home_t;
1720         ')
1721
1722         dontaudit $1 user_home_t:dir list_dir_perms;
1723         dontaudit $1 user_home_t:file read_file_perms;
1724 ')
1725
1726 ########################################
1727 ## <summary>
1728 ##      Do not audit attempts to append user home files.
1729 ## </summary>
1730 ## <param name="domain">
1731 ##      <summary>
1732 ##      Domain to not audit.
1733 ##      </summary>
1734 ## </param>
1735 #
1736 interface(`userdom_dontaudit_append_user_home_content_files',`
1737         gen_require(`
1738                 type user_home_t;
1739         ')
1740
1741         dontaudit $1 user_home_t:file append_file_perms;
1742 ')
1743
1744 ########################################
1745 ## <summary>
1746 ##      Do not audit attempts to write user home files.
1747 ## </summary>
1748 ## <param name="domain">
1749 ##      <summary>
1750 ##      Domain to not audit.
1751 ##      </summary>
1752 ## </param>
1753 #
1754 interface(`userdom_dontaudit_write_user_home_content_files',`
1755         gen_require(`
1756                 type user_home_t;
1757         ')
1758
1759         dontaudit $1 user_home_t:file write_file_perms;
1760 ')
1761
1762 ########################################
1763 ## <summary>
1764 ##      Delete files in a user home subdirectory.
1765 ## </summary>
1766 ## <param name="domain">
1767 ##      <summary>
1768 ##      Domain allowed access.
1769 ##      </summary>
1770 ## </param>
1771 #
1772 interface(`userdom_delete_user_home_content_files',`
1773         gen_require(`
1774                 type user_home_t;
1775         ')
1776
1777         allow $1 user_home_t:file delete_file_perms;
1778 ')
1779
1780 ########################################
1781 ## <summary>
1782 ##      Do not audit attempts to write user home files.
1783 ## </summary>
1784 ## <param name="domain">
1785 ##      <summary>
1786 ##      Domain to not audit.
1787 ##      </summary>
1788 ## </param>
1789 #
1790 interface(`userdom_dontaudit_relabel_user_home_content_files',`
1791         gen_require(`
1792                 type user_home_t;
1793         ')
1794
1795         dontaudit $1 user_home_t:file relabel_file_perms;
1796 ')
1797
1798 ########################################
1799 ## <summary>
1800 ##      Read user home subdirectory symbolic links.
1801 ## </summary>
1802 ## <param name="domain">
1803 ##      <summary>
1804 ##      Domain allowed access.
1805 ##      </summary>
1806 ## </param>
1807 #
1808 interface(`userdom_read_user_home_content_symlinks',`
1809         gen_require(`
1810                 type user_home_dir_t, user_home_t;
1811         ')
1812
1813         read_lnk_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1814         files_search_home($1)
1815 ')
1816
1817 ########################################
1818 ## <summary>
1819 ##      Execute user home files.
1820 ## </summary>
1821 ## <param name="domain">
1822 ##      <summary>
1823 ##      Domain allowed access.
1824 ##      </summary>
1825 ## </param>
1826 ## <rolecap/>
1827 #
1828 interface(`userdom_exec_user_home_content_files',`
1829         gen_require(`
1830                 type user_home_dir_t, user_home_t;
1831         ')
1832
1833         files_search_home($1)
1834         exec_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1835
1836         tunable_policy(`use_nfs_home_dirs',`
1837                 fs_exec_nfs_files($1)
1838         ')
1839
1840         tunable_policy(`use_samba_home_dirs',`
1841                 fs_exec_cifs_files($1)
1842         ')
1843 ')
1844
1845 ########################################
1846 ## <summary>
1847 ##      Do not audit attempts to execute user home files.
1848 ## </summary>
1849 ## <param name="domain">
1850 ##      <summary>
1851 ##      Domain to not audit.
1852 ##      </summary>
1853 ## </param>
1854 #
1855 interface(`userdom_dontaudit_exec_user_home_content_files',`
1856         gen_require(`
1857                 type user_home_t;
1858         ')
1859
1860         dontaudit $1 user_home_t:file exec_file_perms;
1861 ')
1862
1863 ########################################
1864 ## <summary>
1865 ##      Create, read, write, and delete files
1866 ##      in a user home subdirectory.
1867 ## </summary>
1868 ## <param name="domain">
1869 ##      <summary>
1870 ##      Domain allowed access.
1871 ##      </summary>
1872 ## </param>
1873 #
1874 interface(`userdom_manage_user_home_content_files',`
1875         gen_require(`
1876                 type user_home_dir_t, user_home_t;
1877         ')
1878
1879         manage_files_pattern($1, user_home_t, user_home_t)
1880         allow $1 user_home_dir_t:dir search_dir_perms;
1881         files_search_home($1)
1882 ')
1883
1884 ########################################
1885 ## <summary>
1886 ##      Do not audit attempts to create, read, write, and delete directories
1887 ##      in a user home subdirectory.
1888 ## </summary>
1889 ## <param name="domain">
1890 ##      <summary>
1891 ##      Domain to not audit.
1892 ##      </summary>
1893 ## </param>
1894 #
1895 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
1896         gen_require(`
1897                 type user_home_dir_t, user_home_t;
1898         ')
1899
1900         dontaudit $1 user_home_t:dir manage_dir_perms;
1901 ')
1902
1903 ########################################
1904 ## <summary>
1905 ##      Create, read, write, and delete symbolic links
1906 ##      in a user home subdirectory.
1907 ## </summary>
1908 ## <param name="domain">
1909 ##      <summary>
1910 ##      Domain allowed access.
1911 ##      </summary>
1912 ## </param>
1913 #
1914 interface(`userdom_manage_user_home_content_symlinks',`
1915         gen_require(`
1916                 type user_home_dir_t, user_home_t;
1917         ')
1918
1919         manage_lnk_files_pattern($1, user_home_t, user_home_t)
1920         allow $1 user_home_dir_t:dir search_dir_perms;
1921         files_search_home($1)
1922 ')
1923
1924 ########################################
1925 ## <summary>
1926 ##      Delete symbolic links in a user home directory.
1927 ## </summary>
1928 ## <param name="domain">
1929 ##      <summary>
1930 ##      Domain allowed access.
1931 ##      </summary>
1932 ## </param>
1933 #
1934 interface(`userdom_delete_user_home_content_symlinks',`
1935         gen_require(`
1936                 type user_home_t;
1937         ')
1938
1939         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
1940 ')
1941
1942 ########################################
1943 ## <summary>
1944 ##      Create, read, write, and delete named pipes
1945 ##      in a user home subdirectory.
1946 ## </summary>
1947 ## <param name="domain">
1948 ##      <summary>
1949 ##      Domain allowed access.
1950 ##      </summary>
1951 ## </param>
1952 #
1953 interface(`userdom_manage_user_home_content_pipes',`
1954         gen_require(`
1955                 type user_home_dir_t, user_home_t;
1956         ')
1957
1958         manage_fifo_files_pattern($1, user_home_t, user_home_t)
1959         allow $1 user_home_dir_t:dir search_dir_perms;
1960         files_search_home($1)
1961 ')
1962
1963 ########################################
1964 ## <summary>
1965 ##      Create, read, write, and delete named sockets
1966 ##      in a user home subdirectory.
1967 ## </summary>
1968 ## <param name="domain">
1969 ##      <summary>
1970 ##      Domain allowed access.
1971 ##      </summary>
1972 ## </param>
1973 #
1974 interface(`userdom_manage_user_home_content_sockets',`
1975         gen_require(`
1976                 type user_home_dir_t, user_home_t;
1977         ')
1978
1979         allow $1 user_home_dir_t:dir search_dir_perms;
1980         manage_sock_files_pattern($1, user_home_t, user_home_t)
1981         files_search_home($1)
1982 ')
1983
1984 ########################################
1985 ## <summary>
1986 ##      Create objects in a user home directory
1987 ##      with an automatic type transition to
1988 ##      a specified private type.
1989 ## </summary>
1990 ## <param name="domain">
1991 ##      <summary>
1992 ##      Domain allowed access.
1993 ##      </summary>
1994 ## </param>
1995 ## <param name="private_type">
1996 ##      <summary>
1997 ##      The type of the object to create.
1998 ##      </summary>
1999 ## </param>
2000 ## <param name="object_class">
2001 ##      <summary>
2002 ##      The class of the object to be created.
2003 ##      </summary>
2004 ## </param>
2005 #
2006 interface(`userdom_user_home_dir_filetrans',`
2007         gen_require(`
2008                 type user_home_dir_t;
2009         ')
2010
2011         filetrans_pattern($1, user_home_dir_t, $2, $3)
2012         files_search_home($1)
2013 ')
2014
2015 ########################################
2016 ## <summary>
2017 ##      Create objects in a user home directory
2018 ##      with an automatic type transition to
2019 ##      a specified private type.
2020 ## </summary>
2021 ## <param name="domain">
2022 ##      <summary>
2023 ##      Domain allowed access.
2024 ##      </summary>
2025 ## </param>
2026 ## <param name="private_type">
2027 ##      <summary>
2028 ##      The type of the object to create.
2029 ##      </summary>
2030 ## </param>
2031 ## <param name="object_class">
2032 ##      <summary>
2033 ##      The class of the object to be created.
2034 ##      </summary>
2035 ## </param>
2036 #
2037 interface(`userdom_user_home_content_filetrans',`
2038         gen_require(`
2039                 type user_home_dir_t, user_home_t;
2040         ')
2041
2042         filetrans_pattern($1, user_home_t, $2, $3)
2043         allow $1 user_home_dir_t:dir search_dir_perms;
2044         files_search_home($1)
2045 ')
2046
2047 ########################################
2048 ## <summary>
2049 ##      Create objects in a user home directory
2050 ##      with an automatic type transition to
2051 ##      the user home file type.
2052 ## </summary>
2053 ## <param name="domain">
2054 ##      <summary>
2055 ##      Domain allowed access.
2056 ##      </summary>
2057 ## </param>
2058 ## <param name="object_class">
2059 ##      <summary>
2060 ##      The class of the object to be created.
2061 ##      </summary>
2062 ## </param>
2063 #
2064 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2065         gen_require(`
2066                 type user_home_dir_t, user_home_t;
2067         ')
2068
2069         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2070         files_search_home($1)
2071 ')
2072
2073 ########################################
2074 ## <summary>
2075 ##      Write to user temporary named sockets.
2076 ## </summary>
2077 ## <param name="domain">
2078 ##      <summary>
2079 ##      Domain allowed access.
2080 ##      </summary>
2081 ## </param>
2082 #
2083 interface(`userdom_write_user_tmp_sockets',`
2084         gen_require(`
2085                 type user_tmp_t;
2086         ')
2087
2088         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2089         files_search_tmp($1)
2090 ')
2091
2092 ########################################
2093 ## <summary>
2094 ##      List user temporary directories.
2095 ## </summary>
2096 ## <param name="domain">
2097 ##      <summary>
2098 ##      Domain allowed access.
2099 ##      </summary>
2100 ## </param>
2101 #
2102 interface(`userdom_list_user_tmp',`
2103         gen_require(`
2104                 type user_tmp_t;
2105         ')
2106
2107         allow $1 user_tmp_t:dir list_dir_perms;
2108         files_search_tmp($1)
2109 ')
2110
2111 ########################################
2112 ## <summary>
2113 ##      Do not audit attempts to list user
2114 ##      temporary directories.
2115 ## </summary>
2116 ## <param name="domain">
2117 ##      <summary>
2118 ##      Domain to not audit.
2119 ##      </summary>
2120 ## </param>
2121 #
2122 interface(`userdom_dontaudit_list_user_tmp',`
2123         gen_require(`
2124                 type user_tmp_t;
2125         ')
2126
2127         dontaudit $1 user_tmp_t:dir list_dir_perms;
2128 ')
2129
2130 ########################################
2131 ## <summary>
2132 ##      Do not audit attempts to manage users
2133 ##      temporary directories.
2134 ## </summary>
2135 ## <param name="domain">
2136 ##      <summary>
2137 ##      Domain to not audit.
2138 ##      </summary>
2139 ## </param>
2140 #
2141 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2142         gen_require(`
2143                 type user_tmp_t;
2144         ')
2145
2146         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2147 ')
2148
2149 ########################################
2150 ## <summary>
2151 ##      Read user temporary files.
2152 ## </summary>
2153 ## <param name="domain">
2154 ##      <summary>
2155 ##      Domain allowed access.
2156 ##      </summary>
2157 ## </param>
2158 #
2159 interface(`userdom_read_user_tmp_files',`
2160         gen_require(`
2161                 type user_tmp_t;
2162         ')
2163
2164         read_files_pattern($1, user_tmp_t, user_tmp_t)
2165         allow $1 user_tmp_t:dir list_dir_perms;
2166         files_search_tmp($1)
2167 ')
2168
2169 ########################################
2170 ## <summary>
2171 ##      Do not audit attempts to read users
2172 ##      temporary files.
2173 ## </summary>
2174 ## <param name="domain">
2175 ##      <summary>
2176 ##      Domain to not audit.
2177 ##      </summary>
2178 ## </param>
2179 #
2180 interface(`userdom_dontaudit_read_user_tmp_files',`
2181         gen_require(`
2182                 type user_tmp_t;
2183         ')
2184
2185         dontaudit $1 user_tmp_t:file read_file_perms;
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Do not audit attempts to append users
2191 ##      temporary files.
2192 ## </summary>
2193 ## <param name="domain">
2194 ##      <summary>
2195 ##      Domain to not audit.
2196 ##      </summary>
2197 ## </param>
2198 #
2199 interface(`userdom_dontaudit_append_user_tmp_files',`
2200         gen_require(`
2201                 type user_tmp_t;
2202         ')
2203
2204         dontaudit $1 user_tmp_t:file append_file_perms;
2205 ')
2206
2207 ########################################
2208 ## <summary>
2209 ##      Read and write user temporary files.
2210 ## </summary>
2211 ## <param name="domain">
2212 ##      <summary>
2213 ##      Domain allowed access.
2214 ##      </summary>
2215 ## </param>
2216 #
2217 interface(`userdom_rw_user_tmp_files',`
2218         gen_require(`
2219                 type user_tmp_t;
2220         ')
2221
2222         allow $1 user_tmp_t:dir list_dir_perms;
2223         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2224         files_search_tmp($1)
2225 ')
2226
2227 ########################################
2228 ## <summary>
2229 ##      Do not audit attempts to manage users
2230 ##      temporary files.
2231 ## </summary>
2232 ## <param name="domain">
2233 ##      <summary>
2234 ##      Domain to not audit.
2235 ##      </summary>
2236 ## </param>
2237 #
2238 interface(`userdom_dontaudit_manage_user_tmp_files',`
2239         gen_require(`
2240                 type user_tmp_t;
2241         ')
2242
2243         dontaudit $1 user_tmp_t:file manage_file_perms;
2244 ')
2245
2246 ########################################
2247 ## <summary>
2248 ##      Read user temporary symbolic links.
2249 ## </summary>
2250 ## <param name="domain">
2251 ##      <summary>
2252 ##      Domain allowed access.
2253 ##      </summary>
2254 ## </param>
2255 #
2256 interface(`userdom_read_user_tmp_symlinks',`
2257         gen_require(`
2258                 type user_tmp_t;
2259         ')
2260
2261         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2262         allow $1 user_tmp_t:dir list_dir_perms;
2263         files_search_tmp($1)
2264 ')
2265
2266 ########################################
2267 ## <summary>
2268 ##      Create, read, write, and delete user
2269 ##      temporary directories.
2270 ## </summary>
2271 ## <param name="domain">
2272 ##      <summary>
2273 ##      Domain allowed access.
2274 ##      </summary>
2275 ## </param>
2276 #
2277 interface(`userdom_manage_user_tmp_dirs',`
2278         gen_require(`
2279                 type user_tmp_t;
2280         ')
2281
2282         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2283         files_search_tmp($1)
2284 ')
2285
2286 ########################################
2287 ## <summary>
2288 ##      Create, read, write, and delete user
2289 ##      temporary files.
2290 ## </summary>
2291 ## <param name="domain">
2292 ##      <summary>
2293 ##      Domain allowed access.
2294 ##      </summary>
2295 ## </param>
2296 #
2297 interface(`userdom_manage_user_tmp_files',`
2298         gen_require(`
2299                 type user_tmp_t;
2300         ')
2301
2302         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2303         files_search_tmp($1)
2304 ')
2305
2306 ########################################
2307 ## <summary>
2308 ##      Create, read, write, and delete user
2309 ##      temporary symbolic links.
2310 ## </summary>
2311 ## <param name="domain">
2312 ##      <summary>
2313 ##      Domain allowed access.
2314 ##      </summary>
2315 ## </param>
2316 #
2317 interface(`userdom_manage_user_tmp_symlinks',`
2318         gen_require(`
2319                 type user_tmp_t;
2320         ')
2321
2322         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2323         files_search_tmp($1)
2324 ')
2325
2326 ########################################
2327 ## <summary>
2328 ##      Create, read, write, and delete user
2329 ##      temporary named pipes.
2330 ## </summary>
2331 ## <param name="domain">
2332 ##      <summary>
2333 ##      Domain allowed access.
2334 ##      </summary>
2335 ## </param>
2336 #
2337 interface(`userdom_manage_user_tmp_pipes',`
2338         gen_require(`
2339                 type user_tmp_t;
2340         ')
2341
2342         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2343         files_search_tmp($1)
2344 ')
2345
2346 ########################################
2347 ## <summary>
2348 ##      Create, read, write, and delete user
2349 ##      temporary named sockets.
2350 ## </summary>
2351 ## <param name="domain">
2352 ##      <summary>
2353 ##      Domain allowed access.
2354 ##      </summary>
2355 ## </param>
2356 #
2357 interface(`userdom_manage_user_tmp_sockets',`
2358         gen_require(`
2359                 type user_tmp_t;
2360         ')
2361
2362         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2363         files_search_tmp($1)
2364 ')
2365
2366 ########################################
2367 ## <summary>
2368 ##      Create objects in a user temporary directory
2369 ##      with an automatic type transition to
2370 ##      a specified private type.
2371 ## </summary>
2372 ## <param name="domain">
2373 ##      <summary>
2374 ##      Domain allowed access.
2375 ##      </summary>
2376 ## </param>
2377 ## <param name="private_type">
2378 ##      <summary>
2379 ##      The type of the object to create.
2380 ##      </summary>
2381 ## </param>
2382 ## <param name="object_class">
2383 ##      <summary>
2384 ##      The class of the object to be created.
2385 ##      </summary>
2386 ## </param>
2387 #
2388 interface(`userdom_user_tmp_filetrans',`
2389         gen_require(`
2390                 type user_tmp_t;
2391         ')
2392
2393         filetrans_pattern($1, user_tmp_t, $2, $3)
2394         files_search_tmp($1)
2395 ')
2396
2397 ########################################
2398 ## <summary>
2399 ##      Create objects in the temporary directory
2400 ##      with an automatic type transition to
2401 ##      the user temporary type.
2402 ## </summary>
2403 ## <param name="domain">
2404 ##      <summary>
2405 ##      Domain allowed access.
2406 ##      </summary>
2407 ## </param>
2408 ## <param name="object_class">
2409 ##      <summary>
2410 ##      The class of the object to be created.
2411 ##      </summary>
2412 ## </param>
2413 #
2414 interface(`userdom_tmp_filetrans_user_tmp',`
2415         gen_require(`
2416                 type user_tmp_t;
2417         ')
2418
2419         files_tmp_filetrans($1, user_tmp_t, $2)
2420 ')
2421
2422 ########################################
2423 ## <summary>
2424 ##      Read user tmpfs files.
2425 ## </summary>
2426 ## <param name="domain">
2427 ##      <summary>
2428 ##      Domain allowed access.
2429 ##      </summary>
2430 ## </param>
2431 #
2432 interface(`userdom_read_user_tmpfs_files',`
2433         gen_require(`
2434                 type user_tmpfs_t;
2435         ')
2436
2437         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2438         allow $1 user_tmpfs_t:dir list_dir_perms;
2439         fs_search_tmpfs($1)
2440 ')
2441
2442 ########################################
2443 ## <summary>
2444 ##      Read user tmpfs files.
2445 ## </summary>
2446 ## <param name="domain">
2447 ##      <summary>
2448 ##      Domain allowed access.
2449 ##      </summary>
2450 ## </param>
2451 #
2452 interface(`userdom_rw_user_tmpfs_files',`
2453         gen_require(`
2454                 type user_tmpfs_t;
2455         ')
2456
2457         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2458         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2459         allow $1 user_tmpfs_t:dir list_dir_perms;
2460         fs_search_tmpfs($1)
2461 ')
2462
2463 ########################################
2464 ## <summary>
2465 ##      Create, read, write, and delete user tmpfs files.
2466 ## </summary>
2467 ## <param name="domain">
2468 ##      <summary>
2469 ##      Domain allowed access.
2470 ##      </summary>
2471 ## </param>
2472 #
2473 interface(`userdom_manage_user_tmpfs_files',`
2474         gen_require(`
2475                 type user_tmpfs_t;
2476         ')
2477
2478         manage_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2479         allow $1 user_tmpfs_t:dir list_dir_perms;
2480         fs_search_tmpfs($1)
2481 ')
2482
2483 ########################################
2484 ## <summary>
2485 ##      Get the attributes of a user domain tty.
2486 ## </summary>
2487 ## <param name="domain">
2488 ##      <summary>
2489 ##      Domain allowed access.
2490 ##      </summary>
2491 ## </param>
2492 #
2493 interface(`userdom_getattr_user_ttys',`
2494         gen_require(`
2495                 type user_tty_device_t;
2496         ')
2497
2498         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2499 ')
2500
2501 ########################################
2502 ## <summary>
2503 ##      Do not audit attempts to get the attributes of a user domain tty.
2504 ## </summary>
2505 ## <param name="domain">
2506 ##      <summary>
2507 ##      Domain to not audit.
2508 ##      </summary>
2509 ## </param>
2510 #
2511 interface(`userdom_dontaudit_getattr_user_ttys',`
2512         gen_require(`
2513                 type user_tty_device_t;
2514         ')
2515
2516         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2517 ')
2518
2519 ########################################
2520 ## <summary>
2521 ##      Set the attributes of a user domain tty.
2522 ## </summary>
2523 ## <param name="domain">
2524 ##      <summary>
2525 ##      Domain allowed access.
2526 ##      </summary>
2527 ## </param>
2528 #
2529 interface(`userdom_setattr_user_ttys',`
2530         gen_require(`
2531                 type user_tty_device_t;
2532         ')
2533
2534         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2535 ')
2536
2537 ########################################
2538 ## <summary>
2539 ##      Do not audit attempts to set the attributes of a user domain tty.
2540 ## </summary>
2541 ## <param name="domain">
2542 ##      <summary>
2543 ##      Domain to not audit.
2544 ##      </summary>
2545 ## </param>
2546 #
2547 interface(`userdom_dontaudit_setattr_user_ttys',`
2548         gen_require(`
2549                 type user_tty_device_t;
2550         ')
2551
2552         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2553 ')
2554
2555 ########################################
2556 ## <summary>
2557 ##      Read and write a user domain tty.
2558 ## </summary>
2559 ## <param name="domain">
2560 ##      <summary>
2561 ##      Domain allowed access.
2562 ##      </summary>
2563 ## </param>
2564 #
2565 interface(`userdom_use_user_ttys',`
2566         gen_require(`
2567                 type user_tty_device_t;
2568         ')
2569
2570         allow $1 user_tty_device_t:chr_file rw_term_perms;
2571 ')
2572
2573 ########################################
2574 ## <summary>
2575 ##      Read and write a user domain pty.
2576 ## </summary>
2577 ## <param name="domain">
2578 ##      <summary>
2579 ##      Domain allowed access.
2580 ##      </summary>
2581 ## </param>
2582 #
2583 interface(`userdom_use_user_ptys',`
2584         gen_require(`
2585                 type user_devpts_t;
2586         ')
2587
2588         allow $1 user_devpts_t:chr_file rw_term_perms;
2589 ')
2590
2591 ########################################
2592 ## <summary>
2593 ##      Read and write a user TTYs and PTYs.
2594 ## </summary>
2595 ## <desc>
2596 ##      <p>
2597 ##      Allow the specified domain to read and write user
2598 ##      TTYs and PTYs. This will allow the domain to
2599 ##      interact with the user via the terminal. Typically
2600 ##      all interactive applications will require this
2601 ##      access.
2602 ##      </p>
2603 ##      <p>
2604 ##      However, this also allows the applications to spy
2605 ##      on user sessions or inject information into the
2606 ##      user session.  Thus, this access should likely
2607 ##      not be allowed for non-interactive domains.
2608 ##      </p>
2609 ## </desc>
2610 ## <param name="domain">
2611 ##      <summary>
2612 ##      Domain allowed access.
2613 ##      </summary>
2614 ## </param>
2615 ## <infoflow type="both" weight="10"/>
2616 #
2617 interface(`userdom_use_user_terminals',`
2618         gen_require(`
2619                 type user_tty_device_t, user_devpts_t;
2620         ')
2621
2622         allow $1 user_tty_device_t:chr_file rw_term_perms;
2623         allow $1 user_devpts_t:chr_file rw_term_perms;
2624         term_list_ptys($1)
2625 ')
2626
2627 ########################################
2628 ## <summary>
2629 ##      Do not audit attempts to read and write
2630 ##      a user domain tty and pty.
2631 ## </summary>
2632 ## <param name="domain">
2633 ##      <summary>
2634 ##      Domain to not audit.
2635 ##      </summary>
2636 ## </param>
2637 #
2638 interface(`userdom_dontaudit_use_user_terminals',`
2639         gen_require(`
2640                 type user_tty_device_t, user_devpts_t;
2641         ')
2642
2643         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
2644         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
2645 ')
2646
2647 ########################################
2648 ## <summary>
2649 ##      Execute a shell in all user domains.  This
2650 ##      is an explicit transition, requiring the
2651 ##      caller to use setexeccon().
2652 ## </summary>
2653 ## <param name="domain">
2654 ##      <summary>
2655 ##      Domain allowed to transition.
2656 ##      </summary>
2657 ## </param>
2658 #
2659 interface(`userdom_spec_domtrans_all_users',`
2660         gen_require(`
2661                 attribute userdomain;
2662         ')
2663
2664         corecmd_shell_spec_domtrans($1, userdomain)
2665         allow userdomain $1:fd use;
2666         allow userdomain $1:fifo_file rw_file_perms;
2667         allow userdomain $1:process sigchld;
2668 ')
2669
2670 ########################################
2671 ## <summary>
2672 ##      Execute an Xserver session in all unprivileged user domains.  This
2673 ##      is an explicit transition, requiring the
2674 ##      caller to use setexeccon().
2675 ## </summary>
2676 ## <param name="domain">
2677 ##      <summary>
2678 ##      Domain allowed to transition.
2679 ##      </summary>
2680 ## </param>
2681 #
2682 interface(`userdom_xsession_spec_domtrans_all_users',`
2683         gen_require(`
2684                 attribute userdomain;
2685         ')
2686
2687         xserver_xsession_spec_domtrans($1, userdomain)
2688         allow userdomain $1:fd use;
2689         allow userdomain $1:fifo_file rw_file_perms;
2690         allow userdomain $1:process sigchld;
2691 ')
2692
2693 ########################################
2694 ## <summary>
2695 ##      Execute a shell in all unprivileged user domains.  This
2696 ##      is an explicit transition, requiring the
2697 ##      caller to use setexeccon().
2698 ## </summary>
2699 ## <param name="domain">
2700 ##      <summary>
2701 ##      Domain allowed to transition.
2702 ##      </summary>
2703 ## </param>
2704 #
2705 interface(`userdom_spec_domtrans_unpriv_users',`
2706         gen_require(`
2707                 attribute unpriv_userdomain;
2708         ')
2709
2710         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
2711         allow unpriv_userdomain $1:fd use;
2712         allow unpriv_userdomain $1:fifo_file rw_file_perms;
2713         allow unpriv_userdomain $1:process sigchld;
2714 ')
2715
2716 ########################################
2717 ## <summary>
2718 ##      Execute an Xserver session in all unprivileged user domains.  This
2719 ##      is an explicit transition, requiring the
2720 ##      caller to use setexeccon().
2721 ## </summary>
2722 ## <param name="domain">
2723 ##      <summary>
2724 ##      Domain allowed to transition.
2725 ##      </summary>
2726 ## </param>
2727 #
2728 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
2729         gen_require(`
2730                 attribute unpriv_userdomain;
2731         ')
2732
2733         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
2734         allow unpriv_userdomain $1:fd use;
2735         allow unpriv_userdomain $1:fifo_file rw_file_perms;
2736         allow unpriv_userdomain $1:process sigchld;
2737 ')
2738
2739 #######################################
2740 ## <summary>
2741 ##      Read and write unpriviledged user SysV sempaphores.
2742 ## </summary>
2743 ## <param name="domain">
2744 ##      <summary>
2745 ##      Domain allowed access.
2746 ##      </summary>
2747 ## </param>
2748 #
2749 interface(`userdom_rw_unpriv_user_semaphores',`
2750         gen_require(`
2751                 attribute unpriv_userdomain;
2752         ')
2753
2754         allow $1 unpriv_userdomain:sem rw_sem_perms;
2755 ')
2756
2757 ########################################
2758 ## <summary>
2759 ##      Manage unpriviledged user SysV sempaphores.
2760 ## </summary>
2761 ## <param name="domain">
2762 ##      <summary>
2763 ##      Domain allowed access.
2764 ##      </summary>
2765 ## </param>
2766 #
2767 interface(`userdom_manage_unpriv_user_semaphores',`
2768         gen_require(`
2769                 attribute unpriv_userdomain;
2770         ')
2771
2772         allow $1 unpriv_userdomain:sem create_sem_perms;
2773 ')
2774
2775 #######################################
2776 ## <summary>
2777 ##      Read and write unpriviledged user SysV shared
2778 ##      memory segments.
2779 ## </summary>
2780 ## <param name="domain">
2781 ##      <summary>
2782 ##      Domain allowed access.
2783 ##      </summary>
2784 ## </param>
2785 #
2786 interface(`userdom_rw_unpriv_user_shared_mem',`
2787         gen_require(`
2788                 attribute unpriv_userdomain;
2789         ')
2790
2791         allow $1 unpriv_userdomain:shm rw_shm_perms;
2792 ')
2793
2794 ########################################
2795 ## <summary>
2796 ##      Manage unpriviledged user SysV shared
2797 ##      memory segments.
2798 ## </summary>
2799 ## <param name="domain">
2800 ##      <summary>
2801 ##      Domain allowed access.
2802 ##      </summary>
2803 ## </param>
2804 #
2805 interface(`userdom_manage_unpriv_user_shared_mem',`
2806         gen_require(`
2807                 attribute unpriv_userdomain;
2808         ')
2809
2810         allow $1 unpriv_userdomain:shm create_shm_perms;
2811 ')
2812
2813 ########################################
2814 ## <summary>
2815 ##      Execute bin_t in the unprivileged user domains. This
2816 ##      is an explicit transition, requiring the
2817 ##      caller to use setexeccon().
2818 ## </summary>
2819 ## <param name="domain">
2820 ##      <summary>
2821 ##      Domain allowed to transition.
2822 ##      </summary>
2823 ## </param>
2824 #
2825 interface(`userdom_bin_spec_domtrans_unpriv_users',`
2826         gen_require(`
2827                 attribute unpriv_userdomain;
2828         ')
2829
2830         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
2831         allow unpriv_userdomain $1:fd use;
2832         allow unpriv_userdomain $1:fifo_file rw_file_perms;
2833         allow unpriv_userdomain $1:process sigchld;
2834 ')
2835
2836 ########################################
2837 ## <summary>
2838 ##      Execute all entrypoint files in unprivileged user
2839 ##      domains. This is an explicit transition, requiring the
2840 ##      caller to use setexeccon().
2841 ## </summary>
2842 ## <param name="domain">
2843 ##      <summary>
2844 ##      Domain allowed access.
2845 ##      </summary>
2846 ## </param>
2847 #
2848 interface(`userdom_entry_spec_domtrans_unpriv_users',`
2849         gen_require(`
2850                 attribute unpriv_userdomain;
2851         ')
2852
2853         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
2854         allow unpriv_userdomain $1:fd use;
2855         allow unpriv_userdomain $1:fifo_file rw_file_perms;
2856         allow unpriv_userdomain $1:process sigchld;
2857 ')
2858
2859 ########################################
2860 ## <summary>
2861 ##      Search users home directories.
2862 ## </summary>
2863 ## <param name="domain">
2864 ##      <summary>
2865 ##      Domain allowed access.
2866 ##      </summary>
2867 ## </param>
2868 #
2869 interface(`userdom_search_user_home_content',`
2870         gen_require(`
2871                 type user_home_dir_t, user_home_t;
2872         ')
2873
2874         files_list_home($1)
2875         allow $1 { user_home_dir_t user_home_t }:dir search_dir_perms;
2876 ')
2877
2878 ########################################
2879 ## <summary>
2880 ##      Send signull to unprivileged user domains.
2881 ## </summary>
2882 ## <param name="domain">
2883 ##      <summary>
2884 ##      Domain allowed access.
2885 ##      </summary>
2886 ## </param>
2887 #
2888 interface(`userdom_signull_unpriv_users',`
2889         gen_require(`
2890                 attribute unpriv_userdomain;
2891         ')
2892
2893         allow $1 unpriv_userdomain:process signull;
2894 ')
2895
2896 ########################################
2897 ## <summary>
2898 ##      Send general signals to unprivileged user domains.
2899 ## </summary>
2900 ## <param name="domain">
2901 ##      <summary>
2902 ##      Domain allowed access.
2903 ##      </summary>
2904 ## </param>
2905 #
2906 interface(`userdom_signal_unpriv_users',`
2907         gen_require(`
2908                 attribute unpriv_userdomain;
2909         ')
2910
2911         allow $1 unpriv_userdomain:process signal;
2912 ')
2913
2914 ########################################
2915 ## <summary>
2916 ##      Inherit the file descriptors from unprivileged user domains.
2917 ## </summary>
2918 ## <param name="domain">
2919 ##      <summary>
2920 ##      Domain allowed access.
2921 ##      </summary>
2922 ## </param>
2923 #
2924 interface(`userdom_use_unpriv_users_fds',`
2925         gen_require(`
2926                 attribute unpriv_userdomain;
2927         ')
2928
2929         allow $1 unpriv_userdomain:fd use;
2930 ')
2931
2932 ########################################
2933 ## <summary>
2934 ##      Do not audit attempts to inherit the file descriptors
2935 ##      from unprivileged user domains.
2936 ## </summary>
2937 ## <desc>
2938 ##      <p>
2939 ##      Do not audit attempts to inherit the file descriptors
2940 ##      from unprivileged user domains. This will supress
2941 ##      SELinux denial messages when the specified domain is denied
2942 ##      the permission to inherit these file descriptors.
2943 ##      </p>
2944 ## </desc>
2945 ## <param name="domain">
2946 ##      <summary>
2947 ##      Domain to not audit.
2948 ##      </summary>
2949 ## </param>
2950 ## <infoflow type="none"/>
2951 #
2952 interface(`userdom_dontaudit_use_unpriv_user_fds',`
2953         gen_require(`
2954                 attribute unpriv_userdomain;
2955         ')
2956
2957         dontaudit $1 unpriv_userdomain:fd use;
2958 ')
2959
2960 ########################################
2961 ## <summary>
2962 ##      Do not audit attempts to use user ptys.
2963 ## </summary>
2964 ## <param name="domain">
2965 ##      <summary>
2966 ##      Domain to not audit.
2967 ##      </summary>
2968 ## </param>
2969 #
2970 interface(`userdom_dontaudit_use_user_ptys',`
2971         gen_require(`
2972                 type user_devpts_t;
2973         ')
2974
2975         dontaudit $1 user_devpts_t:chr_file rw_file_perms;
2976 ')
2977
2978 ########################################
2979 ## <summary>
2980 ##      Relabel files to unprivileged user pty types.
2981 ## </summary>
2982 ## <param name="domain">
2983 ##      <summary>
2984 ##      Domain allowed access.
2985 ##      </summary>
2986 ## </param>
2987 #
2988 interface(`userdom_relabelto_user_ptys',`
2989         gen_require(`
2990                 type user_devpts_t;
2991         ')
2992
2993         allow $1 user_devpts_t:chr_file relabelto;
2994 ')
2995
2996 ########################################
2997 ## <summary>
2998 ##      Do not audit attempts to relabel files from
2999 ##      user pty types.
3000 ## </summary>
3001 ## <param name="domain">
3002 ##      <summary>
3003 ##      Domain to not audit.
3004 ##      </summary>
3005 ## </param>
3006 #
3007 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3008         gen_require(`
3009                 type user_devpts_t;
3010         ')
3011
3012         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3013 ')
3014
3015 ########################################
3016 ## <summary>
3017 ##      Write all users files in /tmp
3018 ## </summary>
3019 ## <param name="domain">
3020 ##      <summary>
3021 ##      Domain allowed access.
3022 ##      </summary>
3023 ## </param>
3024 #
3025 interface(`userdom_write_user_tmp_files',`
3026         gen_require(`
3027                 type user_tmp_t;
3028         ')
3029
3030         allow $1 user_tmp_t:file write_file_perms;
3031 ')
3032
3033 ########################################
3034 ## <summary>
3035 ##      Do not audit attempts to use user ttys.
3036 ## </summary>
3037 ## <param name="domain">
3038 ##      <summary>
3039 ##      Domain to not audit.
3040 ##      </summary>
3041 ## </param>
3042 #
3043 interface(`userdom_dontaudit_use_user_ttys',`
3044         gen_require(`
3045                 type user_tty_device_t;
3046         ')
3047
3048         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3049 ')
3050
3051 ########################################
3052 ## <summary>
3053 ##      Read the process state of all user domains.
3054 ## </summary>
3055 ## <param name="domain">
3056 ##      <summary>
3057 ##      Domain allowed access.
3058 ##      </summary>
3059 ## </param>
3060 #
3061 interface(`userdom_read_all_users_state',`
3062         gen_require(`
3063                 attribute userdomain;
3064         ')
3065
3066         read_files_pattern($1, userdomain, userdomain)
3067         kernel_search_proc($1)
3068 ')
3069
3070 ########################################
3071 ## <summary>
3072 ##      Get the attributes of all user domains.
3073 ## </summary>
3074 ## <param name="domain">
3075 ##      <summary>
3076 ##      Domain allowed access.
3077 ##      </summary>
3078 ## </param>
3079 #
3080 interface(`userdom_getattr_all_users',`
3081         gen_require(`
3082                 attribute userdomain;
3083         ')
3084
3085         allow $1 userdomain:process getattr;
3086 ')
3087
3088 ########################################
3089 ## <summary>
3090 ##      Inherit the file descriptors from all user domains
3091 ## </summary>
3092 ## <param name="domain">
3093 ##      <summary>
3094 ##      Domain allowed access.
3095 ##      </summary>
3096 ## </param>
3097 #
3098 interface(`userdom_use_all_users_fds',`
3099         gen_require(`
3100                 attribute userdomain;
3101         ')
3102
3103         allow $1 userdomain:fd use;
3104 ')
3105
3106 ########################################
3107 ## <summary>
3108 ##      Do not audit attempts to inherit the file
3109 ##      descriptors from any user domains.
3110 ## </summary>
3111 ## <param name="domain">
3112 ##      <summary>
3113 ##      Domain to not audit.
3114 ##      </summary>
3115 ## </param>
3116 #
3117 interface(`userdom_dontaudit_use_all_users_fds',`
3118         gen_require(`
3119                 attribute userdomain;
3120         ')
3121
3122         dontaudit $1 userdomain:fd use;
3123 ')
3124
3125 ########################################
3126 ## <summary>
3127 ##      Send general signals to all user domains.
3128 ## </summary>
3129 ## <param name="domain">
3130 ##      <summary>
3131 ##      Domain allowed access.
3132 ##      </summary>
3133 ## </param>
3134 #
3135 interface(`userdom_signal_all_users',`
3136         gen_require(`
3137                 attribute userdomain;
3138         ')
3139
3140         allow $1 userdomain:process signal;
3141 ')
3142
3143 ########################################
3144 ## <summary>
3145 ##      Send a SIGCHLD signal to all user domains.
3146 ## </summary>
3147 ## <param name="domain">
3148 ##      <summary>
3149 ##      Domain allowed access.
3150 ##      </summary>
3151 ## </param>
3152 #
3153 interface(`userdom_sigchld_all_users',`
3154         gen_require(`
3155                 attribute userdomain;
3156         ')
3157
3158         allow $1 userdomain:process sigchld;
3159 ')
3160
3161 ########################################
3162 ## <summary>
3163 ##      Create keys for all user domains.
3164 ## </summary>
3165 ## <param name="domain">
3166 ##      <summary>
3167 ##      Domain allowed access.
3168 ##      </summary>
3169 ## </param>
3170 #
3171 interface(`userdom_create_all_users_keys',`
3172         gen_require(`
3173                 attribute userdomain;
3174         ')
3175
3176         allow $1 userdomain:key create;
3177 ')
3178
3179 ########################################
3180 ## <summary>
3181 ##      Send a dbus message to all user domains.
3182 ## </summary>
3183 ## <param name="domain">
3184 ##      <summary>
3185 ##      Domain allowed access.
3186 ##      </summary>
3187 ## </param>
3188 #
3189 interface(`userdom_dbus_send_all_users',`
3190         gen_require(`
3191                 attribute userdomain;
3192                 class dbus send_msg;
3193         ')
3194
3195         allow $1 userdomain:dbus send_msg;
3196 ')