policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678                 alsa_filetrans_named_content($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 nsplugin_role($1_r, $1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_mysql_connect',`
 797                         mysql_stream_connect($1_t)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 oident_manage_user_content($1_t)
 803                 oident_relabel_user_content($1_t)
 804         ')
 805
 806         optional_policy(`
 807                 # to allow monitoring of pcmcia status
 808                 pcmcia_read_pid($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 pcscd_read_pub_files($1_usertype)
 813                 pcscd_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 tunable_policy(`allow_user_postgresql_connect',`
 818                         postgresql_stream_connect($1_usertype)
 819                         postgresql_tcp_connect($1_usertype)
 820                 ')
 821         ')
 822
 823         optional_policy(`
 824                 resmgr_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpc_dontaudit_getattr_exports($1_usertype)
 829                 rpc_manage_nfs_rw_content($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 rpcbind_stream_connect($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 samba_stream_connect_winbind($1_usertype)
 838         ')
 839
 840         optional_policy(`
 841                 sandbox_transition($1_usertype, $1_r)
 842         ')
 843
 844         optional_policy(`
 845                 seunshare_role_template($1, $1_r, $1_t)
 846         ')
 847
 848         optional_policy(`
 849                 slrnpull_search_spool($1_usertype)
 850         ')
 851
 852 ')
 853
 854 #######################################
 855 ## <summary>
 856 ##      The template for creating a login user.
 857 ## </summary>
 858 ## <desc>
 859 ##      <p>
 860 ##      This template creates a user domain, types, and
 861 ##      rules for the user's tty, pty, home directories,
 862 ##      tmp, and tmpfs files.
 863 ##      </p>
 864 ## </desc>
 865 ## <param name="userdomain_prefix">
 866 ##      <summary>
 867 ##      The prefix of the user domain (e.g., user
 868 ##      is the prefix for user_t).
 869 ##      </summary>
 870 ## </param>
 871 #
 872 template(`userdom_login_user_template', `
 873         gen_require(`
 874                 class context contains;
 875         ')
 876
 877         userdom_base_user_template($1)
 878
 879         userdom_manage_home_role($1_r, $1_usertype)
 880
 881         userdom_manage_tmp_role($1_r, $1_usertype)
 882         userdom_manage_tmpfs_role($1_r, $1_usertype)
 883
 884         ifelse(`$1',`unconfined',`',`
 885                 gen_tunable(allow_$1_exec_content, true)
 886
 887                 tunable_policy(`allow_$1_exec_content',`
 888                         userdom_exec_user_tmp_files($1_usertype)
 889                         userdom_exec_user_home_content_files($1_usertype)
 890                 ')
 891                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 892                         fs_exec_nfs_files($1_usertype)
 893                 ')
 894
 895                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 896                         fs_exec_cifs_files($1_usertype)
 897                 ')
 898         ')
 899
 900         userdom_change_password_template($1)
 901
 902         ##############################
 903         #
 904         # User domain Local policy
 905         #
 906
 907         allow $1_t self:capability { setgid chown fowner };
 908         dontaudit $1_t self:capability { sys_nice fsetid };
 909
 910         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 911         dontaudit $1_t self:process setrlimit;
 912         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 913
 914         allow $1_t self:context contains;
 915
 916         kernel_dontaudit_read_system_state($1_usertype)
 917         kernel_dontaudit_list_all_proc($1_usertype)
 918
 919         dev_read_sysfs($1_usertype)
 920         dev_read_urand($1_usertype)
 921
 922         domain_use_interactive_fds($1_usertype)
 923         # Command completion can fire hundreds of denials
 924         domain_dontaudit_exec_all_entry_files($1_usertype)
 925
 926         files_dontaudit_list_default($1_usertype)
 927         files_dontaudit_read_default_files($1_usertype)
 928         # Stat lost+found.
 929         files_getattr_lost_found_dirs($1_usertype)
 930
 931         fs_get_all_fs_quotas($1_usertype)
 932         fs_getattr_all_fs($1_usertype)
 933         fs_search_all($1_usertype)
 934         fs_list_inotifyfs($1_usertype)
 935         fs_rw_anon_inodefs_files($1_usertype)
 936
 937         auth_dontaudit_write_login_records($1_t)
 938         auth_rw_cache($1_t)
 939
 940         application_exec_all($1_t)
 941         # The library functions always try to open read-write first,
 942         # then fall back to read-only if it fails.
 943         init_dontaudit_rw_utmp($1_t)
 944
 945         # Stop warnings about access to /dev/console
 946         init_dontaudit_use_fds($1_usertype)
 947         init_dontaudit_use_script_fds($1_usertype)
 948
 949         libs_exec_lib_files($1_usertype)
 950
 951         logging_dontaudit_getattr_all_logs($1_usertype)
 952
 953         # for running TeX programs
 954         miscfiles_read_tetex_data($1_usertype)
 955         miscfiles_exec_tetex_data($1_usertype)
 956
 957         seutil_read_config($1_usertype)
 958
 959         optional_policy(`
 960                 cups_read_config($1_usertype)
 961                 cups_stream_connect($1_usertype)
 962                 cups_stream_connect_ptal($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 kerberos_use($1_usertype)
 967                 kerberos_filetrans_home_content($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 mta_dontaudit_read_spool_symlinks($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 quota_dontaudit_getattr_db($1_usertype)
 976         ')
 977
 978         optional_policy(`
 979                 rpm_read_db($1_usertype)
 980                 rpm_dontaudit_manage_db($1_usertype)
 981                 rpm_read_cache($1_usertype)
 982         ')
 983
 984         optional_policy(`
 985                 oddjob_run_mkhomedir($1_t, $1_r)
 986         ')
 987 ')
 988
 989 #######################################
 990 ## <summary>
 991 ##      The template for creating a unprivileged login user.
 992 ## </summary>
 993 ## <desc>
 994 ##      <p>
 995 ##      This template creates a user domain, types, and
 996 ##      rules for the user's tty, pty, home directories,
 997 ##      tmp, and tmpfs files.
 998 ##      </p>
 999 ## </desc>
1000 ## <param name="userdomain_prefix">
1001 ##      <summary>
1002 ##      The prefix of the user domain (e.g., user
1003 ##      is the prefix for user_t).
1004 ##      </summary>
1005 ## </param>
1006 #
1007 template(`userdom_restricted_user_template',`
1008         gen_require(`
1009                 attribute unpriv_userdomain;
1010         ')
1011
1012         userdom_login_user_template($1)
1013
1014         typeattribute $1_t unpriv_userdomain;
1015         domain_interactive_fd($1_t)
1016
1017         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1018         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1019
1020         ##############################
1021         #
1022         # Local policy
1023         #
1024
1025         optional_policy(`
1026                 loadkeys_run($1_t, $1_r)
1027         ')
1028 ')
1029
1030 #######################################
1031 ## <summary>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ## </summary>
1034 ## <desc>
1035 ##      <p>
1036 ##      The template for creating a unprivileged xwindows login user.
1037 ##      </p>
1038 ##      <p>
1039 ##      This template creates a user domain, types, and
1040 ##      rules for the user's tty, pty, home directories,
1041 ##      tmp, and tmpfs files.
1042 ##      </p>
1043 ## </desc>
1044 ## <param name="userdomain_prefix">
1045 ##      <summary>
1046 ##      The prefix of the user domain (e.g., user
1047 ##      is the prefix for user_t).
1048 ##      </summary>
1049 ## </param>
1050 #
1051 template(`userdom_restricted_xwindows_user_template',`
1052
1053         userdom_restricted_user_template($1)
1054
1055         ##############################
1056         #
1057         # Local policy
1058         #
1059
1060         auth_role($1_r, $1_t)
1061         auth_search_pam_console_data($1_usertype)
1062         auth_dontaudit_read_login_records($1_usertype)
1063
1064         dev_read_sound($1_usertype)
1065         dev_write_sound($1_usertype)
1066         # gnome keyring wants to read this.
1067         dev_dontaudit_read_rand($1_usertype)
1068         # temporarily allow since openoffice requires this
1069         dev_read_rand($1_usertype)
1070
1071         dev_read_video_dev($1_usertype)
1072         dev_write_video_dev($1_usertype)
1073         dev_rw_wireless($1_usertype)
1074
1075         libs_dontaudit_setattr_lib_files($1_usertype)
1076
1077         tunable_policy(`user_rw_noexattrfile',`
1078                 dev_rw_usbfs($1_t)
1079                 dev_rw_generic_usb_dev($1_usertype)
1080
1081                 fs_manage_noxattr_fs_files($1_usertype)
1082                 fs_manage_noxattr_fs_dirs($1_usertype)
1083                 fs_manage_dos_dirs($1_usertype)
1084                 fs_manage_dos_files($1_usertype)
1085                 storage_raw_read_removable_device($1_usertype)
1086                 storage_raw_write_removable_device($1_usertype)
1087         ')
1088
1089         logging_send_syslog_msg($1_usertype)
1090         logging_dontaudit_send_audit_msgs($1_t)
1091
1092         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1093         logging_send_audit_msgs($1_t)
1094         selinux_get_enforce_mode($1_t)
1095         seutil_exec_restorecond($1_t)
1096         seutil_read_file_contexts($1_t)
1097         seutil_read_default_contexts($1_t)
1098
1099         xserver_restricted_role($1_r, $1_t)
1100
1101         optional_policy(`
1102                 alsa_read_rw_config($1_usertype)
1103         ')
1104
1105          # cjp: needed by KDE apps
1106          # bug: #682499
1107          optional_policy(`
1108                 gnome_read_usr_config($1_usertype)
1109                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1110                 # cjp: telepathy F15 bugs
1111                 telepathy_role($1_r, $1_t, $1)
1112         ')
1113
1114         optional_policy(`
1115                 dbus_role_template($1, $1_r, $1_usertype)
1116                 dbus_system_bus_client($1_usertype)
1117                 allow $1_usertype $1_usertype:dbus send_msg;
1118
1119                 optional_policy(`
1120                         abrt_dbus_chat($1_usertype)
1121                         abrt_run_helper($1_usertype, $1_r)
1122                 ')
1123
1124                 optional_policy(`
1125                         consolekit_dontaudit_read_log($1_usertype)
1126                         consolekit_dbus_chat($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         cups_dbus_chat($1_usertype)
1131                         cups_dbus_chat_config($1_usertype)
1132                 ')
1133
1134                 optional_policy(`
1135                         devicekit_dbus_chat($1_usertype)
1136                         devicekit_dbus_chat_disk($1_usertype)
1137                         devicekit_dbus_chat_power($1_usertype)
1138                 ')
1139
1140                 optional_policy(`
1141                         fprintd_dbus_chat($1_t)
1142                 ')
1143         ')
1144
1145         optional_policy(`
1146                 openoffice_role_template($1, $1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 policykit_role($1_r, $1_usertype)
1151         ')
1152
1153         optional_policy(`
1154                 pulseaudio_role($1_r, $1_usertype)
1155                 pulseaudio_filetrans_admin_home_content($1_usertype)
1156                 pulseaudio_filetrans_home_content($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 rtkit_scheduled($1_usertype)
1161         ')
1162
1163         optional_policy(`
1164                 setroubleshoot_dontaudit_stream_connect($1_t)
1165         ')
1166
1167         optional_policy(`
1168                 udev_read_db($1_usertype)
1169         ')
1170
1171         optional_policy(`
1172                 wm_role_template($1, $1_r, $1_t)
1173         ')
1174 ')
1175
1176 #######################################
1177 ## <summary>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      The template for creating a unprivileged user roughly
1184 ##      equivalent to a regular linux user.
1185 ##      </p>
1186 ##      <p>
1187 ##      This template creates a user domain, types, and
1188 ##      rules for the user's tty, pty, home directories,
1189 ##      tmp, and tmpfs files.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="userdomain_prefix">
1193 ##      <summary>
1194 ##      The prefix of the user domain (e.g., user
1195 ##      is the prefix for user_t).
1196 ##      </summary>
1197 ## </param>
1198 #
1199 template(`userdom_unpriv_user_template', `
1200
1201         ##############################
1202         #
1203         # Declarations
1204         #
1205
1206         # Inherit rules for ordinary users.
1207         userdom_restricted_xwindows_user_template($1)
1208         userdom_common_user_template($1)
1209
1210         ##############################
1211         #
1212         # Local policy
1213         #
1214
1215         # port access is audited even if dac would not have allowed it, so dontaudit it here
1216 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1217         # Need the following rule to allow users to run vpnc
1218         corenet_tcp_bind_xserver_port($1_t)
1219         corenet_tcp_bind_generic_node($1_usertype)
1220
1221         storage_rw_fuse($1_t)
1222
1223         files_exec_usr_files($1_t)
1224    # cjp: why?
1225         files_read_kernel_symbol_table($1_t)
1226
1227         ifndef(`enable_mls',`
1228                 fs_exec_noxattr($1_t)
1229
1230                 tunable_policy(`user_rw_noexattrfile',`
1231                         fs_manage_noxattr_fs_files($1_t)
1232                         fs_manage_noxattr_fs_dirs($1_t)
1233                         # Write floppies
1234                         storage_raw_read_removable_device($1_t)
1235                         storage_raw_write_removable_device($1_t)
1236                 ',`
1237                         storage_raw_read_removable_device($1_t)
1238                 ')
1239         ')
1240
1241         miscfiles_read_hwdata($1_usertype)
1242
1243         # Allow users to run TCP servers (bind to ports and accept connection from
1244         # the same domain and outside users) disabling this forces FTP passive mode
1245         # and may change other protocols
1246
1247         tunable_policy(`user_share_music',`
1248                 corenet_tcp_bind_daap_port($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_tcp_server',`
1252                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1253         ')
1254
1255         tunable_policy(`user_setrlimit',`
1256                 allow $1_usertype self:process setrlimit;
1257         ')
1258
1259         optional_policy(`
1260                 cdrecord_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 cron_role($1_r, $1_t)
1265         ')
1266
1267         optional_policy(`
1268                 games_rw_data($1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gpg_role($1_r, $1_usertype)
1273         ')
1274
1275         optional_policy(`
1276                 gnomeclock_dbus_chat($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 gpm_stream_connect($1_usertype)
1281         ')
1282
1283         optional_policy(`
1284                 execmem_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 java_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mono_role_template($1, $1_r, $1_t)
1293         ')
1294
1295         optional_policy(`
1296                 mount_run_fusermount($1_t, $1_r)
1297                 mount_read_pid_files($1_t)
1298         ')
1299
1300         optional_policy(`
1301                 wine_role_template($1, $1_r, $1_t)
1302         ')
1303
1304         optional_policy(`
1305                 postfix_run_postdrop($1_t, $1_r)
1306                 postfix_search_spool($1_t)
1307         ')
1308
1309         # Run pppd in pppd_t by default for user
1310         optional_policy(`
1311                 ppp_run_cond($1_t, $1_r)
1312         ')
1313
1314         optional_policy(`
1315                 vdagent_getattr_log($1_t)
1316                 vdagent_getattr_exec($1_t)
1317                 vdagent_stream_connect($1_t)
1318         ')
1319 ')
1320
1321 #######################################
1322 ## <summary>
1323 ##      The template for creating an administrative user.
1324 ## </summary>
1325 ## <desc>
1326 ##      <p>
1327 ##      This template creates a user domain, types, and
1328 ##      rules for the user's tty, pty, home directories,
1329 ##      tmp, and tmpfs files.
1330 ##      </p>
1331 ##      <p>
1332 ##      The privileges given to administrative users are:
1333 ##      <ul>
1334 ##              <li>Raw disk access</li>
1335 ##              <li>Set all sysctls</li>
1336 ##              <li>All kernel ring buffer controls</li>
1337 ##              <li>Create, read, write, and delete all files but shadow</li>
1338 ##              <li>Manage source and binary format SELinux policy</li>
1339 ##              <li>Run insmod</li>
1340 ##      </ul>
1341 ##      </p>
1342 ## </desc>
1343 ## <param name="userdomain_prefix">
1344 ##      <summary>
1345 ##      The prefix of the user domain (e.g., sysadm
1346 ##      is the prefix for sysadm_t).
1347 ##      </summary>
1348 ## </param>
1349 #
1350 template(`userdom_admin_user_template',`
1351         gen_require(`
1352                 attribute admindomain;
1353                 class passwd { passwd chfn chsh rootok crontab };
1354         ')
1355
1356         ##############################
1357         #
1358         # Declarations
1359         #
1360
1361         # Inherit rules for ordinary users.
1362         userdom_login_user_template($1)
1363         userdom_common_user_template($1)
1364
1365         domain_obj_id_change_exemption($1_t)
1366         role system_r types $1_t;
1367
1368         typeattribute $1_t admindomain;
1369
1370         ifdef(`direct_sysadm_daemon',`
1371                 domain_system_change_exemption($1_t)
1372         ')
1373
1374         ##############################
1375         #
1376         # $1_t local policy
1377         #
1378
1379         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1380         allow $1_t self:capability2 syslog;
1381         allow $1_t self:process { setexec setfscreate };
1382         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1383         allow $1_t self:tun_socket create;
1384         # Set password information for other users.
1385         allow $1_t self:passwd { passwd chfn chsh };
1386         # Skip authentication when pam_rootok is specified.
1387         allow $1_t self:passwd rootok;
1388
1389         # Manipulate other users crontab.
1390         allow $1_t self:passwd crontab;
1391
1392         kernel_read_software_raid_state($1_t)
1393         kernel_getattr_core_if($1_t)
1394         kernel_getattr_message_if($1_t)
1395         kernel_change_ring_buffer_level($1_t)
1396         kernel_clear_ring_buffer($1_t)
1397         kernel_read_ring_buffer($1_t)
1398         kernel_get_sysvipc_info($1_t)
1399         kernel_rw_all_sysctls($1_t)
1400         # signal unlabeled processes:
1401         kernel_kill_unlabeled($1_t)
1402         kernel_signal_unlabeled($1_t)
1403         kernel_sigstop_unlabeled($1_t)
1404         kernel_signull_unlabeled($1_t)
1405         kernel_sigchld_unlabeled($1_t)
1406         kernel_signal($1_t)
1407
1408         corenet_tcp_bind_generic_port($1_t)
1409         # allow setting up tunnels
1410         corenet_rw_tun_tap_dev($1_t)
1411
1412         dev_getattr_generic_blk_files($1_t)
1413         dev_getattr_generic_chr_files($1_t)
1414         # for lsof
1415         dev_getattr_mtrr_dev($1_t)
1416         # Allow MAKEDEV to work
1417         dev_create_all_blk_files($1_t)
1418         dev_create_all_chr_files($1_t)
1419         dev_delete_all_blk_files($1_t)
1420         dev_delete_all_chr_files($1_t)
1421         dev_rename_all_blk_files($1_t)
1422         dev_rename_all_chr_files($1_t)
1423         dev_create_generic_symlinks($1_t)
1424         dev_rw_generic_usb_dev($1_t)
1425         dev_rw_usbfs($1_t)
1426
1427         domain_setpriority_all_domains($1_t)
1428         domain_read_all_domains_state($1_t)
1429         domain_getattr_all_domains($1_t)
1430         domain_getcap_all_domains($1_t)
1431         domain_dontaudit_ptrace_all_domains($1_t)
1432         # signal all domains:
1433         domain_kill_all_domains($1_t)
1434         domain_signal_all_domains($1_t)
1435         domain_signull_all_domains($1_t)
1436         domain_sigstop_all_domains($1_t)
1437         domain_sigstop_all_domains($1_t)
1438         domain_sigchld_all_domains($1_t)
1439         # for lsof
1440         domain_getattr_all_sockets($1_t)
1441         domain_dontaudit_getattr_all_sockets($1_t)
1442
1443         files_exec_usr_src_files($1_t)
1444
1445         fs_getattr_all_fs($1_t)
1446         fs_getattr_all_files($1_t)
1447         fs_list_all($1_t)
1448         fs_set_all_quotas($1_t)
1449         fs_exec_noxattr($1_t)
1450
1451         storage_raw_read_removable_device($1_t)
1452         storage_raw_write_removable_device($1_t)
1453         storage_dontaudit_read_fixed_disk($1_t)
1454
1455         term_use_all_inherited_terms($1_t)
1456         term_use_unallocated_ttys($1_t)
1457
1458         auth_getattr_shadow($1_t)
1459         # Manage almost all files
1460         files_manage_non_security_dirs($1_t)
1461         files_manage_non_security_files($1_t)
1462         # Relabel almost all files
1463         files_relabel_non_security_files($1_t)
1464
1465         init_telinit($1_t)
1466
1467         logging_send_syslog_msg($1_t)
1468
1469         optional_policy(`
1470                 modutils_domtrans_insmod($1_t)
1471                 modutils_domtrans_depmod($1_t)
1472         ')
1473
1474         # The following rule is temporary until such time that a complete
1475         # policy management infrastructure is in place so that an administrator
1476         # cannot directly manipulate policy files with arbitrary programs.
1477         seutil_manage_src_policy($1_t)
1478         # Violates the goal of limiting write access to checkpolicy.
1479         # But presently necessary for installing the file_contexts file.
1480         seutil_manage_bin_policy($1_t)
1481
1482         systemd_config_all_services($1_t)
1483
1484         userdom_manage_user_home_content_dirs($1_t)
1485         userdom_manage_user_home_content_files($1_t)
1486         userdom_manage_user_home_content_symlinks($1_t)
1487         userdom_manage_user_home_content_pipes($1_t)
1488         userdom_manage_user_home_content_sockets($1_t)
1489         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1490
1491         tunable_policy(`user_rw_noexattrfile',`
1492                 fs_manage_noxattr_fs_files($1_t)
1493                 fs_manage_noxattr_fs_dirs($1_t)
1494         ',`
1495                 fs_read_noxattr_fs_files($1_t)
1496         ')
1497
1498         optional_policy(`
1499                 postgresql_unconfined($1_t)
1500         ')
1501
1502         optional_policy(`
1503                 userhelper_exec($1_t)
1504         ')
1505 ')
1506
1507 ########################################
1508 ## <summary>
1509 ##      Allow user to run as a secadm
1510 ## </summary>
1511 ## <desc>
1512 ##      <p>
1513 ##      Create objects in a user home directory
1514 ##      with an automatic type transition to
1515 ##      a specified private type.
1516 ##      </p>
1517 ##      <p>
1518 ##      This is a templated interface, and should only
1519 ##      be called from a per-userdomain template.
1520 ##      </p>
1521 ## </desc>
1522 ## <param name="domain">
1523 ##      <summary>
1524 ##      Domain allowed access.
1525 ##      </summary>
1526 ## </param>
1527 ## <param name="role">
1528 ##      <summary>
1529 ##      The role  of the object to create.
1530 ##      </summary>
1531 ## </param>
1532 #
1533 template(`userdom_security_admin_template',`
1534         allow $1 self:capability { dac_read_search dac_override };
1535
1536         corecmd_exec_shell($1)
1537
1538         domain_obj_id_change_exemption($1)
1539
1540         dev_relabel_all_dev_nodes($1)
1541
1542         files_create_boot_flag($1)
1543         files_create_default_dir($1)
1544         files_root_filetrans_default($1, dir)
1545
1546         # Necessary for managing /boot/efi
1547         fs_manage_dos_files($1)
1548
1549         mls_process_read_up($1)
1550         mls_file_read_all_levels($1)
1551         mls_file_upgrade($1)
1552         mls_file_downgrade($1)
1553
1554         selinux_set_enforce_mode($1)
1555         selinux_set_all_booleans($1)
1556         selinux_set_parameters($1)
1557         selinux_read_policy($1)
1558
1559         files_relabel_all_files($1)
1560         auth_relabel_shadow($1)
1561
1562         init_exec($1)
1563
1564         logging_send_syslog_msg($1)
1565         logging_read_audit_log($1)
1566         logging_read_generic_logs($1)
1567         logging_read_audit_config($1)
1568
1569         seutil_manage_bin_policy($1)
1570         seutil_manage_default_contexts($1)
1571         seutil_manage_file_contexts($1)
1572         seutil_manage_module_store($1)
1573         seutil_manage_config($1)
1574         seutil_run_checkpolicy($1,$2)
1575         seutil_run_loadpolicy($1,$2)
1576         seutil_run_semanage($1,$2)
1577         seutil_run_setsebool($1,$2)
1578         seutil_run_setfiles($1, $2)
1579
1580         seutil_manage_bin_policy($1)
1581     seutil_manage_default_contexts($1)
1582     seutil_manage_file_contexts($1)
1583     seutil_manage_module_store($1)
1584     seutil_manage_config($1)
1585
1586         optional_policy(`
1587                 aide_run($1,$2)
1588         ')
1589
1590         optional_policy(`
1591                 consoletype_exec($1)
1592         ')
1593
1594         optional_policy(`
1595                 dmesg_exec($1)
1596         ')
1597
1598         optional_policy(`
1599                 ipsec_run_setkey($1,$2)
1600         ')
1601
1602         optional_policy(`
1603                 netlabel_run_mgmt($1,$2)
1604         ')
1605
1606         optional_policy(`
1607                 samhain_run($1, $2)
1608         ')
1609 ')
1610
1611 ########################################
1612 ## <summary>
1613 ##      Make the specified type usable in a
1614 ##      user home directory.
1615 ## </summary>
1616 ## <param name="type">
1617 ##      <summary>
1618 ##      Type to be used as a file in the
1619 ##      user home directory.
1620 ##      </summary>
1621 ## </param>
1622 #
1623 interface(`userdom_user_home_content',`
1624         gen_require(`
1625                 type user_home_t;
1626                 attribute user_home_type;
1627         ')
1628
1629         allow $1 user_home_t:filesystem associate;
1630         files_type($1)
1631         ubac_constrained($1)
1632
1633         files_poly_member($1)
1634         typeattribute $1  user_home_type;
1635 ')
1636
1637 ########################################
1638 ## <summary>
1639 ##      Make the specified type usable in a
1640 ##      generic temporary directory.
1641 ## </summary>
1642 ## <param name="type">
1643 ##      <summary>
1644 ##      Type to be used as a file in the
1645 ##      generic temporary directory.
1646 ##      </summary>
1647 ## </param>
1648 #
1649 interface(`userdom_user_tmp_content',`
1650         gen_require(`
1651                 attribute user_tmp_type;
1652         ')
1653
1654         typeattribute $1 user_tmp_type;
1655
1656         files_tmp_file($1)
1657         ubac_constrained($1)
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Make the specified type usable in a
1663 ##      generic tmpfs_t directory.
1664 ## </summary>
1665 ## <param name="type">
1666 ##      <summary>
1667 ##      Type to be used as a file in the
1668 ##      generic temporary directory.
1669 ##      </summary>
1670 ## </param>
1671 #
1672 interface(`userdom_user_tmpfs_content',`
1673         gen_require(`
1674                 attribute user_tmpfs_type;
1675         ')
1676
1677         typeattribute $1 user_tmpfs_type;
1678
1679         files_tmpfs_file($1)
1680         ubac_constrained($1)
1681 ')
1682
1683 ########################################
1684 ## <summary>
1685 ##      Allow domain to attach to TUN devices created by administrative users.
1686 ## </summary>
1687 ## <param name="domain">
1688 ##      <summary>
1689 ##      Domain allowed access.
1690 ##      </summary>
1691 ## </param>
1692 #
1693 interface(`userdom_attach_admin_tun_iface',`
1694         gen_require(`
1695                 attribute admindomain;
1696         ')
1697
1698         allow $1 admindomain:tun_socket relabelfrom;
1699         allow $1 self:tun_socket relabelto;
1700 ')
1701
1702 ########################################
1703 ## <summary>
1704 ##      Set the attributes of a user pty.
1705 ## </summary>
1706 ## <param name="domain">
1707 ##      <summary>
1708 ##      Domain allowed access.
1709 ##      </summary>
1710 ## </param>
1711 #
1712 interface(`userdom_setattr_user_ptys',`
1713         gen_require(`
1714                 type user_devpts_t;
1715         ')
1716
1717         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1718 ')
1719
1720 ########################################
1721 ## <summary>
1722 ##      Create a user pty.
1723 ## </summary>
1724 ## <param name="domain">
1725 ##      <summary>
1726 ##      Domain allowed access.
1727 ##      </summary>
1728 ## </param>
1729 #
1730 interface(`userdom_create_user_pty',`
1731         gen_require(`
1732                 type user_devpts_t;
1733         ')
1734
1735         term_create_pty($1, user_devpts_t)
1736 ')
1737
1738 ########################################
1739 ## <summary>
1740 ##      Get the attributes of user home directories.
1741 ## </summary>
1742 ## <param name="domain">
1743 ##      <summary>
1744 ##      Domain allowed access.
1745 ##      </summary>
1746 ## </param>
1747 #
1748 interface(`userdom_getattr_user_home_dirs',`
1749         gen_require(`
1750                 type user_home_dir_t;
1751         ')
1752
1753         allow $1 user_home_dir_t:dir getattr_dir_perms;
1754         files_search_home($1)
1755 ')
1756
1757 ########################################
1758 ## <summary>
1759 ##      Do not audit attempts to get the attributes of user home directories.
1760 ## </summary>
1761 ## <param name="domain">
1762 ##      <summary>
1763 ##      Domain to not audit.
1764 ##      </summary>
1765 ## </param>
1766 #
1767 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1768         gen_require(`
1769                 type user_home_dir_t;
1770         ')
1771
1772         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1773 ')
1774
1775 ########################################
1776 ## <summary>
1777 ##      Search user home directories.
1778 ## </summary>
1779 ## <param name="domain">
1780 ##      <summary>
1781 ##      Domain allowed access.
1782 ##      </summary>
1783 ## </param>
1784 #
1785 interface(`userdom_search_user_home_dirs',`
1786         gen_require(`
1787                 type user_home_dir_t;
1788         ')
1789
1790         allow $1 user_home_dir_t:dir search_dir_perms;
1791         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1792         files_search_home($1)
1793 ')
1794
1795 ########################################
1796 ## <summary>
1797 ##      Do not audit attempts to search user home directories.
1798 ## </summary>
1799 ## <desc>
1800 ##      <p>
1801 ##      Do not audit attempts to search user home directories.
1802 ##      This will supress SELinux denial messages when the specified
1803 ##      domain is denied the permission to search these directories.
1804 ##      </p>
1805 ## </desc>
1806 ## <param name="domain">
1807 ##      <summary>
1808 ##      Domain to not audit.
1809 ##      </summary>
1810 ## </param>
1811 ## <infoflow type="none"/>
1812 #
1813 interface(`userdom_dontaudit_search_user_home_dirs',`
1814         gen_require(`
1815                 type user_home_dir_t;
1816         ')
1817
1818         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1819 ')
1820
1821 ########################################
1822 ## <summary>
1823 ##      List user home directories.
1824 ## </summary>
1825 ## <param name="domain">
1826 ##      <summary>
1827 ##      Domain allowed access.
1828 ##      </summary>
1829 ## </param>
1830 #
1831 interface(`userdom_list_user_home_dirs',`
1832         gen_require(`
1833                 type user_home_dir_t;
1834         ')
1835
1836         allow $1 user_home_dir_t:dir list_dir_perms;
1837         files_search_home($1)
1838
1839         tunable_policy(`use_nfs_home_dirs',`
1840                 fs_list_nfs($1)
1841         ')
1842
1843         tunable_policy(`use_samba_home_dirs',`
1844                 fs_list_cifs($1)
1845         ')
1846 ')
1847
1848 ########################################
1849 ## <summary>
1850 ##      Do not audit attempts to list user home subdirectories.
1851 ## </summary>
1852 ## <param name="domain">
1853 ##      <summary>
1854 ##      Domain to not audit.
1855 ##      </summary>
1856 ## </param>
1857 #
1858 interface(`userdom_dontaudit_list_user_home_dirs',`
1859         gen_require(`
1860                 type user_home_dir_t;
1861                 type user_home_t;
1862         ')
1863
1864         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1865         dontaudit $1 user_home_t:dir list_dir_perms;
1866 ')
1867
1868 ########################################
1869 ## <summary>
1870 ##      Create user home directories.
1871 ## </summary>
1872 ## <param name="domain">
1873 ##      <summary>
1874 ##      Domain allowed access.
1875 ##      </summary>
1876 ## </param>
1877 #
1878 interface(`userdom_create_user_home_dirs',`
1879         gen_require(`
1880                 type user_home_dir_t;
1881         ')
1882
1883         allow $1 user_home_dir_t:dir create_dir_perms;
1884 ')
1885
1886 ########################################
1887 ## <summary>
1888 ##      Create user home directories.
1889 ## </summary>
1890 ## <param name="domain">
1891 ##      <summary>
1892 ##      Domain allowed access.
1893 ##      </summary>
1894 ## </param>
1895 #
1896 interface(`userdom_manage_user_home_dirs',`
1897         gen_require(`
1898                 type user_home_dir_t;
1899         ')
1900
1901         allow $1 user_home_dir_t:dir manage_dir_perms;
1902 ')
1903
1904 ########################################
1905 ## <summary>
1906 ##      Relabel to user home directories.
1907 ## </summary>
1908 ## <param name="domain">
1909 ##      <summary>
1910 ##      Domain allowed access.
1911 ##      </summary>
1912 ## </param>
1913 #
1914 interface(`userdom_relabelto_user_home_dirs',`
1915         gen_require(`
1916                 type user_home_dir_t;
1917         ')
1918
1919         allow $1 user_home_dir_t:dir relabelto;
1920 ')
1921
1922
1923 ########################################
1924 ## <summary>
1925 ##      Relabel to user home files.
1926 ## </summary>
1927 ## <param name="domain">
1928 ##      <summary>
1929 ##      Domain allowed access.
1930 ##      </summary>
1931 ## </param>
1932 #
1933 interface(`userdom_relabelto_user_home_files',`
1934         gen_require(`
1935                 type user_home_t;
1936         ')
1937
1938         allow $1 user_home_t:file relabelto;
1939 ')
1940 ########################################
1941 ## <summary>
1942 ##      Relabel user home files.
1943 ## </summary>
1944 ## <param name="domain">
1945 ##      <summary>
1946 ##      Domain allowed access.
1947 ##      </summary>
1948 ## </param>
1949 #
1950 interface(`userdom_relabel_user_home_files',`
1951         gen_require(`
1952                 type user_home_t;
1953         ')
1954
1955         allow $1 user_home_t:file relabel_file_perms;
1956 ')
1957
1958 ########################################
1959 ## <summary>
1960 ##      Create directories in the home dir root with
1961 ##      the user home directory type.
1962 ## </summary>
1963 ## <param name="domain">
1964 ##      <summary>
1965 ##      Domain allowed access.
1966 ##      </summary>
1967 ## </param>
1968 #
1969 interface(`userdom_home_filetrans_user_home_dir',`
1970         gen_require(`
1971                 type user_home_dir_t;
1972         ')
1973
1974         files_home_filetrans($1, user_home_dir_t, dir)
1975 ')
1976
1977 ########################################
1978 ## <summary>
1979 ##      Do a domain transition to the specified
1980 ##      domain when executing a program in the
1981 ##      user home directory.
1982 ## </summary>
1983 ## <desc>
1984 ##      <p>
1985 ##      Do a domain transition to the specified
1986 ##      domain when executing a program in the
1987 ##      user home directory.
1988 ##      </p>
1989 ##      <p>
1990 ##      No interprocess communication (signals, pipes,
1991 ##      etc.) is provided by this interface since
1992 ##      the domains are not owned by this module.
1993 ##      </p>
1994 ## </desc>
1995 ## <param name="source_domain">
1996 ##      <summary>
1997 ##      Domain allowed to transition.
1998 ##      </summary>
1999 ## </param>
2000 ## <param name="target_domain">
2001 ##      <summary>
2002 ##      Domain to transition to.
2003 ##      </summary>
2004 ## </param>
2005 #
2006 interface(`userdom_user_home_domtrans',`
2007         gen_require(`
2008                 type user_home_dir_t, user_home_t;
2009         ')
2010
2011         domain_auto_trans($1, user_home_t, $2)
2012         allow $1 user_home_dir_t:dir search_dir_perms;
2013         files_search_home($1)
2014 ')
2015
2016 ########################################
2017 ## <summary>
2018 ##      Do not audit attempts to search user home content directories.
2019 ## </summary>
2020 ## <param name="domain">
2021 ##      <summary>
2022 ##      Domain to not audit.
2023 ##      </summary>
2024 ## </param>
2025 #
2026 interface(`userdom_dontaudit_search_user_home_content',`
2027         gen_require(`
2028                 type user_home_t;
2029         ')
2030
2031         dontaudit $1 user_home_t:dir search_dir_perms;
2032         fs_dontaudit_list_nfs($1)
2033         fs_dontaudit_list_cifs($1)
2034 ')
2035
2036 ########################################
2037 ## <summary>
2038 ##      List contents of users home directory.
2039 ## </summary>
2040 ## <param name="domain">
2041 ##      <summary>
2042 ##      Domain allowed access.
2043 ##      </summary>
2044 ## </param>
2045 #
2046 interface(`userdom_list_user_home_content',`
2047         gen_require(`
2048                 type user_home_dir_t;
2049                 attribute user_home_type;
2050         ')
2051
2052         files_list_home($1)
2053         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2054 ')
2055
2056 ########################################
2057 ## <summary>
2058 ##      Create, read, write, and delete directories
2059 ##      in a user home subdirectory.
2060 ## </summary>
2061 ## <param name="domain">
2062 ##      <summary>
2063 ##      Domain allowed access.
2064 ##      </summary>
2065 ## </param>
2066 #
2067 interface(`userdom_manage_user_home_content_dirs',`
2068         gen_require(`
2069                 type user_home_dir_t, user_home_t;
2070         ')
2071
2072         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2073         files_search_home($1)
2074 ')
2075
2076 ########################################
2077 ## <summary>
2078 ##      Delete directories in a user home subdirectory.
2079 ## </summary>
2080 ## <param name="domain">
2081 ##      <summary>
2082 ##      Domain allowed access.
2083 ##      </summary>
2084 ## </param>
2085 #
2086 interface(`userdom_delete_user_home_content_dirs',`
2087         gen_require(`
2088                 type user_home_t;
2089         ')
2090
2091         allow $1 user_home_t:dir delete_dir_perms;
2092 ')
2093
2094 ########################################
2095 ## <summary>
2096 ##      Delete all directories in a user home subdirectory.
2097 ## </summary>
2098 ## <param name="domain">
2099 ##      <summary>
2100 ##      Domain allowed access.
2101 ##      </summary>
2102 ## </param>
2103 #
2104 interface(`userdom_delete_all_user_home_content_dirs',`
2105         gen_require(`
2106                 attribute user_home_type;
2107         ')
2108
2109         allow $1 user_home_type:dir delete_dir_perms;
2110 ')
2111
2112 ########################################
2113 ## <summary>
2114 ##      Set the attributes of user home files.
2115 ## </summary>
2116 ## <param name="domain">
2117 ##      <summary>
2118 ##      Domain allowed access.
2119 ##      </summary>
2120 ## </param>
2121 ## <rolecap/>
2122 #
2123 interface(`userdom_setattr_user_home_content_files',`
2124         gen_require(`
2125                 type user_home_t;
2126         ')
2127
2128         allow $1 user_home_t:file setattr;
2129 ')
2130
2131 ########################################
2132 ## <summary>
2133 ##      Do not audit attempts to set the
2134 ##      attributes of user home files.
2135 ## </summary>
2136 ## <param name="domain">
2137 ##      <summary>
2138 ##      Domain to not audit.
2139 ##      </summary>
2140 ## </param>
2141 #
2142 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2143         gen_require(`
2144                 type user_home_t;
2145         ')
2146
2147         dontaudit $1 user_home_t:file setattr_file_perms;
2148 ')
2149
2150 ########################################
2151 ## <summary>
2152 ##      Set the attributes of all user home directories.
2153 ## </summary>
2154 ## <param name="domain">
2155 ##      <summary>
2156 ##      Domain allowed access.
2157 ##      </summary>
2158 ## </param>
2159 ## <rolecap/>
2160 #
2161 interface(`userdom_setattr_all_user_home_content_dirs',`
2162         gen_require(`
2163                 attribute user_home_type;
2164         ')
2165
2166         allow $1 user_home_type:dir setattr_dir_perms;
2167 ')
2168
2169 ########################################
2170 ## <summary>
2171 ##      Mmap user home files.
2172 ## </summary>
2173 ## <param name="domain">
2174 ##      <summary>
2175 ##      Domain allowed access.
2176 ##      </summary>
2177 ## </param>
2178 #
2179 interface(`userdom_mmap_user_home_content_files',`
2180         gen_require(`
2181                 type user_home_dir_t, user_home_t;
2182         ')
2183
2184         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2185         files_search_home($1)
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Read user home files.
2191 ## </summary>
2192 ## <param name="domain">
2193 ##      <summary>
2194 ##      Domain allowed access.
2195 ##      </summary>
2196 ## </param>
2197 #
2198 interface(`userdom_read_user_home_content_files',`
2199         gen_require(`
2200                 type user_home_dir_t, user_home_t;
2201         ')
2202
2203         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2204         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2205         files_search_home($1)
2206 ')
2207
2208 ########################################
2209 ## <summary>
2210 ##      Do not audit attempts to getattr user home files.
2211 ## </summary>
2212 ## <param name="domain">
2213 ##      <summary>
2214 ##      Domain to not audit.
2215 ##      </summary>
2216 ## </param>
2217 #
2218 interface(`userdom_dontaudit_getattr_user_home_content',`
2219         gen_require(`
2220                 attribute user_home_type;
2221         ')
2222
2223         dontaudit $1 user_home_type:dir getattr;
2224         dontaudit $1 user_home_type:file getattr;
2225 ')
2226
2227 ########################################
2228 ## <summary>
2229 ##      Do not audit attempts to read user home files.
2230 ## </summary>
2231 ## <param name="domain">
2232 ##      <summary>
2233 ##      Domain to not audit.
2234 ##      </summary>
2235 ## </param>
2236 #
2237 interface(`userdom_dontaudit_read_user_home_content_files',`
2238         gen_require(`
2239                 attribute user_home_type;
2240                 type user_home_dir_t;
2241         ')
2242
2243         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2244         dontaudit $1 user_home_type:dir list_dir_perms;
2245         dontaudit $1 user_home_type:file read_file_perms;
2246         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2247 ')
2248
2249 ########################################
2250 ## <summary>
2251 ##      Do not audit attempts to append user home files.
2252 ## </summary>
2253 ## <param name="domain">
2254 ##      <summary>
2255 ##      Domain to not audit.
2256 ##      </summary>
2257 ## </param>
2258 #
2259 interface(`userdom_dontaudit_append_user_home_content_files',`
2260         gen_require(`
2261                 type user_home_t;
2262         ')
2263
2264         dontaudit $1 user_home_t:file append_file_perms;
2265 ')
2266
2267 ########################################
2268 ## <summary>
2269 ##      Do not audit attempts to write user home files.
2270 ## </summary>
2271 ## <param name="domain">
2272 ##      <summary>
2273 ##      Domain to not audit.
2274 ##      </summary>
2275 ## </param>
2276 #
2277 interface(`userdom_dontaudit_write_user_home_content_files',`
2278         gen_require(`
2279                 type user_home_t;
2280         ')
2281
2282         dontaudit $1 user_home_t:file write_file_perms;
2283 ')
2284
2285 ########################################
2286 ## <summary>
2287 ##      Delete files in a user home subdirectory.
2288 ## </summary>
2289 ## <param name="domain">
2290 ##      <summary>
2291 ##      Domain allowed access.
2292 ##      </summary>
2293 ## </param>
2294 #
2295 interface(`userdom_delete_user_home_content_files',`
2296         gen_require(`
2297                 type user_home_t;
2298         ')
2299
2300         allow $1 user_home_t:file delete_file_perms;
2301 ')
2302
2303 ########################################
2304 ## <summary>
2305 ##      Delete all files in a user home subdirectory.
2306 ## </summary>
2307 ## <param name="domain">
2308 ##      <summary>
2309 ##      Domain allowed access.
2310 ##      </summary>
2311 ## </param>
2312 #
2313 interface(`userdom_delete_all_user_home_content_files',`
2314         gen_require(`
2315                 attribute user_home_type;
2316         ')
2317
2318         allow $1 user_home_type:file delete_file_perms;
2319 ')
2320
2321 ########################################
2322 ## <summary>
2323 ##      Delete sock files in a user home subdirectory.
2324 ## </summary>
2325 ## <param name="domain">
2326 ##      <summary>
2327 ##      Domain allowed access.
2328 ##      </summary>
2329 ## </param>
2330 #
2331 interface(`userdom_delete_user_home_content_sock_files',`
2332         gen_require(`
2333                 type user_home_t;
2334         ')
2335
2336         allow $1 user_home_t:sock_file delete_file_perms;
2337 ')
2338
2339 ########################################
2340 ## <summary>
2341 ##      Delete all sock files in a user home subdirectory.
2342 ## </summary>
2343 ## <param name="domain">
2344 ##      <summary>
2345 ##      Domain allowed access.
2346 ##      </summary>
2347 ## </param>
2348 #
2349 interface(`userdom_delete_all_user_home_content_sock_files',`
2350         gen_require(`
2351                 attribute user_home_type;
2352         ')
2353
2354         allow $1 user_home_type:sock_file delete_file_perms;
2355 ')
2356
2357 ########################################
2358 ## <summary>
2359 ##      Do not audit attempts to write user home files.
2360 ## </summary>
2361 ## <param name="domain">
2362 ##      <summary>
2363 ##      Domain to not audit.
2364 ##      </summary>
2365 ## </param>
2366 #
2367 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2368         gen_require(`
2369                 type user_home_t;
2370         ')
2371
2372         dontaudit $1 user_home_t:file relabel_file_perms;
2373 ')
2374
2375 ########################################
2376 ## <summary>
2377 ##      Read user home subdirectory symbolic links.
2378 ## </summary>
2379 ## <param name="domain">
2380 ##      <summary>
2381 ##      Domain allowed access.
2382 ##      </summary>
2383 ## </param>
2384 #
2385 interface(`userdom_read_user_home_content_symlinks',`
2386         gen_require(`
2387                 type user_home_dir_t, user_home_t;
2388         ')
2389
2390         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2391 ')
2392
2393 ########################################
2394 ## <summary>
2395 ##      Execute user home files.
2396 ## </summary>
2397 ## <param name="domain">
2398 ##      <summary>
2399 ##      Domain allowed access.
2400 ##      </summary>
2401 ## </param>
2402 ## <rolecap/>
2403 #
2404 interface(`userdom_exec_user_home_content_files',`
2405         gen_require(`
2406                 type user_home_dir_t;
2407                 attribute user_home_type;
2408         ')
2409
2410         files_search_home($1)
2411         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2412         dontaudit $1 user_home_type:sock_file execute;
2413         ')
2414
2415 ########################################
2416 ## <summary>
2417 ##      Do not audit attempts to execute user home files.
2418 ## </summary>
2419 ## <param name="domain">
2420 ##      <summary>
2421 ##      Domain to not audit.
2422 ##      </summary>
2423 ## </param>
2424 #
2425 interface(`userdom_dontaudit_exec_user_home_content_files',`
2426         gen_require(`
2427                 type user_home_t;
2428         ')
2429
2430         dontaudit $1 user_home_t:file exec_file_perms;
2431 ')
2432
2433 ########################################
2434 ## <summary>
2435 ##      Create, read, write, and delete files
2436 ##      in a user home subdirectory.
2437 ## </summary>
2438 ## <param name="domain">
2439 ##      <summary>
2440 ##      Domain allowed access.
2441 ##      </summary>
2442 ## </param>
2443 #
2444 interface(`userdom_manage_user_home_content_files',`
2445         gen_require(`
2446                 type user_home_dir_t, user_home_t;
2447         ')
2448
2449         manage_files_pattern($1, user_home_t, user_home_t)
2450         allow $1 user_home_dir_t:dir search_dir_perms;
2451         files_search_home($1)
2452 ')
2453
2454 ########################################
2455 ## <summary>
2456 ##      Do not audit attempts to create, read, write, and delete directories
2457 ##      in a user home subdirectory.
2458 ## </summary>
2459 ## <param name="domain">
2460 ##      <summary>
2461 ##      Domain to not audit.
2462 ##      </summary>
2463 ## </param>
2464 #
2465 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2466         gen_require(`
2467                 type user_home_dir_t, user_home_t;
2468         ')
2469
2470         dontaudit $1 user_home_t:dir manage_dir_perms;
2471 ')
2472
2473 ########################################
2474 ## <summary>
2475 ##      Create, read, write, and delete symbolic links
2476 ##      in a user home subdirectory.
2477 ## </summary>
2478 ## <param name="domain">
2479 ##      <summary>
2480 ##      Domain allowed access.
2481 ##      </summary>
2482 ## </param>
2483 #
2484 interface(`userdom_manage_user_home_content_symlinks',`
2485         gen_require(`
2486                 type user_home_dir_t, user_home_t;
2487         ')
2488
2489         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2490         allow $1 user_home_dir_t:dir search_dir_perms;
2491         files_search_home($1)
2492 ')
2493
2494 ########################################
2495 ## <summary>
2496 ##      Delete symbolic links in a user home directory.
2497 ## </summary>
2498 ## <param name="domain">
2499 ##      <summary>
2500 ##      Domain allowed access.
2501 ##      </summary>
2502 ## </param>
2503 #
2504 interface(`userdom_delete_user_home_content_symlinks',`
2505         gen_require(`
2506                 type user_home_t;
2507         ')
2508
2509         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2510 ')
2511
2512 ########################################
2513 ## <summary>
2514 ##      Delete all symbolic links in a user home directory.
2515 ## </summary>
2516 ## <param name="domain">
2517 ##      <summary>
2518 ##      Domain allowed access.
2519 ##      </summary>
2520 ## </param>
2521 #
2522 interface(`userdom_delete_all_user_home_content_symlinks',`
2523         gen_require(`
2524                 attribute user_home_type;
2525         ')
2526
2527         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2528 ')
2529
2530 ########################################
2531 ## <summary>
2532 ##      Create, read, write, and delete named pipes
2533 ##      in a user home subdirectory.
2534 ## </summary>
2535 ## <param name="domain">
2536 ##      <summary>
2537 ##      Domain allowed access.
2538 ##      </summary>
2539 ## </param>
2540 #
2541 interface(`userdom_manage_user_home_content_pipes',`
2542         gen_require(`
2543                 type user_home_dir_t, user_home_t;
2544         ')
2545
2546         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2547         allow $1 user_home_dir_t:dir search_dir_perms;
2548         files_search_home($1)
2549 ')
2550
2551 ########################################
2552 ## <summary>
2553 ##      Create, read, write, and delete named sockets
2554 ##      in a user home subdirectory.
2555 ## </summary>
2556 ## <param name="domain">
2557 ##      <summary>
2558 ##      Domain allowed access.
2559 ##      </summary>
2560 ## </param>
2561 #
2562 interface(`userdom_manage_user_home_content_sockets',`
2563         gen_require(`
2564                 type user_home_dir_t, user_home_t;
2565         ')
2566
2567         allow $1 user_home_dir_t:dir search_dir_perms;
2568         manage_sock_files_pattern($1, user_home_t, user_home_t)
2569         files_search_home($1)
2570 ')
2571
2572 ########################################
2573 ## <summary>
2574 ##      Create objects in a user home directory
2575 ##      with an automatic type transition to
2576 ##      a specified private type.
2577 ## </summary>
2578 ## <param name="domain">
2579 ##      <summary>
2580 ##      Domain allowed access.
2581 ##      </summary>
2582 ## </param>
2583 ## <param name="private_type">
2584 ##      <summary>
2585 ##      The type of the object to create.
2586 ##      </summary>
2587 ## </param>
2588 ## <param name="object_class">
2589 ##      <summary>
2590 ##      The class of the object to be created.
2591 ##      </summary>
2592 ## </param>
2593 #
2594 interface(`userdom_user_home_dir_filetrans',`
2595         gen_require(`
2596                 type user_home_dir_t;
2597         ')
2598
2599         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2600         files_search_home($1)
2601 ')
2602
2603 ########################################
2604 ## <summary>
2605 ##      Create objects in a user home directory
2606 ##      with an automatic type transition to
2607 ##      a specified private type.
2608 ## </summary>
2609 ## <param name="domain">
2610 ##      <summary>
2611 ##      Domain allowed access.
2612 ##      </summary>
2613 ## </param>
2614 ## <param name="private_type">
2615 ##      <summary>
2616 ##      The type of the object to create.
2617 ##      </summary>
2618 ## </param>
2619 ## <param name="object_class">
2620 ##      <summary>
2621 ##      The class of the object to be created.
2622 ##      </summary>
2623 ## </param>
2624 #
2625 interface(`userdom_user_home_content_filetrans',`
2626         gen_require(`
2627                 type user_home_dir_t, user_home_t;
2628         ')
2629
2630         filetrans_pattern($1, user_home_t, $2, $3)
2631         allow $1 user_home_dir_t:dir search_dir_perms;
2632         files_search_home($1)
2633 ')
2634
2635 ########################################
2636 ## <summary>
2637 ##      Create objects in a user home directory
2638 ##      with an automatic type transition to
2639 ##      the user home file type.
2640 ## </summary>
2641 ## <param name="domain">
2642 ##      <summary>
2643 ##      Domain allowed access.
2644 ##      </summary>
2645 ## </param>
2646 ## <param name="object_class">
2647 ##      <summary>
2648 ##      The class of the object to be created.
2649 ##      </summary>
2650 ## </param>
2651 #
2652 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2653         gen_require(`
2654                 type user_home_dir_t, user_home_t;
2655         ')
2656
2657         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2658         files_search_home($1)
2659 ')
2660
2661 ########################################
2662 ## <summary>
2663 ##      Write to user temporary named sockets.
2664 ## </summary>
2665 ## <param name="domain">
2666 ##      <summary>
2667 ##      Domain allowed access.
2668 ##      </summary>
2669 ## </param>
2670 #
2671 interface(`userdom_write_user_tmp_sockets',`
2672         gen_require(`
2673                 type user_tmp_t;
2674         ')
2675
2676         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2677         files_search_tmp($1)
2678 ')
2679
2680 ########################################
2681 ## <summary>
2682 ##      List user temporary directories.
2683 ## </summary>
2684 ## <param name="domain">
2685 ##      <summary>
2686 ##      Domain allowed access.
2687 ##      </summary>
2688 ## </param>
2689 #
2690 interface(`userdom_list_user_tmp',`
2691         gen_require(`
2692                 type user_tmp_t;
2693         ')
2694
2695         allow $1 user_tmp_t:dir list_dir_perms;
2696         files_search_tmp($1)
2697 ')
2698
2699 ########################################
2700 ## <summary>
2701 ##      Do not audit attempts to list user
2702 ##      temporary directories.
2703 ## </summary>
2704 ## <param name="domain">
2705 ##      <summary>
2706 ##      Domain to not audit.
2707 ##      </summary>
2708 ## </param>
2709 #
2710 interface(`userdom_dontaudit_list_user_tmp',`
2711         gen_require(`
2712                 type user_tmp_t;
2713         ')
2714
2715         dontaudit $1 user_tmp_t:dir list_dir_perms;
2716 ')
2717
2718 ########################################
2719 ## <summary>
2720 ##      Do not audit attempts to manage users
2721 ##      temporary directories.
2722 ## </summary>
2723 ## <param name="domain">
2724 ##      <summary>
2725 ##      Domain to not audit.
2726 ##      </summary>
2727 ## </param>
2728 #
2729 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2730         gen_require(`
2731                 type user_tmp_t;
2732         ')
2733
2734         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2735 ')
2736
2737 ########################################
2738 ## <summary>
2739 ##      Read user temporary files.
2740 ## </summary>
2741 ## <param name="domain">
2742 ##      <summary>
2743 ##      Domain allowed access.
2744 ##      </summary>
2745 ## </param>
2746 #
2747 interface(`userdom_read_user_tmp_files',`
2748         gen_require(`
2749                 type user_tmp_t;
2750         ')
2751
2752         read_files_pattern($1, user_tmp_t, user_tmp_t)
2753         allow $1 user_tmp_t:dir list_dir_perms;
2754         files_search_tmp($1)
2755 ')
2756
2757 ########################################
2758 ## <summary>
2759 ##      Do not audit attempts to read users
2760 ##      temporary files.
2761 ## </summary>
2762 ## <param name="domain">
2763 ##      <summary>
2764 ##      Domain to not audit.
2765 ##      </summary>
2766 ## </param>
2767 #
2768 interface(`userdom_dontaudit_read_user_tmp_files',`
2769         gen_require(`
2770                 type user_tmp_t;
2771         ')
2772
2773         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2774 ')
2775
2776 ########################################
2777 ## <summary>
2778 ##      Do not audit attempts to append users
2779 ##      temporary files.
2780 ## </summary>
2781 ## <param name="domain">
2782 ##      <summary>
2783 ##      Domain to not audit.
2784 ##      </summary>
2785 ## </param>
2786 #
2787 interface(`userdom_dontaudit_append_user_tmp_files',`
2788         gen_require(`
2789                 type user_tmp_t;
2790         ')
2791
2792         dontaudit $1 user_tmp_t:file append_file_perms;
2793 ')
2794
2795 ########################################
2796 ## <summary>
2797 ##      Read and write user temporary files.
2798 ## </summary>
2799 ## <param name="domain">
2800 ##      <summary>
2801 ##      Domain allowed access.
2802 ##      </summary>
2803 ## </param>
2804 #
2805 interface(`userdom_rw_user_tmp_files',`
2806         gen_require(`
2807                 type user_tmp_t;
2808         ')
2809
2810         allow $1 user_tmp_t:dir list_dir_perms;
2811         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2812         files_search_tmp($1)
2813 ')
2814
2815 ########################################
2816 ## <summary>
2817 ##      Do not audit attempts to manage users
2818 ##      temporary files.
2819 ## </summary>
2820 ## <param name="domain">
2821 ##      <summary>
2822 ##      Domain to not audit.
2823 ##      </summary>
2824 ## </param>
2825 #
2826 interface(`userdom_dontaudit_manage_user_tmp_files',`
2827         gen_require(`
2828                 type user_tmp_t;
2829         ')
2830
2831         dontaudit $1 user_tmp_t:file manage_file_perms;
2832 ')
2833
2834 ########################################
2835 ## <summary>
2836 ##      Read user temporary symbolic links.
2837 ## </summary>
2838 ## <param name="domain">
2839 ##      <summary>
2840 ##      Domain allowed access.
2841 ##      </summary>
2842 ## </param>
2843 #
2844 interface(`userdom_read_user_tmp_symlinks',`
2845         gen_require(`
2846                 type user_tmp_t;
2847         ')
2848
2849         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2850         allow $1 user_tmp_t:dir list_dir_perms;
2851         files_search_tmp($1)
2852 ')
2853
2854 ########################################
2855 ## <summary>
2856 ##      Create, read, write, and delete user
2857 ##      temporary directories.
2858 ## </summary>
2859 ## <param name="domain">
2860 ##      <summary>
2861 ##      Domain allowed access.
2862 ##      </summary>
2863 ## </param>
2864 #
2865 interface(`userdom_manage_user_tmp_dirs',`
2866         gen_require(`
2867                 type user_tmp_t;
2868         ')
2869
2870         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2871         files_search_tmp($1)
2872 ')
2873
2874 ########################################
2875 ## <summary>
2876 ##      Create, read, write, and delete user
2877 ##      temporary files.
2878 ## </summary>
2879 ## <param name="domain">
2880 ##      <summary>
2881 ##      Domain allowed access.
2882 ##      </summary>
2883 ## </param>
2884 #
2885 interface(`userdom_manage_user_tmp_files',`
2886         gen_require(`
2887                 type user_tmp_t;
2888         ')
2889
2890         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2891         files_search_tmp($1)
2892 ')
2893
2894 ########################################
2895 ## <summary>
2896 ##      Create, read, write, and delete user
2897 ##      temporary symbolic links.
2898 ## </summary>
2899 ## <param name="domain">
2900 ##      <summary>
2901 ##      Domain allowed access.
2902 ##      </summary>
2903 ## </param>
2904 #
2905 interface(`userdom_manage_user_tmp_symlinks',`
2906         gen_require(`
2907                 type user_tmp_t;
2908         ')
2909
2910         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2911         files_search_tmp($1)
2912 ')
2913
2914 ########################################
2915 ## <summary>
2916 ##      Create, read, write, and delete user
2917 ##      temporary named pipes.
2918 ## </summary>
2919 ## <param name="domain">
2920 ##      <summary>
2921 ##      Domain allowed access.
2922 ##      </summary>
2923 ## </param>
2924 #
2925 interface(`userdom_manage_user_tmp_pipes',`
2926         gen_require(`
2927                 type user_tmp_t;
2928         ')
2929
2930         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2931         files_search_tmp($1)
2932 ')
2933
2934 ########################################
2935 ## <summary>
2936 ##      Create, read, write, and delete user
2937 ##      temporary named sockets.
2938 ## </summary>
2939 ## <param name="domain">
2940 ##      <summary>
2941 ##      Domain allowed access.
2942 ##      </summary>
2943 ## </param>
2944 #
2945 interface(`userdom_manage_user_tmp_sockets',`
2946         gen_require(`
2947                 type user_tmp_t;
2948         ')
2949
2950         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2951         files_search_tmp($1)
2952 ')
2953
2954 ########################################
2955 ## <summary>
2956 ##      Create objects in a user temporary directory
2957 ##      with an automatic type transition to
2958 ##      a specified private type.
2959 ## </summary>
2960 ## <param name="domain">
2961 ##      <summary>
2962 ##      Domain allowed access.
2963 ##      </summary>
2964 ## </param>
2965 ## <param name="private_type">
2966 ##      <summary>
2967 ##      The type of the object to create.
2968 ##      </summary>
2969 ## </param>
2970 ## <param name="object_class">
2971 ##      <summary>
2972 ##      The class of the object to be created.
2973 ##      </summary>
2974 ## </param>
2975 #
2976 interface(`userdom_user_tmp_filetrans',`
2977         gen_require(`
2978                 type user_tmp_t;
2979         ')
2980
2981         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2982         files_search_tmp($1)
2983 ')
2984
2985 ########################################
2986 ## <summary>
2987 ##      Create objects in the temporary directory
2988 ##      with an automatic type transition to
2989 ##      the user temporary type.
2990 ## </summary>
2991 ## <param name="domain">
2992 ##      <summary>
2993 ##      Domain allowed access.
2994 ##      </summary>
2995 ## </param>
2996 ## <param name="object_class">
2997 ##      <summary>
2998 ##      The class of the object to be created.
2999 ##      </summary>
3000 ## </param>
3001 #
3002 interface(`userdom_tmp_filetrans_user_tmp',`
3003         gen_require(`
3004                 type user_tmp_t;
3005         ')
3006
3007         files_tmp_filetrans($1, user_tmp_t, $2)
3008 ')
3009
3010 ########################################
3011 ## <summary>
3012 ##      Read user tmpfs files.
3013 ## </summary>
3014 ## <param name="domain">
3015 ##      <summary>
3016 ##      Domain allowed access.
3017 ##      </summary>
3018 ## </param>
3019 #
3020 interface(`userdom_read_user_tmpfs_files',`
3021         gen_require(`
3022                 type user_tmpfs_t;
3023         ')
3024
3025         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3026         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3027         allow $1 user_tmpfs_t:dir list_dir_perms;
3028         fs_search_tmpfs($1)
3029 ')
3030
3031 ########################################
3032 ## <summary>
3033 ##      Read/Write user tmpfs files.
3034 ## </summary>
3035 ## <param name="domain">
3036 ##      <summary>
3037 ##      Domain allowed access.
3038 ##      </summary>
3039 ## </param>
3040 #
3041 interface(`userdom_rw_user_tmpfs_files',`
3042         gen_require(`
3043                 type user_tmpfs_t;
3044         ')
3045
3046         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3047         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3048         allow $1 user_tmpfs_t:dir list_dir_perms;
3049         fs_search_tmpfs($1)
3050 ')
3051
3052 ########################################
3053 ## <summary>
3054 ##      Get the attributes of a user domain tty.
3055 ## </summary>
3056 ## <param name="domain">
3057 ##      <summary>
3058 ##      Domain allowed access.
3059 ##      </summary>
3060 ## </param>
3061 #
3062 interface(`userdom_getattr_user_ttys',`
3063         gen_require(`
3064                 type user_tty_device_t;
3065         ')
3066
3067         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3068 ')
3069
3070 ########################################
3071 ## <summary>
3072 ##      Do not audit attempts to get the attributes of a user domain tty.
3073 ## </summary>
3074 ## <param name="domain">
3075 ##      <summary>
3076 ##      Domain to not audit.
3077 ##      </summary>
3078 ## </param>
3079 #
3080 interface(`userdom_dontaudit_getattr_user_ttys',`
3081         gen_require(`
3082                 type user_tty_device_t;
3083         ')
3084
3085         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3086 ')
3087
3088 ########################################
3089 ## <summary>
3090 ##      Set the attributes of a user domain tty.
3091 ## </summary>
3092 ## <param name="domain">
3093 ##      <summary>
3094 ##      Domain allowed access.
3095 ##      </summary>
3096 ## </param>
3097 #
3098 interface(`userdom_setattr_user_ttys',`
3099         gen_require(`
3100                 type user_tty_device_t;
3101         ')
3102
3103         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3104 ')
3105
3106 ########################################
3107 ## <summary>
3108 ##      Do not audit attempts to set the attributes of a user domain tty.
3109 ## </summary>
3110 ## <param name="domain">
3111 ##      <summary>
3112 ##      Domain to not audit.
3113 ##      </summary>
3114 ## </param>
3115 #
3116 interface(`userdom_dontaudit_setattr_user_ttys',`
3117         gen_require(`
3118                 type user_tty_device_t;
3119         ')
3120
3121         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3122 ')
3123
3124 ########################################
3125 ## <summary>
3126 ##      Read and write a user domain tty.
3127 ## </summary>
3128 ## <param name="domain">
3129 ##      <summary>
3130 ##      Domain allowed access.
3131 ##      </summary>
3132 ## </param>
3133 #
3134 interface(`userdom_use_user_ttys',`
3135         gen_require(`
3136                 type user_tty_device_t;
3137         ')
3138
3139         allow $1 user_tty_device_t:chr_file rw_term_perms;
3140 ')
3141
3142 ########################################
3143 ## <summary>
3144 ##      Read and write a inherited user domain tty.
3145 ## </summary>
3146 ## <param name="domain">
3147 ##      <summary>
3148 ##      Domain allowed access.
3149 ##      </summary>
3150 ## </param>
3151 #
3152 interface(`userdom_use_inherited_user_ttys',`
3153         gen_require(`
3154                 type user_tty_device_t;
3155         ')
3156
3157         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3158 ')
3159
3160 ########################################
3161 ## <summary>
3162 ##      Read and write a user domain pty.
3163 ## </summary>
3164 ## <param name="domain">
3165 ##      <summary>
3166 ##      Domain allowed access.
3167 ##      </summary>
3168 ## </param>
3169 #
3170 interface(`userdom_use_user_ptys',`
3171         gen_require(`
3172                 type user_devpts_t;
3173         ')
3174
3175         allow $1 user_devpts_t:chr_file rw_term_perms;
3176 ')
3177
3178 ########################################
3179 ## <summary>
3180 ##      Read and write a inherited user domain pty.
3181 ## </summary>
3182 ## <param name="domain">
3183 ##      <summary>
3184 ##      Domain allowed access.
3185 ##      </summary>
3186 ## </param>
3187 #
3188 interface(`userdom_use_inherited_user_ptys',`
3189         gen_require(`
3190                 type user_devpts_t;
3191         ')
3192
3193         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3194 ')
3195
3196 ########################################
3197 ## <summary>
3198 ##      Read and write a inherited user TTYs and PTYs.
3199 ## </summary>
3200 ## <desc>
3201 ##      <p>
3202 ##      Allow the specified domain to read and write inherited user
3203 ##      TTYs and PTYs. This will allow the domain to
3204 ##      interact with the user via the terminal. Typically
3205 ##      all interactive applications will require this
3206 ##      access.
3207 ##      </p>
3208 ## </desc>
3209 ## <param name="domain">
3210 ##      <summary>
3211 ##      Domain allowed access.
3212 ##      </summary>
3213 ## </param>
3214 ## <infoflow type="both" weight="10"/>
3215 #
3216 interface(`userdom_use_inherited_user_terminals',`
3217         gen_require(`
3218                 type user_tty_device_t, user_devpts_t;
3219         ')
3220
3221         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3222         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3223 ')
3224
3225 #######################################
3226 ## <summary>
3227 ##  Allow attempts to read and write
3228 ##  a user domain tty and pty.
3229 ## </summary>
3230 ## <param name="domain">
3231 ##  <summary>
3232 ##  Domain to not audit.
3233 ##  </summary>
3234 ## </param>
3235 #
3236 interface(`userdom_use_user_terminals',`
3237     gen_require(`
3238         type user_tty_device_t, user_devpts_t;
3239     ')
3240
3241     allow $1 user_tty_device_t:chr_file rw_term_perms;
3242     allow $1 user_devpts_t:chr_file rw_term_perms;
3243 ')
3244
3245 ########################################
3246 ## <summary>
3247 ##      Do not audit attempts to read and write
3248 ##      a user domain tty and pty.
3249 ## </summary>
3250 ## <param name="domain">
3251 ##      <summary>
3252 ##      Domain to not audit.
3253 ##      </summary>
3254 ## </param>
3255 #
3256 interface(`userdom_dontaudit_use_user_terminals',`
3257         gen_require(`
3258                 type user_tty_device_t, user_devpts_t;
3259         ')
3260
3261         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3262         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3263 ')
3264
3265
3266 ########################################
3267 ## <summary>
3268 ##      Get attributes of user domain tty and pty.
3269 ## </summary>
3270 ## <param name="domain">
3271 ##      <summary>
3272 ##      Domain allowed access.
3273 ##      </summary>
3274 ## </param>
3275 #
3276 interface(`userdom_getattr_user_terminals',`
3277         gen_require(`
3278                 type user_tty_device_t, user_devpts_t;
3279         ')
3280
3281         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3282 ')
3283
3284 ########################################
3285 ## <summary>
3286 ##      Execute a shell in all user domains.  This
3287 ##      is an explicit transition, requiring the
3288 ##      caller to use setexeccon().
3289 ## </summary>
3290 ## <param name="domain">
3291 ##      <summary>
3292 ##      Domain allowed to transition.
3293 ##      </summary>
3294 ## </param>
3295 #
3296 interface(`userdom_spec_domtrans_all_users',`
3297         gen_require(`
3298                 attribute userdomain;
3299         ')
3300
3301         corecmd_shell_spec_domtrans($1, userdomain)
3302         allow userdomain $1:fd use;
3303         allow userdomain $1:fifo_file rw_file_perms;
3304         allow userdomain $1:process sigchld;
3305 ')
3306
3307 ########################################
3308 ## <summary>
3309 ##      Execute an Xserver session in all unprivileged user domains.  This
3310 ##      is an explicit transition, requiring the
3311 ##      caller to use setexeccon().
3312 ## </summary>
3313 ## <param name="domain">
3314 ##      <summary>
3315 ##      Domain allowed to transition.
3316 ##      </summary>
3317 ## </param>
3318 #
3319 interface(`userdom_xsession_spec_domtrans_all_users',`
3320         gen_require(`
3321                 attribute userdomain;
3322         ')
3323
3324         xserver_xsession_spec_domtrans($1, userdomain)
3325         allow userdomain $1:fd use;
3326         allow userdomain $1:fifo_file rw_file_perms;
3327         allow userdomain $1:process sigchld;
3328 ')
3329
3330 ########################################
3331 ## <summary>
3332 ##      Execute a shell in all unprivileged user domains.  This
3333 ##      is an explicit transition, requiring the
3334 ##      caller to use setexeccon().
3335 ## </summary>
3336 ## <param name="domain">
3337 ##      <summary>
3338 ##      Domain allowed to transition.
3339 ##      </summary>
3340 ## </param>
3341 #
3342 interface(`userdom_spec_domtrans_unpriv_users',`
3343         gen_require(`
3344                 attribute unpriv_userdomain;
3345         ')
3346
3347         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3348         allow unpriv_userdomain $1:fd use;
3349         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3350         allow unpriv_userdomain $1:process sigchld;
3351 ')
3352
3353 #####################################
3354 ## <summary>
3355 ##  Allow domain dyntrans to unpriv userdomain.
3356 ## </summary>
3357 ## <param name="domain">
3358 ##  <summary>
3359 ##  Domain allowed access.
3360 ##  </summary>
3361 ## </param>
3362 #
3363 interface(`userdom_dyntransition_unpriv_users',`
3364     gen_require(`
3365         attribute unpriv_userdomain;
3366     ')
3367
3368     allow $1 unpriv_userdomain:process dyntransition;
3369 ')
3370
3371 #####################################
3372 ## <summary>
3373 ##  Allow domain dyntrans to unpriv userdomain.
3374 ## </summary>
3375 ## <param name="domain">
3376 ##  <summary>
3377 ##  Domain allowed access.
3378 ##  </summary>
3379 ## </param>
3380 #
3381 interface(`userdom_dyntransition_unpriv_users',`
3382     gen_require(`
3383         attribute unpriv_userdomain;
3384     ')
3385
3386     allow $1 unpriv_userdomain:process dyntransition;
3387 ')
3388
3389 ########################################
3390 ## <summary>
3391 ##      Execute an Xserver session in all unprivileged user domains.  This
3392 ##      is an explicit transition, requiring the
3393 ##      caller to use setexeccon().
3394 ## </summary>
3395 ## <param name="domain">
3396 ##      <summary>
3397 ##      Domain allowed to transition.
3398 ##      </summary>
3399 ## </param>
3400 #
3401 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3402         gen_require(`
3403                 attribute unpriv_userdomain;
3404         ')
3405
3406         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3407         allow unpriv_userdomain $1:fd use;
3408         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3409         allow unpriv_userdomain $1:process sigchld;
3410 ')
3411
3412 ########################################
3413 ## <summary>
3414 ##      Manage unpriviledged user SysV sempaphores.
3415 ## </summary>
3416 ## <param name="domain">
3417 ##      <summary>
3418 ##      Domain allowed access.
3419 ##      </summary>
3420 ## </param>
3421 #
3422 interface(`userdom_manage_unpriv_user_semaphores',`
3423         gen_require(`
3424                 attribute unpriv_userdomain;
3425         ')
3426
3427         allow $1 unpriv_userdomain:sem create_sem_perms;
3428 ')
3429
3430 ########################################
3431 ## <summary>
3432 ##      Manage unpriviledged user SysV shared
3433 ##      memory segments.
3434 ## </summary>
3435 ## <param name="domain">
3436 ##      <summary>
3437 ##      Domain allowed access.
3438 ##      </summary>
3439 ## </param>
3440 #
3441 interface(`userdom_manage_unpriv_user_shared_mem',`
3442         gen_require(`
3443                 attribute unpriv_userdomain;
3444         ')
3445
3446         allow $1 unpriv_userdomain:shm create_shm_perms;
3447 ')
3448
3449 ########################################
3450 ## <summary>
3451 ##      Execute bin_t in the unprivileged user domains. This
3452 ##      is an explicit transition, requiring the
3453 ##      caller to use setexeccon().
3454 ## </summary>
3455 ## <param name="domain">
3456 ##      <summary>
3457 ##      Domain allowed to transition.
3458 ##      </summary>
3459 ## </param>
3460 #
3461 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3462         gen_require(`
3463                 attribute unpriv_userdomain;
3464         ')
3465
3466         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3467         allow unpriv_userdomain $1:fd use;
3468         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3469         allow unpriv_userdomain $1:process sigchld;
3470 ')
3471
3472 ########################################
3473 ## <summary>
3474 ##      Execute all entrypoint files in unprivileged user
3475 ##      domains. This is an explicit transition, requiring the
3476 ##      caller to use setexeccon().
3477 ## </summary>
3478 ## <param name="domain">
3479 ##      <summary>
3480 ##      Domain allowed access.
3481 ##      </summary>
3482 ## </param>
3483 #
3484 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3485         gen_require(`
3486                 attribute unpriv_userdomain;
3487         ')
3488
3489         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3490         allow unpriv_userdomain $1:fd use;
3491         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3492         allow unpriv_userdomain $1:process sigchld;
3493 ')
3494
3495 ########################################
3496 ## <summary>
3497 ##      Search users home directories.
3498 ## </summary>
3499 ## <param name="domain">
3500 ##      <summary>
3501 ##      Domain allowed access.
3502 ##      </summary>
3503 ## </param>
3504 #
3505 interface(`userdom_search_user_home_content',`
3506         gen_require(`
3507                 type user_home_dir_t;
3508                 attribute user_home_type;
3509         ')
3510
3511         files_list_home($1)
3512         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3513         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3514 ')
3515
3516 ########################################
3517 ## <summary>
3518 ##      Send general signals to unprivileged user domains.
3519 ## </summary>
3520 ## <param name="domain">
3521 ##      <summary>
3522 ##      Domain allowed access.
3523 ##      </summary>
3524 ## </param>
3525 #
3526 interface(`userdom_signal_unpriv_users',`
3527         gen_require(`
3528                 attribute unpriv_userdomain;
3529         ')
3530
3531         allow $1 unpriv_userdomain:process signal;
3532 ')
3533
3534 ########################################
3535 ## <summary>
3536 ##      Inherit the file descriptors from unprivileged user domains.
3537 ## </summary>
3538 ## <param name="domain">
3539 ##      <summary>
3540 ##      Domain allowed access.
3541 ##      </summary>
3542 ## </param>
3543 #
3544 interface(`userdom_use_unpriv_users_fds',`
3545         gen_require(`
3546                 attribute unpriv_userdomain;
3547         ')
3548
3549         allow $1 unpriv_userdomain:fd use;
3550 ')
3551
3552 ########################################
3553 ## <summary>
3554 ##      Do not audit attempts to inherit the file descriptors
3555 ##      from unprivileged user domains.
3556 ## </summary>
3557 ## <desc>
3558 ##      <p>
3559 ##      Do not audit attempts to inherit the file descriptors
3560 ##      from unprivileged user domains. This will supress
3561 ##      SELinux denial messages when the specified domain is denied
3562 ##      the permission to inherit these file descriptors.
3563 ##      </p>
3564 ## </desc>
3565 ## <param name="domain">
3566 ##      <summary>
3567 ##      Domain to not audit.
3568 ##      </summary>
3569 ## </param>
3570 ## <infoflow type="none"/>
3571 #
3572 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3573         gen_require(`
3574                 attribute unpriv_userdomain;
3575         ')
3576
3577         dontaudit $1 unpriv_userdomain:fd use;
3578 ')
3579
3580 ########################################
3581 ## <summary>
3582 ##      Do not audit attempts to use user ptys.
3583 ## </summary>
3584 ## <param name="domain">
3585 ##      <summary>
3586 ##      Domain to not audit.
3587 ##      </summary>
3588 ## </param>
3589 #
3590 interface(`userdom_dontaudit_use_user_ptys',`
3591         gen_require(`
3592                 type user_devpts_t;
3593         ')
3594
3595         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3596 ')
3597
3598 ########################################
3599 ## <summary>
3600 ##      Relabel files to unprivileged user pty types.
3601 ## </summary>
3602 ## <param name="domain">
3603 ##      <summary>
3604 ##      Domain allowed access.
3605 ##      </summary>
3606 ## </param>
3607 #
3608 interface(`userdom_relabelto_user_ptys',`
3609         gen_require(`
3610                 type user_devpts_t;
3611         ')
3612
3613         allow $1 user_devpts_t:chr_file relabelto;
3614 ')
3615
3616 ########################################
3617 ## <summary>
3618 ##      Do not audit attempts to relabel files from
3619 ##      user pty types.
3620 ## </summary>
3621 ## <param name="domain">
3622 ##      <summary>
3623 ##      Domain to not audit.
3624 ##      </summary>
3625 ## </param>
3626 #
3627 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3628         gen_require(`
3629                 type user_devpts_t;
3630         ')
3631
3632         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3633 ')
3634
3635 ########################################
3636 ## <summary>
3637 ##      Write all users files in /tmp
3638 ## </summary>
3639 ## <param name="domain">
3640 ##      <summary>
3641 ##      Domain allowed access.
3642 ##      </summary>
3643 ## </param>
3644 #
3645 interface(`userdom_write_user_tmp_files',`
3646         gen_require(`
3647                 type user_tmp_t;
3648         ')
3649
3650         write_files_pattern($1, user_tmp_t, user_tmp_t)
3651 ')
3652
3653 ########################################
3654 ## <summary>
3655 ##      Do not audit attempts to write users
3656 ##      temporary files.
3657 ## </summary>
3658 ## <param name="domain">
3659 ##      <summary>
3660 ##      Domain to not audit.
3661 ##      </summary>
3662 ## </param>
3663 #
3664 interface(`userdom_dontaudit_write_user_tmp_files',`
3665         gen_require(`
3666                 type user_tmp_t;
3667         ')
3668
3669         dontaudit $1 user_tmp_t:file write;
3670 ')
3671
3672 ########################################
3673 ## <summary>
3674 ##      Do not audit attempts to read/write users
3675 ##      temporary fifo files.
3676 ## </summary>
3677 ## <param name="domain">
3678 ##      <summary>
3679 ##      Domain to not audit.
3680 ##      </summary>
3681 ## </param>
3682 #
3683 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3684         gen_require(`
3685                 type user_tmp_t;
3686         ')
3687
3688         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3689 ')
3690
3691 ########################################
3692 ## <summary>
3693 ##      Do not audit attempts to use user ttys.
3694 ## </summary>
3695 ## <param name="domain">
3696 ##      <summary>
3697 ##      Domain to not audit.
3698 ##      </summary>
3699 ## </param>
3700 #
3701 interface(`userdom_dontaudit_use_user_ttys',`
3702         gen_require(`
3703                 type user_tty_device_t;
3704         ')
3705
3706         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3707 ')
3708
3709 ########################################
3710 ## <summary>
3711 ##      Read the process state of all user domains.
3712 ## </summary>
3713 ## <param name="domain">
3714 ##      <summary>
3715 ##      Domain allowed access.
3716 ##      </summary>
3717 ## </param>
3718 #
3719 interface(`userdom_read_all_users_state',`
3720         gen_require(`
3721                 attribute userdomain;
3722         ')
3723
3724         read_files_pattern($1, userdomain, userdomain)
3725         read_lnk_files_pattern($1,userdomain,userdomain)
3726         kernel_search_proc($1)
3727 ')
3728
3729 ########################################
3730 ## <summary>
3731 ##      Get the attributes of all user domains.
3732 ## </summary>
3733 ## <param name="domain">
3734 ##      <summary>
3735 ##      Domain allowed access.
3736 ##      </summary>
3737 ## </param>
3738 #
3739 interface(`userdom_getattr_all_users',`
3740         gen_require(`
3741                 attribute userdomain;
3742         ')
3743
3744         allow $1 userdomain:process getattr;
3745 ')
3746
3747 ########################################
3748 ## <summary>
3749 ##      Inherit the file descriptors from all user domains
3750 ## </summary>
3751 ## <param name="domain">
3752 ##      <summary>
3753 ##      Domain allowed access.
3754 ##      </summary>
3755 ## </param>
3756 #
3757 interface(`userdom_use_all_users_fds',`
3758         gen_require(`
3759                 attribute userdomain;
3760         ')
3761
3762         allow $1 userdomain:fd use;
3763 ')
3764
3765 ########################################
3766 ## <summary>
3767 ##      Do not audit attempts to inherit the file
3768 ##      descriptors from any user domains.
3769 ## </summary>
3770 ## <param name="domain">
3771 ##      <summary>
3772 ##      Domain to not audit.
3773 ##      </summary>
3774 ## </param>
3775 #
3776 interface(`userdom_dontaudit_use_all_users_fds',`
3777         gen_require(`
3778                 attribute userdomain;
3779         ')
3780
3781         dontaudit $1 userdomain:fd use;
3782 ')
3783
3784 ########################################
3785 ## <summary>
3786 ##      Send general signals to all user domains.
3787 ## </summary>
3788 ## <param name="domain">
3789 ##      <summary>
3790 ##      Domain allowed access.
3791 ##      </summary>
3792 ## </param>
3793 #
3794 interface(`userdom_signal_all_users',`
3795         gen_require(`
3796                 attribute userdomain;
3797         ')
3798
3799         allow $1 userdomain:process signal;
3800 ')
3801
3802 ########################################
3803 ## <summary>
3804 ##      Send kill signals to all user domains.
3805 ## </summary>
3806 ## <param name="domain">
3807 ##      <summary>
3808 ##      Domain allowed access.
3809 ##      </summary>
3810 ## </param>
3811 #
3812 interface(`userdom_kill_all_users',`
3813         gen_require(`
3814                 attribute userdomain;
3815         ')
3816
3817         allow $1 userdomain:process sigkill;
3818 ')
3819
3820 ########################################
3821 ## <summary>
3822 ##      Send a SIGCHLD signal to all user domains.
3823 ## </summary>
3824 ## <param name="domain">
3825 ##      <summary>
3826 ##      Domain allowed access.
3827 ##      </summary>
3828 ## </param>
3829 #
3830 interface(`userdom_sigchld_all_users',`
3831         gen_require(`
3832                 attribute userdomain;
3833         ')
3834
3835         allow $1 userdomain:process sigchld;
3836 ')
3837
3838 ########################################
3839 ## <summary>
3840 ##      Create keys for all user domains.
3841 ## </summary>
3842 ## <param name="domain">
3843 ##      <summary>
3844 ##      Domain allowed access.
3845 ##      </summary>
3846 ## </param>
3847 #
3848 interface(`userdom_create_all_users_keys',`
3849         gen_require(`
3850                 attribute userdomain;
3851         ')
3852
3853         allow $1 userdomain:key create;
3854 ')
3855
3856 ########################################
3857 ## <summary>
3858 ##      Send a dbus message to all user domains.
3859 ## </summary>
3860 ## <param name="domain">
3861 ##      <summary>
3862 ##      Domain allowed access.
3863 ##      </summary>
3864 ## </param>
3865 #
3866 interface(`userdom_dbus_send_all_users',`
3867         gen_require(`
3868                 attribute userdomain;
3869                 class dbus send_msg;
3870         ')
3871
3872         allow $1 userdomain:dbus send_msg;
3873 ')
3874
3875 ########################################
3876 ## <summary>
3877 ##      Allow apps to set rlimits on userdomain
3878 ## </summary>
3879 ## <param name="domain">
3880 ##      <summary>
3881 ##      Domain allowed access.
3882 ##      </summary>
3883 ## </param>
3884 #
3885 interface(`userdom_set_rlimitnh',`
3886         gen_require(`
3887                 attribute userdomain;
3888         ')
3889
3890         allow $1 userdomain:process rlimitinh;
3891 ')
3892
3893 ########################################
3894 ## <summary>
3895 ##      Define this type as a Allow apps to set rlimits on userdomain
3896 ## </summary>
3897 ## <param name="domain">
3898 ##      <summary>
3899 ##      Domain allowed access.
3900 ##      </summary>
3901 ## </param>
3902 ## <param name="userdomain_prefix">
3903 ##      <summary>
3904 ##      The prefix of the user domain (e.g., user
3905 ##      is the prefix for user_t).
3906 ## </summary>
3907 ## </param>
3908 ## <param name="domain">
3909 ##      <summary>
3910 ##      Domain allowed access.
3911 ##      </summary>
3912 ## </param>
3913 #
3914 template(`userdom_unpriv_usertype',`
3915         gen_require(`
3916                 attribute unpriv_userdomain, userdomain;
3917                 attribute $1_usertype;
3918         ')
3919         typeattribute $2  $1_usertype;
3920         typeattribute $2  unpriv_userdomain;
3921         typeattribute $2  userdomain;
3922
3923         auth_use_nsswitch($2)
3924         ubac_constrained($2)
3925 ')
3926
3927 ########################################
3928 ## <summary>
3929 ##      Connect to users over an unix stream socket.
3930 ## </summary>
3931 ## <param name="domain">
3932 ##      <summary>
3933 ##      Domain allowed access.
3934 ##      </summary>
3935 ## </param>
3936 #
3937 interface(`userdom_stream_connect',`
3938         gen_require(`
3939                 type user_tmp_t;
3940                 attribute userdomain;
3941         ')
3942
3943         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3944 ')
3945
3946 ########################################
3947 ## <summary>
3948 ##      Ptrace user domains.
3949 ## </summary>
3950 ## <param name="domain">
3951 ##      <summary>
3952 ##      Domain allowed access.
3953 ##      </summary>
3954 ## </param>
3955 #
3956 interface(`userdom_ptrace_all_users',`
3957         gen_require(`
3958                 attribute userdomain;
3959         ')
3960
3961         allow $1 userdomain:process ptrace;
3962 ')
3963
3964 ########################################
3965 ## <summary>
3966 ##      dontaudit Search /root
3967 ## </summary>
3968 ## <param name="domain">
3969 ##      <summary>
3970 ##      Domain to not audit.
3971 ##      </summary>
3972 ## </param>
3973 #
3974 interface(`userdom_dontaudit_search_admin_dir',`
3975         gen_require(`
3976                 type admin_home_t;
3977         ')
3978
3979         dontaudit $1 admin_home_t:dir search_dir_perms;
3980 ')
3981
3982 ########################################
3983 ## <summary>
3984 ##      dontaudit list /root
3985 ## </summary>
3986 ## <param name="domain">
3987 ##      <summary>
3988 ##      Domain to not audit.
3989 ##      </summary>
3990 ## </param>
3991 #
3992 interface(`userdom_dontaudit_list_admin_dir',`
3993         gen_require(`
3994                 type admin_home_t;
3995         ')
3996
3997         dontaudit $1 admin_home_t:dir list_dir_perms;
3998 ')
3999
4000 ########################################
4001 ## <summary>
4002 ##      Allow domain to  list /root
4003 ## </summary>
4004 ## <param name="domain">
4005 ##      <summary>
4006 ##      Domain allowed access.
4007 ##      </summary>
4008 ## </param>
4009 #
4010 interface(`userdom_list_admin_dir',`
4011         gen_require(`
4012                 type admin_home_t;
4013         ')
4014
4015         allow $1 admin_home_t:dir list_dir_perms;
4016 ')
4017
4018 ########################################
4019 ## <summary>
4020 ##      Allow Search /root
4021 ## </summary>
4022 ## <param name="domain">
4023 ##      <summary>
4024 ##      Domain allowed access.
4025 ##      </summary>
4026 ## </param>
4027 #
4028 interface(`userdom_search_admin_dir',`
4029         gen_require(`
4030                 type admin_home_t;
4031         ')
4032
4033         allow $1 admin_home_t:dir search_dir_perms;
4034 ')
4035
4036 ########################################
4037 ## <summary>
4038 ##      RW unpriviledged user SysV sempaphores.
4039 ## </summary>
4040 ## <param name="domain">
4041 ##      <summary>
4042 ##      Domain allowed access.
4043 ##      </summary>
4044 ## </param>
4045 #
4046 interface(`userdom_rw_semaphores',`
4047         gen_require(`
4048                 attribute unpriv_userdomain;
4049         ')
4050
4051         allow $1 unpriv_userdomain:sem rw_sem_perms;
4052 ')
4053
4054 ########################################
4055 ## <summary>
4056 ##      Send a message to unpriv users over a unix domain
4057 ##      datagram socket.
4058 ## </summary>
4059 ## <param name="domain">
4060 ##      <summary>
4061 ##      Domain allowed access.
4062 ##      </summary>
4063 ## </param>
4064 #
4065 interface(`userdom_dgram_send',`
4066         gen_require(`
4067                 attribute unpriv_userdomain;
4068         ')
4069
4070         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4071 ')
4072
4073 ######################################
4074 ## <summary>
4075 ##      Send a message to users over a unix domain
4076 ##      datagram socket.
4077 ## </summary>
4078 ## <param name="domain">
4079 ##      <summary>
4080 ##      Domain allowed access.
4081 ##      </summary>
4082 ## </param>
4083 #
4084 interface(`userdom_users_dgram_send',`
4085         gen_require(`
4086                  attribute userdomain;
4087       ')
4088
4089        allow $1 userdomain:unix_dgram_socket sendto;
4090 ')
4091
4092 #######################################
4093 ## <summary>
4094 ##      Allow execmod on files in homedirectory
4095 ## </summary>
4096 ## <param name="domain">
4097 ##      <summary>
4098 ##      Domain allowed access.
4099 ##      </summary>
4100 ## </param>
4101 ## <rolebase/>
4102 #
4103 interface(`userdom_execmod_user_home_files',`
4104         gen_require(`
4105                 type user_home_type;
4106         ')
4107
4108         allow $1 user_home_type:file execmod;
4109 ')
4110
4111 ########################################
4112 ## <summary>
4113 ##      Read admin home files.
4114 ## </summary>
4115 ## <param name="domain">
4116 ##      <summary>
4117 ##      Domain allowed access.
4118 ##      </summary>
4119 ## </param>
4120 ## <rolecap/>
4121 #
4122 interface(`userdom_read_admin_home_files',`
4123         gen_require(`
4124                 type admin_home_t;
4125         ')
4126
4127         read_files_pattern($1, admin_home_t, admin_home_t)
4128 ')
4129
4130 ########################################
4131 ## <summary>
4132 ##      Execute admin home files.
4133 ## </summary>
4134 ## <param name="domain">
4135 ##      <summary>
4136 ##      Domain allowed access.
4137 ##      </summary>
4138 ## </param>
4139 ## <rolecap/>
4140 #
4141 interface(`userdom_exec_admin_home_files',`
4142         gen_require(`
4143                 type admin_home_t;
4144         ')
4145
4146         exec_files_pattern($1, admin_home_t, admin_home_t)
4147 ')
4148
4149 ########################################
4150 ## <summary>
4151 ##      Append files inherited
4152 ##      in the /root directory.
4153 ## </summary>
4154 ## <param name="domain">
4155 ##      <summary>
4156 ##      Domain allowed access.
4157 ##      </summary>
4158 ## </param>
4159 #
4160 interface(`userdom_inherit_append_admin_home_files',`
4161         gen_require(`
4162                 type admin_home_t;
4163         ')
4164
4165         allow $1 admin_home_t:file { getattr append };
4166 ')
4167
4168
4169 #######################################
4170 ## <summary>
4171 ##      Manage all files/directories in the homedir
4172 ## </summary>
4173 ## <param name="userdomain">
4174 ##      <summary>
4175 ##      The user domain
4176 ##      </summary>
4177 ## </param>
4178 ## <rolebase/>
4179 #
4180 interface(`userdom_manage_user_home_content',`
4181         gen_require(`
4182                 type user_home_dir_t, user_home_t;
4183                 attribute user_home_type;
4184         ')
4185
4186         files_list_home($1)
4187         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4188         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4189         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4190         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4191         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4192         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4193
4194 ')
4195
4196
4197 ########################################
4198 ## <summary>
4199 ##      Create objects in a user home directory
4200 ##      with an automatic type transition to
4201 ##      the user home file type.
4202 ## </summary>
4203 ## <param name="domain">
4204 ##      <summary>
4205 ##      Domain allowed access.
4206 ##      </summary>
4207 ## </param>
4208 ## <param name="object_class">
4209 ##      <summary>
4210 ##      The class of the object to be created.
4211 ##      </summary>
4212 ## </param>
4213 #
4214 interface(`userdom_user_home_dir_filetrans_pattern',`
4215         gen_require(`
4216                 type user_home_dir_t, user_home_t;
4217         ')
4218
4219         type_transition $1 user_home_dir_t:$2 user_home_t;
4220 ')
4221
4222 ########################################
4223 ## <summary>
4224 ##      Create objects in the /root directory
4225 ##      with an automatic type transition to
4226 ##      a specified private type.
4227 ## </summary>
4228 ## <param name="domain">
4229 ##      <summary>
4230 ##      Domain allowed access.
4231 ##      </summary>
4232 ## </param>
4233 ## <param name="private_type">
4234 ##      <summary>
4235 ##      The type of the object to create.
4236 ##      </summary>
4237 ## </param>
4238 ## <param name="object_class">
4239 ##      <summary>
4240 ##      The class of the object to be created.
4241 ##      </summary>
4242 ## </param>
4243 #
4244 interface(`userdom_admin_home_dir_filetrans',`
4245         gen_require(`
4246                 type admin_home_t;
4247         ')
4248
4249         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4250 ')
4251
4252 ########################################
4253 ## <summary>
4254 ##      Send signull to unprivileged user domains.
4255 ## </summary>
4256 ## <param name="domain">
4257 ##      <summary>
4258 ##      Domain allowed access.
4259 ##      </summary>
4260 ## </param>
4261 #
4262 interface(`userdom_signull_unpriv_users',`
4263         gen_require(`
4264                 attribute unpriv_userdomain;
4265         ')
4266
4267         allow $1 unpriv_userdomain:process signull;
4268 ')
4269
4270 ########################################
4271 ## <summary>
4272 ##      Write all users files in /tmp
4273 ## </summary>
4274 ## <param name="domain">
4275 ##      <summary>
4276 ##      Domain allowed access.
4277 ##      </summary>
4278 ## </param>
4279 #
4280 interface(`userdom_write_user_tmp_dirs',`
4281         gen_require(`
4282                 type user_tmp_t;
4283         ')
4284
4285         write_files_pattern($1, user_tmp_t, user_tmp_t)
4286 ')
4287
4288 ########################################
4289 ## <summary>
4290 ##      Manage keys for all user domains.
4291 ## </summary>
4292 ## <param name="domain">
4293 ##      <summary>
4294 ##      Domain allowed access.
4295 ##      </summary>
4296 ## </param>
4297 #
4298 interface(`userdom_manage_all_users_keys',`
4299         gen_require(`
4300                 attribute userdomain;
4301         ')
4302
4303         allow $1 userdomain:key manage_key_perms;
4304 ')
4305
4306
4307 ########################################
4308 ## <summary>
4309 ##      Do not audit attempts to read and write
4310 ##      unserdomain stream.
4311 ## </summary>
4312 ## <param name="domain">
4313 ##      <summary>
4314 ##      Domain to not audit.
4315 ##      </summary>
4316 ## </param>
4317 #
4318 interface(`userdom_dontaudit_rw_stream',`
4319         gen_require(`
4320                 attribute userdomain;
4321         ')
4322
4323         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4324 ')
4325
4326 ########################################
4327 ## <summary>
4328 ##      Do not audit attempts to read and write
4329 ##      unserdomain datagram socket.
4330 ## </summary>
4331 ## <param name="domain">
4332 ##      <summary>
4333 ##      Domain to not audit.
4334 ##      </summary>
4335 ## </param>
4336 #
4337 interface(`userdom_dontaudit_rw_dgram_socket',`
4338         gen_require(`
4339                 attribute userdomain;
4340         ')
4341
4342         dontaudit $1 userdomain:unix_dgram_socket { read write };
4343 ')
4344
4345 ########################################
4346 ## <summary>
4347 ##      Append files
4348 ##      in a user home subdirectory.
4349 ## </summary>
4350 ## <param name="domain">
4351 ##      <summary>
4352 ##      Domain allowed access.
4353 ##      </summary>
4354 ## </param>
4355 #
4356 interface(`userdom_append_user_home_content_files',`
4357         gen_require(`
4358                 type user_home_dir_t, user_home_t;
4359         ')
4360
4361         append_files_pattern($1, user_home_t, user_home_t)
4362         allow $1 user_home_dir_t:dir search_dir_perms;
4363         files_search_home($1)
4364 ')
4365
4366 ########################################
4367 ## <summary>
4368 ##      Read files inherited
4369 ##      in a user home subdirectory.
4370 ## </summary>
4371 ## <param name="domain">
4372 ##      <summary>
4373 ##      Domain allowed access.
4374 ##      </summary>
4375 ## </param>
4376 #
4377 interface(`userdom_read_inherited_user_home_content_files',`
4378         gen_require(`
4379                 attribute user_home_type;
4380         ')
4381
4382         allow $1 user_home_type:file { getattr read };
4383 ')
4384
4385 ########################################
4386 ## <summary>
4387 ##      Append files inherited
4388 ##      in a user home subdirectory.
4389 ## </summary>
4390 ## <param name="domain">
4391 ##      <summary>
4392 ##      Domain allowed access.
4393 ##      </summary>
4394 ## </param>
4395 #
4396 interface(`userdom_inherit_append_user_home_content_files',`
4397         gen_require(`
4398                 type user_home_t;
4399         ')
4400
4401         allow $1 user_home_t:file { getattr append };
4402 ')
4403
4404 ########################################
4405 ## <summary>
4406 ##      Append files inherited
4407 ##      in a user tmp files.
4408 ## </summary>
4409 ## <param name="domain">
4410 ##      <summary>
4411 ##      Domain allowed access.
4412 ##      </summary>
4413 ## </param>
4414 #
4415 interface(`userdom_inherit_append_user_tmp_files',`
4416         gen_require(`
4417                 type user_tmp_t;
4418         ')
4419
4420         allow $1 user_tmp_t:file { getattr append };
4421 ')
4422
4423 ######################################
4424 ## <summary>
4425 ##      Read audio files in the users homedir.
4426 ## </summary>
4427 ## <param name="domain">
4428 ##      <summary>
4429 ##      Domain allowed access.
4430 ##      </summary>
4431 ## </param>
4432 ## <rolecap/>
4433 #
4434 interface(`userdom_read_home_audio_files',`
4435         gen_require(`
4436                 type audio_home_t;
4437         ')
4438
4439         userdom_search_user_home_dirs($1)
4440         allow $1 audio_home_t:dir list_dir_perms;
4441         read_files_pattern($1, audio_home_t, audio_home_t)
4442         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      Do not audit attempts to write all user home content files.
4448 ## </summary>
4449 ## <param name="domain">
4450 ##      <summary>
4451 ##      Domain to not audit.
4452 ##      </summary>
4453 ## </param>
4454 #
4455 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4456         gen_require(`
4457                 attribute user_home_type;
4458         ')
4459
4460         dontaudit $1 user_home_type:file write_file_perms;
4461 ')
4462
4463 ########################################
4464 ## <summary>
4465 ##      Do not audit attempts to write all user tmp content files.
4466 ## </summary>
4467 ## <param name="domain">
4468 ##      <summary>
4469 ##      Domain to not audit.
4470 ##      </summary>
4471 ## </param>
4472 #
4473 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4474         gen_require(`
4475                 attribute user_tmp_type;
4476         ')
4477
4478         dontaudit $1 user_tmp_type:file write_file_perms;
4479 ')
4480
4481 ########################################
4482 ## <summary>
4483 ##      Manage all user temporary content.
4484 ## </summary>
4485 ## <param name="domain">
4486 ##      <summary>
4487 ##      Domain allowed access.
4488 ##      </summary>
4489 ## </param>
4490 #
4491 interface(`userdom_manage_all_user_tmp_content',`
4492         gen_require(`
4493                 attribute user_tmp_type;
4494         ')
4495
4496         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4497         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4498         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4499         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4500         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4501         files_search_tmp($1)
4502 ')
4503
4504 ########################################
4505 ## <summary>
4506 ##      List all user temporary content.
4507 ## </summary>
4508 ## <param name="domain">
4509 ##      <summary>
4510 ##      Domain allowed access.
4511 ##      </summary>
4512 ## </param>
4513 #
4514 interface(`userdom_list_all_user_tmp_content',`
4515         gen_require(`
4516                 attribute user_tmp_type;
4517         ')
4518
4519         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4520         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4521         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4522         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4523         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4524         files_search_var($1)
4525         files_search_tmp($1)
4526 ')
4527
4528 ########################################
4529 ## <summary>
4530 ##      Manage all user tmpfs content.
4531 ## </summary>
4532 ## <param name="domain">
4533 ##      <summary>
4534 ##      Domain allowed access.
4535 ##      </summary>
4536 ## </param>
4537 #
4538 interface(`userdom_manage_all_user_tmpfs_content',`
4539         gen_require(`
4540                 attribute user_tmpfs_type;
4541         ')
4542
4543         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4544         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4545         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4546         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4547         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4548         fs_search_tmpfs($1)
4549 ')
4550
4551 ########################################
4552 ## <summary>
4553 ##      Delete all user temporary content.
4554 ## </summary>
4555 ## <param name="domain">
4556 ##      <summary>
4557 ##      Domain allowed access.
4558 ##      </summary>
4559 ## </param>
4560 #
4561 interface(`userdom_delete_all_user_tmp_content',`
4562         gen_require(`
4563                 attribute user_tmp_type;
4564         ')
4565
4566         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4567         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4568         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4569         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4570         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4571         # /var/tmp
4572         files_search_var($1)
4573         files_delete_tmp_dir_entry($1)
4574 ')
4575
4576 ########################################
4577 ## <summary>
4578 ##      Read system SSL certificates in the users homedir.
4579 ## </summary>
4580 ## <param name="domain">
4581 ##      <summary>
4582 ##      Domain allowed access.
4583 ##      </summary>
4584 ## </param>
4585 #
4586 interface(`userdom_read_home_certs',`
4587         gen_require(`
4588                 type home_cert_t;
4589         ')
4590
4591         userdom_search_user_home_content($1)
4592         allow $1 home_cert_t:dir list_dir_perms;
4593         read_files_pattern($1, home_cert_t, home_cert_t)
4594         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4595 ')
4596
4597 #######################################
4598 ## <summary>
4599 ##  Dontaudit Write system SSL certificates in the users homedir.
4600 ## </summary>
4601 ## <param name="domain">
4602 ##  <summary>
4603 ##      Domain to not audit.
4604 ##  </summary>
4605 ## </param>
4606 #
4607 interface(`userdom_dontaudit_write_home_certs',`
4608     gen_require(`
4609         type home_cert_t;
4610     ')
4611
4612     dontaudit $1 home_cert_t:file write;
4613 ')
4614
4615 ########################################
4616 ## <summary>
4617 ##      dontaudit Search getatrr /root files
4618 ## </summary>
4619 ## <param name="domain">
4620 ##      <summary>
4621 ##      Domain to not audit.
4622 ##      </summary>
4623 ## </param>
4624 #
4625 interface(`userdom_dontaudit_getattr_admin_home_files',`
4626         gen_require(`
4627                 type admin_home_t;
4628         ')
4629
4630         dontaudit $1 admin_home_t:file getattr;
4631 ')
4632
4633 ########################################
4634 ## <summary>
4635 ##      dontaudit read /root lnk files
4636 ## </summary>
4637 ## <param name="domain">
4638 ##      <summary>
4639 ##      Domain to not audit.
4640 ##      </summary>
4641 ## </param>
4642 #
4643 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4644         gen_require(`
4645                 type admin_home_t;
4646         ')
4647
4648         dontaudit $1 admin_home_t:lnk_file read;
4649 ')
4650
4651 ########################################
4652 ## <summary>
4653 ##      dontaudit read /root files
4654 ## </summary>
4655 ## <param name="domain">
4656 ##      <summary>
4657 ##      Domain to not audit.
4658 ##      </summary>
4659 ## </param>
4660 #
4661 interface(`userdom_dontaudit_read_admin_home_files',`
4662         gen_require(`
4663                 type admin_home_t;
4664         ')
4665
4666         dontaudit $1 admin_home_t:file read_file_perms;
4667 ')
4668
4669 ########################################
4670 ## <summary>
4671 ##      Create, read, write, and delete user
4672 ##      temporary chr files.
4673 ## </summary>
4674 ## <param name="domain">
4675 ##      <summary>
4676 ##      Domain allowed access.
4677 ##      </summary>
4678 ## </param>
4679 #
4680 interface(`userdom_manage_user_tmp_chr_files',`
4681         gen_require(`
4682                 type user_tmp_t;
4683         ')
4684
4685         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4686         files_search_tmp($1)
4687 ')
4688
4689 ########################################
4690 ## <summary>
4691 ##      Create, read, write, and delete user
4692 ##      temporary blk files.
4693 ## </summary>
4694 ## <param name="domain">
4695 ##      <summary>
4696 ##      Domain allowed access.
4697 ##      </summary>
4698 ## </param>
4699 #
4700 interface(`userdom_manage_user_tmp_blk_files',`
4701         gen_require(`
4702                 type user_tmp_t;
4703         ')
4704
4705         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4706         files_search_tmp($1)
4707 ')
4708
4709 ########################################
4710 ## <summary>
4711 ##      Dontaudit attempt to set attributes on  user temporary directories.
4712 ## </summary>
4713 ## <param name="domain">
4714 ##      <summary>
4715 ##      Domain to not audit.
4716 ##      </summary>
4717 ## </param>
4718 #
4719 interface(`userdom_dontaudit_setattr_user_tmp',`
4720         gen_require(`
4721                 type user_tmp_t;
4722         ')
4723
4724         dontaudit $1 user_tmp_t:dir setattr;
4725 ')
4726
4727 ########################################
4728 ## <summary>
4729 ##      Write all inherited users files in /tmp
4730 ## </summary>
4731 ## <param name="domain">
4732 ##      <summary>
4733 ##      Domain allowed access.
4734 ##      </summary>
4735 ## </param>
4736 #
4737 interface(`userdom_write_inherited_user_tmp_files',`
4738         gen_require(`
4739                 type user_tmp_t;
4740         ')
4741
4742         allow $1 user_tmp_t:file write;
4743 ')
4744
4745 ########################################
4746 ## <summary>
4747 ##      Delete all users files in /tmp
4748 ## </summary>
4749 ## <param name="domain">
4750 ##      <summary>
4751 ##      Domain allowed access.
4752 ##      </summary>
4753 ## </param>
4754 #
4755 interface(`userdom_delete_user_tmp_files',`
4756         gen_require(`
4757                 type user_tmp_t;
4758         ')
4759
4760         allow $1 user_tmp_t:file delete_file_perms;
4761 ')
4762
4763 ########################################
4764 ## <summary>
4765 ##      Delete user tmpfs files.
4766 ## </summary>
4767 ## <param name="domain">
4768 ##      <summary>
4769 ##      Domain allowed access.
4770 ##      </summary>
4771 ## </param>
4772 #
4773 interface(`userdom_delete_user_tmpfs_files',`
4774         gen_require(`
4775                 type user_tmpfs_t;
4776         ')
4777
4778         allow $1 user_tmpfs_t:file delete_file_perms;
4779 ')
4780
4781 ########################################
4782 ## <summary>
4783 ##      Read/Write unpriviledged user SysV shared
4784 ##      memory segments.
4785 ## </summary>
4786 ## <param name="domain">
4787 ##      <summary>
4788 ##      Domain allowed access.
4789 ##      </summary>
4790 ## </param>
4791 #
4792 interface(`userdom_rw_unpriv_user_shared_mem',`
4793         gen_require(`
4794                 attribute unpriv_userdomain;
4795         ')
4796
4797         allow $1 unpriv_userdomain:shm rw_shm_perms;
4798 ')
4799
4800 ########################################
4801 ## <summary>
4802 ##      Do not audit attempts to search user
4803 ##      temporary directories.
4804 ## </summary>
4805 ## <param name="domain">
4806 ##      <summary>
4807 ##      Domain to not audit.
4808 ##      </summary>
4809 ## </param>
4810 #
4811 interface(`userdom_dontaudit_search_user_tmp',`
4812         gen_require(`
4813                 type user_tmp_t;
4814         ')
4815
4816         dontaudit $1 user_tmp_t:dir search_dir_perms;
4817 ')
4818
4819 ########################################
4820 ## <summary>
4821 ##      Execute a file in a user home directory
4822 ##      in the specified domain.
4823 ## </summary>
4824 ## <desc>
4825 ##      <p>
4826 ##      Execute a file in a user home directory
4827 ##      in the specified domain.
4828 ##      </p>
4829 ##      <p>
4830 ##      No interprocess communication (signals, pipes,
4831 ##      etc.) is provided by this interface since
4832 ##      the domains are not owned by this module.
4833 ##      </p>
4834 ## </desc>
4835 ## <param name="domain">
4836 ##      <summary>
4837 ##      Domain allowed access.
4838 ##      </summary>
4839 ## </param>
4840 ## <param name="target_domain">
4841 ##      <summary>
4842 ##      The type of the new process.
4843 ##      </summary>
4844 ## </param>
4845 #
4846 interface(`userdom_domtrans_user_home',`
4847         gen_require(`
4848                 type user_home_t;
4849         ')
4850
4851         read_lnk_files_pattern($1, user_home_t, user_home_t)
4852         domain_transition_pattern($1, user_home_t, $2)
4853         type_transition $1 user_home_t:process $2;
4854 ')
4855
4856 ########################################
4857 ## <summary>
4858 ##      Execute a file in a user tmp directory
4859 ##      in the specified domain.
4860 ## </summary>
4861 ## <desc>
4862 ##      <p>
4863 ##      Execute a file in a user tmp directory
4864 ##      in the specified domain.
4865 ##      </p>
4866 ##      <p>
4867 ##      No interprocess communication (signals, pipes,
4868 ##      etc.) is provided by this interface since
4869 ##      the domains are not owned by this module.
4870 ##      </p>
4871 ## </desc>
4872 ## <param name="domain">
4873 ##      <summary>
4874 ##      Domain allowed access.
4875 ##      </summary>
4876 ## </param>
4877 ## <param name="target_domain">
4878 ##      <summary>
4879 ##      The type of the new process.
4880 ##      </summary>
4881 ## </param>
4882 #
4883 interface(`userdom_domtrans_user_tmp',`
4884         gen_require(`
4885                 type user_tmp_t;
4886         ')
4887
4888         files_search_tmp($1)
4889         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4890         domain_transition_pattern($1, user_tmp_t, $2)
4891         type_transition $1 user_tmp_t:process $2;
4892 ')
4893
4894 ########################################
4895 ## <summary>
4896 ##      Do not audit attempts to read all user home content files.
4897 ## </summary>
4898 ## <param name="domain">
4899 ##      <summary>
4900 ##      Domain to not audit.
4901 ##      </summary>
4902 ## </param>
4903 #
4904 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4905         gen_require(`
4906                 attribute user_home_type;
4907         ')
4908
4909         dontaudit $1 user_home_type:file read_file_perms;
4910 ')
4911
4912 ########################################
4913 ## <summary>
4914 ##      Do not audit attempts to read all user tmp content files.
4915 ## </summary>
4916 ## <param name="domain">
4917 ##      <summary>
4918 ##      Domain to not audit.
4919 ##      </summary>
4920 ## </param>
4921 #
4922 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4923         gen_require(`
4924                 attribute user_tmp_type;
4925         ')
4926
4927         dontaudit $1 user_tmp_type:file read_file_perms;
4928 ')
4929
4930 #######################################
4931 ## <summary>
4932 ## Read and write unpriviledged user SysV sempaphores.
4933 ## </summary>
4934 ## <param name="domain">
4935 ## <summary>
4936 ## Domain allowed access.
4937 ## </summary>
4938 ## </param>
4939 #
4940 interface(`userdom_rw_unpriv_user_semaphores',`
4941    gen_require(`
4942        attribute unpriv_userdomain;
4943    ')
4944
4945    allow $1 unpriv_userdomain:sem rw_sem_perms;
4946 ')