policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678                 alsa_filetrans_named_content($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 nsplugin_role($1_r, $1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_mysql_connect',`
 797                         mysql_stream_connect($1_t)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 oident_manage_user_content($1_t)
 803                 oident_relabel_user_content($1_t)
 804         ')
 805
 806         optional_policy(`
 807                 # to allow monitoring of pcmcia status
 808                 pcmcia_read_pid($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 pcscd_read_pub_files($1_usertype)
 813                 pcscd_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 tunable_policy(`allow_user_postgresql_connect',`
 818                         postgresql_stream_connect($1_usertype)
 819                         postgresql_tcp_connect($1_usertype)
 820                 ')
 821         ')
 822
 823         optional_policy(`
 824                 resmgr_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpc_dontaudit_getattr_exports($1_usertype)
 829                 rpc_manage_nfs_rw_content($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 rpcbind_stream_connect($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 samba_stream_connect_winbind($1_usertype)
 838         ')
 839
 840         optional_policy(`
 841                 sandbox_transition($1_usertype, $1_r)
 842         ')
 843
 844         optional_policy(`
 845                 seunshare_role_template($1, $1_r, $1_t)
 846         ')
 847
 848         optional_policy(`
 849                 slrnpull_search_spool($1_usertype)
 850         ')
 851
 852 ')
 853
 854 #######################################
 855 ## <summary>
 856 ##      The template for creating a login user.
 857 ## </summary>
 858 ## <desc>
 859 ##      <p>
 860 ##      This template creates a user domain, types, and
 861 ##      rules for the user's tty, pty, home directories,
 862 ##      tmp, and tmpfs files.
 863 ##      </p>
 864 ## </desc>
 865 ## <param name="userdomain_prefix">
 866 ##      <summary>
 867 ##      The prefix of the user domain (e.g., user
 868 ##      is the prefix for user_t).
 869 ##      </summary>
 870 ## </param>
 871 #
 872 template(`userdom_login_user_template', `
 873         gen_require(`
 874                 class context contains;
 875         ')
 876
 877         userdom_base_user_template($1)
 878
 879         userdom_manage_home_role($1_r, $1_usertype)
 880
 881         userdom_manage_tmp_role($1_r, $1_usertype)
 882         userdom_manage_tmpfs_role($1_r, $1_usertype)
 883
 884         ifelse(`$1',`unconfined',`',`
 885                 gen_tunable(allow_$1_exec_content, true)
 886
 887                 tunable_policy(`allow_$1_exec_content',`
 888                         userdom_exec_user_tmp_files($1_usertype)
 889                         userdom_exec_user_home_content_files($1_usertype)
 890                 ')
 891                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 892                         fs_exec_nfs_files($1_usertype)
 893                 ')
 894
 895                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 896                         fs_exec_cifs_files($1_usertype)
 897                 ')
 898         ')
 899
 900         userdom_change_password_template($1)
 901
 902         ##############################
 903         #
 904         # User domain Local policy
 905         #
 906
 907         allow $1_t self:capability { setgid chown fowner };
 908         dontaudit $1_t self:capability { sys_nice fsetid };
 909
 910         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 911         dontaudit $1_t self:process setrlimit;
 912         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 913
 914         allow $1_t self:context contains;
 915
 916         kernel_dontaudit_read_system_state($1_usertype)
 917         kernel_dontaudit_list_all_proc($1_usertype)
 918
 919         dev_read_sysfs($1_usertype)
 920         dev_read_urand($1_usertype)
 921
 922         domain_use_interactive_fds($1_usertype)
 923         # Command completion can fire hundreds of denials
 924         domain_dontaudit_exec_all_entry_files($1_usertype)
 925
 926         files_dontaudit_list_default($1_usertype)
 927         files_dontaudit_read_default_files($1_usertype)
 928         # Stat lost+found.
 929         files_getattr_lost_found_dirs($1_usertype)
 930
 931         fs_get_all_fs_quotas($1_usertype)
 932         fs_getattr_all_fs($1_usertype)
 933         fs_search_all($1_usertype)
 934         fs_list_inotifyfs($1_usertype)
 935         fs_rw_anon_inodefs_files($1_usertype)
 936
 937         auth_dontaudit_write_login_records($1_t)
 938         auth_rw_cache($1_t)
 939
 940         application_exec_all($1_t)
 941         # The library functions always try to open read-write first,
 942         # then fall back to read-only if it fails.
 943         init_dontaudit_rw_utmp($1_t)
 944
 945         # Stop warnings about access to /dev/console
 946         init_dontaudit_use_fds($1_usertype)
 947         init_dontaudit_use_script_fds($1_usertype)
 948
 949         libs_exec_lib_files($1_usertype)
 950
 951         logging_dontaudit_getattr_all_logs($1_usertype)
 952
 953         # for running TeX programs
 954         miscfiles_read_tetex_data($1_usertype)
 955         miscfiles_exec_tetex_data($1_usertype)
 956
 957         seutil_read_config($1_usertype)
 958
 959         optional_policy(`
 960                 cups_read_config($1_usertype)
 961                 cups_stream_connect($1_usertype)
 962                 cups_stream_connect_ptal($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 kerberos_use($1_usertype)
 967                 kerberos_filetrans_home_content($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 mta_dontaudit_read_spool_symlinks($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 quota_dontaudit_getattr_db($1_usertype)
 976         ')
 977
 978         optional_policy(`
 979                 rpm_read_db($1_usertype)
 980                 rpm_dontaudit_manage_db($1_usertype)
 981                 rpm_read_cache($1_usertype)
 982         ')
 983
 984         optional_policy(`
 985                 oddjob_run_mkhomedir($1_t, $1_r)
 986         ')
 987 ')
 988
 989 #######################################
 990 ## <summary>
 991 ##      The template for creating a unprivileged login user.
 992 ## </summary>
 993 ## <desc>
 994 ##      <p>
 995 ##      This template creates a user domain, types, and
 996 ##      rules for the user's tty, pty, home directories,
 997 ##      tmp, and tmpfs files.
 998 ##      </p>
 999 ## </desc>
1000 ## <param name="userdomain_prefix">
1001 ##      <summary>
1002 ##      The prefix of the user domain (e.g., user
1003 ##      is the prefix for user_t).
1004 ##      </summary>
1005 ## </param>
1006 #
1007 template(`userdom_restricted_user_template',`
1008         gen_require(`
1009                 attribute unpriv_userdomain;
1010         ')
1011
1012         userdom_login_user_template($1)
1013
1014         typeattribute $1_t unpriv_userdomain;
1015         domain_interactive_fd($1_t)
1016
1017         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1018         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1019
1020         ##############################
1021         #
1022         # Local policy
1023         #
1024
1025         optional_policy(`
1026                 loadkeys_run($1_t, $1_r)
1027         ')
1028 ')
1029
1030 #######################################
1031 ## <summary>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ## </summary>
1034 ## <desc>
1035 ##      <p>
1036 ##      The template for creating a unprivileged xwindows login user.
1037 ##      </p>
1038 ##      <p>
1039 ##      This template creates a user domain, types, and
1040 ##      rules for the user's tty, pty, home directories,
1041 ##      tmp, and tmpfs files.
1042 ##      </p>
1043 ## </desc>
1044 ## <param name="userdomain_prefix">
1045 ##      <summary>
1046 ##      The prefix of the user domain (e.g., user
1047 ##      is the prefix for user_t).
1048 ##      </summary>
1049 ## </param>
1050 #
1051 template(`userdom_restricted_xwindows_user_template',`
1052
1053         userdom_restricted_user_template($1)
1054
1055         ##############################
1056         #
1057         # Local policy
1058         #
1059
1060         auth_role($1_r, $1_t)
1061         auth_search_pam_console_data($1_usertype)
1062         auth_dontaudit_read_login_records($1_usertype)
1063
1064         dev_read_sound($1_usertype)
1065         dev_write_sound($1_usertype)
1066         # gnome keyring wants to read this.
1067         dev_dontaudit_read_rand($1_usertype)
1068         # temporarily allow since openoffice requires this
1069         dev_read_rand($1_usertype)
1070
1071         dev_read_video_dev($1_usertype)
1072         dev_write_video_dev($1_usertype)
1073         dev_rw_wireless($1_usertype)
1074
1075         libs_dontaudit_setattr_lib_files($1_usertype)
1076
1077         tunable_policy(`user_rw_noexattrfile',`
1078                 dev_rw_usbfs($1_t)
1079                 dev_rw_generic_usb_dev($1_usertype)
1080
1081                 fs_manage_noxattr_fs_files($1_usertype)
1082                 fs_manage_noxattr_fs_dirs($1_usertype)
1083                 fs_manage_dos_dirs($1_usertype)
1084                 fs_manage_dos_files($1_usertype)
1085                 storage_raw_read_removable_device($1_usertype)
1086                 storage_raw_write_removable_device($1_usertype)
1087         ')
1088
1089         logging_send_syslog_msg($1_usertype)
1090         logging_dontaudit_send_audit_msgs($1_t)
1091
1092         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1093         logging_send_audit_msgs($1_t)
1094         selinux_get_enforce_mode($1_t)
1095         seutil_exec_restorecond($1_t)
1096         seutil_read_file_contexts($1_t)
1097         seutil_read_default_contexts($1_t)
1098
1099         xserver_restricted_role($1_r, $1_t)
1100
1101         optional_policy(`
1102                 alsa_read_rw_config($1_usertype)
1103         ')
1104
1105          # cjp: needed by KDE apps
1106          # bug: #682499
1107          optional_policy(`
1108                 gnome_read_usr_config($1_usertype)
1109                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1110                 # cjp: telepathy F15 bugs
1111                 telepathy_role($1_r, $1_t, $1)
1112         ')
1113
1114         optional_policy(`
1115                 dbus_role_template($1, $1_r, $1_usertype)
1116                 dbus_system_bus_client($1_usertype)
1117                 allow $1_usertype $1_usertype:dbus send_msg;
1118
1119                 optional_policy(`
1120                         abrt_dbus_chat($1_usertype)
1121                         abrt_run_helper($1_usertype, $1_r)
1122                 ')
1123
1124                 optional_policy(`
1125                         consolekit_dontaudit_read_log($1_usertype)
1126                         consolekit_dbus_chat($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         cups_dbus_chat($1_usertype)
1131                         cups_dbus_chat_config($1_usertype)
1132                 ')
1133
1134                 optional_policy(`
1135                         devicekit_dbus_chat($1_usertype)
1136                         devicekit_dbus_chat_disk($1_usertype)
1137                         devicekit_dbus_chat_power($1_usertype)
1138                 ')
1139
1140                 optional_policy(`
1141                         fprintd_dbus_chat($1_t)
1142                 ')
1143         ')
1144
1145         optional_policy(`
1146                 openoffice_role_template($1, $1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 policykit_role($1_r, $1_usertype)
1151         ')
1152
1153         optional_policy(`
1154                 pulseaudio_role($1_r, $1_usertype)
1155                 pulseaudio_filetrans_admin_home_content($1_usertype)
1156                 pulseaudio_filetrans_home_content($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 rtkit_scheduled($1_usertype)
1161         ')
1162
1163         optional_policy(`
1164                 setroubleshoot_dontaudit_stream_connect($1_t)
1165         ')
1166
1167         optional_policy(`
1168                 udev_read_db($1_usertype)
1169         ')
1170
1171         optional_policy(`
1172                 wm_role_template($1, $1_r, $1_t)
1173         ')
1174 ')
1175
1176 #######################################
1177 ## <summary>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      The template for creating a unprivileged user roughly
1184 ##      equivalent to a regular linux user.
1185 ##      </p>
1186 ##      <p>
1187 ##      This template creates a user domain, types, and
1188 ##      rules for the user's tty, pty, home directories,
1189 ##      tmp, and tmpfs files.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="userdomain_prefix">
1193 ##      <summary>
1194 ##      The prefix of the user domain (e.g., user
1195 ##      is the prefix for user_t).
1196 ##      </summary>
1197 ## </param>
1198 #
1199 template(`userdom_unpriv_user_template', `
1200
1201         ##############################
1202         #
1203         # Declarations
1204         #
1205
1206         # Inherit rules for ordinary users.
1207         userdom_restricted_xwindows_user_template($1)
1208         userdom_common_user_template($1)
1209
1210         ##############################
1211         #
1212         # Local policy
1213         #
1214
1215         # port access is audited even if dac would not have allowed it, so dontaudit it here
1216 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1217         # Need the following rule to allow users to run vpnc
1218         corenet_tcp_bind_xserver_port($1_t)
1219         corenet_tcp_bind_generic_node($1_usertype)
1220
1221         storage_rw_fuse($1_t)
1222
1223         files_exec_usr_files($1_t)
1224    # cjp: why?
1225         files_read_kernel_symbol_table($1_t)
1226
1227         ifndef(`enable_mls',`
1228                 fs_exec_noxattr($1_t)
1229
1230                 tunable_policy(`user_rw_noexattrfile',`
1231                         fs_manage_noxattr_fs_files($1_t)
1232                         fs_manage_noxattr_fs_dirs($1_t)
1233                         # Write floppies
1234                         storage_raw_read_removable_device($1_t)
1235                         storage_raw_write_removable_device($1_t)
1236                 ',`
1237                         storage_raw_read_removable_device($1_t)
1238                 ')
1239         ')
1240
1241         miscfiles_read_hwdata($1_usertype)
1242
1243         # Allow users to run TCP servers (bind to ports and accept connection from
1244         # the same domain and outside users) disabling this forces FTP passive mode
1245         # and may change other protocols
1246
1247         tunable_policy(`user_share_music',`
1248                 corenet_tcp_bind_daap_port($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_tcp_server',`
1252                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1253         ')
1254
1255         tunable_policy(`user_setrlimit',`
1256                 allow $1_usertype self:process setrlimit;
1257         ')
1258
1259         optional_policy(`
1260                 cdrecord_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 cron_role($1_r, $1_t)
1265         ')
1266
1267         optional_policy(`
1268                 games_rw_data($1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gpg_role($1_r, $1_usertype)
1273         ')
1274
1275         optional_policy(`
1276                 gnomeclock_dbus_chat($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 gpm_stream_connect($1_usertype)
1281         ')
1282
1283         optional_policy(`
1284                 execmem_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 java_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mono_role_template($1, $1_r, $1_t)
1293         ')
1294
1295         optional_policy(`
1296                 mount_run_fusermount($1_t, $1_r)
1297                 mount_read_pid_files($1_t)
1298         ')
1299
1300         optional_policy(`
1301                 wine_role_template($1, $1_r, $1_t)
1302         ')
1303
1304         optional_policy(`
1305                 postfix_run_postdrop($1_t, $1_r)
1306         ')
1307
1308         # Run pppd in pppd_t by default for user
1309         optional_policy(`
1310                 ppp_run_cond($1_t, $1_r)
1311         ')
1312
1313         optional_policy(`
1314                 vdagent_getattr_log($1_t)
1315                 vdagent_getattr_exec($1_t)
1316                 vdagent_stream_connect($1_t)
1317         ')
1318 ')
1319
1320 #######################################
1321 ## <summary>
1322 ##      The template for creating an administrative user.
1323 ## </summary>
1324 ## <desc>
1325 ##      <p>
1326 ##      This template creates a user domain, types, and
1327 ##      rules for the user's tty, pty, home directories,
1328 ##      tmp, and tmpfs files.
1329 ##      </p>
1330 ##      <p>
1331 ##      The privileges given to administrative users are:
1332 ##      <ul>
1333 ##              <li>Raw disk access</li>
1334 ##              <li>Set all sysctls</li>
1335 ##              <li>All kernel ring buffer controls</li>
1336 ##              <li>Create, read, write, and delete all files but shadow</li>
1337 ##              <li>Manage source and binary format SELinux policy</li>
1338 ##              <li>Run insmod</li>
1339 ##      </ul>
1340 ##      </p>
1341 ## </desc>
1342 ## <param name="userdomain_prefix">
1343 ##      <summary>
1344 ##      The prefix of the user domain (e.g., sysadm
1345 ##      is the prefix for sysadm_t).
1346 ##      </summary>
1347 ## </param>
1348 #
1349 template(`userdom_admin_user_template',`
1350         gen_require(`
1351                 attribute admindomain;
1352                 class passwd { passwd chfn chsh rootok crontab };
1353         ')
1354
1355         ##############################
1356         #
1357         # Declarations
1358         #
1359
1360         # Inherit rules for ordinary users.
1361         userdom_login_user_template($1)
1362         userdom_common_user_template($1)
1363
1364         domain_obj_id_change_exemption($1_t)
1365         role system_r types $1_t;
1366
1367         typeattribute $1_t admindomain;
1368
1369         ifdef(`direct_sysadm_daemon',`
1370                 domain_system_change_exemption($1_t)
1371         ')
1372
1373         ##############################
1374         #
1375         # $1_t local policy
1376         #
1377
1378         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1379         allow $1_t self:capability2 syslog;
1380         allow $1_t self:process { setexec setfscreate };
1381         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1382         allow $1_t self:tun_socket create;
1383         # Set password information for other users.
1384         allow $1_t self:passwd { passwd chfn chsh };
1385         # Skip authentication when pam_rootok is specified.
1386         allow $1_t self:passwd rootok;
1387
1388         # Manipulate other users crontab.
1389         allow $1_t self:passwd crontab;
1390
1391         kernel_read_software_raid_state($1_t)
1392         kernel_getattr_core_if($1_t)
1393         kernel_getattr_message_if($1_t)
1394         kernel_change_ring_buffer_level($1_t)
1395         kernel_clear_ring_buffer($1_t)
1396         kernel_read_ring_buffer($1_t)
1397         kernel_get_sysvipc_info($1_t)
1398         kernel_rw_all_sysctls($1_t)
1399         # signal unlabeled processes:
1400         kernel_kill_unlabeled($1_t)
1401         kernel_signal_unlabeled($1_t)
1402         kernel_sigstop_unlabeled($1_t)
1403         kernel_signull_unlabeled($1_t)
1404         kernel_sigchld_unlabeled($1_t)
1405         kernel_signal($1_t)
1406
1407         corenet_tcp_bind_generic_port($1_t)
1408         # allow setting up tunnels
1409         corenet_rw_tun_tap_dev($1_t)
1410
1411         dev_getattr_generic_blk_files($1_t)
1412         dev_getattr_generic_chr_files($1_t)
1413         # for lsof
1414         dev_getattr_mtrr_dev($1_t)
1415         # Allow MAKEDEV to work
1416         dev_create_all_blk_files($1_t)
1417         dev_create_all_chr_files($1_t)
1418         dev_delete_all_blk_files($1_t)
1419         dev_delete_all_chr_files($1_t)
1420         dev_rename_all_blk_files($1_t)
1421         dev_rename_all_chr_files($1_t)
1422         dev_create_generic_symlinks($1_t)
1423         dev_rw_generic_usb_dev($1_t)
1424         dev_rw_usbfs($1_t)
1425
1426         domain_setpriority_all_domains($1_t)
1427         domain_read_all_domains_state($1_t)
1428         domain_getattr_all_domains($1_t)
1429         domain_getcap_all_domains($1_t)
1430         domain_dontaudit_ptrace_all_domains($1_t)
1431         # signal all domains:
1432         domain_kill_all_domains($1_t)
1433         domain_signal_all_domains($1_t)
1434         domain_signull_all_domains($1_t)
1435         domain_sigstop_all_domains($1_t)
1436         domain_sigstop_all_domains($1_t)
1437         domain_sigchld_all_domains($1_t)
1438         # for lsof
1439         domain_getattr_all_sockets($1_t)
1440         domain_dontaudit_getattr_all_sockets($1_t)
1441
1442         files_exec_usr_src_files($1_t)
1443
1444         fs_getattr_all_fs($1_t)
1445         fs_getattr_all_files($1_t)
1446         fs_list_all($1_t)
1447         fs_set_all_quotas($1_t)
1448         fs_exec_noxattr($1_t)
1449
1450         storage_raw_read_removable_device($1_t)
1451         storage_raw_write_removable_device($1_t)
1452         storage_dontaudit_read_fixed_disk($1_t)
1453
1454         term_use_all_inherited_terms($1_t)
1455         term_use_unallocated_ttys($1_t)
1456
1457         auth_getattr_shadow($1_t)
1458         # Manage almost all files
1459         files_manage_non_security_files($1_t)
1460         # Relabel almost all files
1461         files_relabel_non_security_files($1_t)
1462
1463         init_telinit($1_t)
1464
1465         logging_send_syslog_msg($1_t)
1466
1467         optional_policy(`
1468                 modutils_domtrans_insmod($1_t)
1469                 modutils_domtrans_depmod($1_t)
1470         ')
1471
1472         # The following rule is temporary until such time that a complete
1473         # policy management infrastructure is in place so that an administrator
1474         # cannot directly manipulate policy files with arbitrary programs.
1475         seutil_manage_src_policy($1_t)
1476         # Violates the goal of limiting write access to checkpolicy.
1477         # But presently necessary for installing the file_contexts file.
1478         seutil_manage_bin_policy($1_t)
1479
1480         systemd_config_all_services($1_t)
1481
1482         userdom_manage_user_home_content_dirs($1_t)
1483         userdom_manage_user_home_content_files($1_t)
1484         userdom_manage_user_home_content_symlinks($1_t)
1485         userdom_manage_user_home_content_pipes($1_t)
1486         userdom_manage_user_home_content_sockets($1_t)
1487         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1488
1489         tunable_policy(`user_rw_noexattrfile',`
1490                 fs_manage_noxattr_fs_files($1_t)
1491                 fs_manage_noxattr_fs_dirs($1_t)
1492         ',`
1493                 fs_read_noxattr_fs_files($1_t)
1494         ')
1495
1496         optional_policy(`
1497                 postgresql_unconfined($1_t)
1498         ')
1499
1500         optional_policy(`
1501                 userhelper_exec($1_t)
1502         ')
1503 ')
1504
1505 ########################################
1506 ## <summary>
1507 ##      Allow user to run as a secadm
1508 ## </summary>
1509 ## <desc>
1510 ##      <p>
1511 ##      Create objects in a user home directory
1512 ##      with an automatic type transition to
1513 ##      a specified private type.
1514 ##      </p>
1515 ##      <p>
1516 ##      This is a templated interface, and should only
1517 ##      be called from a per-userdomain template.
1518 ##      </p>
1519 ## </desc>
1520 ## <param name="domain">
1521 ##      <summary>
1522 ##      Domain allowed access.
1523 ##      </summary>
1524 ## </param>
1525 ## <param name="role">
1526 ##      <summary>
1527 ##      The role  of the object to create.
1528 ##      </summary>
1529 ## </param>
1530 #
1531 template(`userdom_security_admin_template',`
1532         allow $1 self:capability { dac_read_search dac_override };
1533
1534         corecmd_exec_shell($1)
1535
1536         domain_obj_id_change_exemption($1)
1537
1538         dev_relabel_all_dev_nodes($1)
1539
1540         files_create_boot_flag($1)
1541         files_create_default_dir($1)
1542         files_root_filetrans_default($1, dir)
1543
1544         # Necessary for managing /boot/efi
1545         fs_manage_dos_files($1)
1546
1547         mls_process_read_up($1)
1548         mls_file_read_all_levels($1)
1549         mls_file_upgrade($1)
1550         mls_file_downgrade($1)
1551
1552         selinux_set_enforce_mode($1)
1553         selinux_set_all_booleans($1)
1554         selinux_set_parameters($1)
1555         selinux_read_policy($1)
1556
1557         files_relabel_all_files($1)
1558         auth_relabel_shadow($1)
1559
1560         init_exec($1)
1561
1562         logging_send_syslog_msg($1)
1563         logging_read_audit_log($1)
1564         logging_read_generic_logs($1)
1565         logging_read_audit_config($1)
1566
1567         seutil_manage_bin_policy($1)
1568         seutil_manage_default_contexts($1)
1569         seutil_manage_file_contexts($1)
1570         seutil_manage_module_store($1)
1571         seutil_manage_config($1)
1572         seutil_run_checkpolicy($1,$2)
1573         seutil_run_loadpolicy($1,$2)
1574         seutil_run_semanage($1,$2)
1575         seutil_run_setsebool($1,$2)
1576         seutil_run_setfiles($1, $2)
1577
1578         seutil_manage_bin_policy($1)
1579     seutil_manage_default_contexts($1)
1580     seutil_manage_file_contexts($1)
1581     seutil_manage_module_store($1)
1582     seutil_manage_config($1)
1583
1584         optional_policy(`
1585                 aide_run($1,$2)
1586         ')
1587
1588         optional_policy(`
1589                 consoletype_exec($1)
1590         ')
1591
1592         optional_policy(`
1593                 dmesg_exec($1)
1594         ')
1595
1596         optional_policy(`
1597                 ipsec_run_setkey($1,$2)
1598         ')
1599
1600         optional_policy(`
1601                 netlabel_run_mgmt($1,$2)
1602         ')
1603
1604         optional_policy(`
1605                 samhain_run($1, $2)
1606         ')
1607 ')
1608
1609 ########################################
1610 ## <summary>
1611 ##      Make the specified type usable in a
1612 ##      user home directory.
1613 ## </summary>
1614 ## <param name="type">
1615 ##      <summary>
1616 ##      Type to be used as a file in the
1617 ##      user home directory.
1618 ##      </summary>
1619 ## </param>
1620 #
1621 interface(`userdom_user_home_content',`
1622         gen_require(`
1623                 type user_home_t;
1624                 attribute user_home_type;
1625         ')
1626
1627         allow $1 user_home_t:filesystem associate;
1628         files_type($1)
1629         ubac_constrained($1)
1630
1631         files_poly_member($1)
1632         typeattribute $1  user_home_type;
1633 ')
1634
1635 ########################################
1636 ## <summary>
1637 ##      Make the specified type usable in a
1638 ##      generic temporary directory.
1639 ## </summary>
1640 ## <param name="type">
1641 ##      <summary>
1642 ##      Type to be used as a file in the
1643 ##      generic temporary directory.
1644 ##      </summary>
1645 ## </param>
1646 #
1647 interface(`userdom_user_tmp_content',`
1648         gen_require(`
1649                 attribute user_tmp_type;
1650         ')
1651
1652         typeattribute $1 user_tmp_type;
1653
1654         files_tmp_file($1)
1655         ubac_constrained($1)
1656 ')
1657
1658 ########################################
1659 ## <summary>
1660 ##      Make the specified type usable in a
1661 ##      generic tmpfs_t directory.
1662 ## </summary>
1663 ## <param name="type">
1664 ##      <summary>
1665 ##      Type to be used as a file in the
1666 ##      generic temporary directory.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_user_tmpfs_content',`
1671         gen_require(`
1672                 attribute user_tmpfs_type;
1673         ')
1674
1675         typeattribute $1 user_tmpfs_type;
1676
1677         files_tmpfs_file($1)
1678         ubac_constrained($1)
1679 ')
1680
1681 ########################################
1682 ## <summary>
1683 ##      Allow domain to attach to TUN devices created by administrative users.
1684 ## </summary>
1685 ## <param name="domain">
1686 ##      <summary>
1687 ##      Domain allowed access.
1688 ##      </summary>
1689 ## </param>
1690 #
1691 interface(`userdom_attach_admin_tun_iface',`
1692         gen_require(`
1693                 attribute admindomain;
1694         ')
1695
1696         allow $1 admindomain:tun_socket relabelfrom;
1697         allow $1 self:tun_socket relabelto;
1698 ')
1699
1700 ########################################
1701 ## <summary>
1702 ##      Set the attributes of a user pty.
1703 ## </summary>
1704 ## <param name="domain">
1705 ##      <summary>
1706 ##      Domain allowed access.
1707 ##      </summary>
1708 ## </param>
1709 #
1710 interface(`userdom_setattr_user_ptys',`
1711         gen_require(`
1712                 type user_devpts_t;
1713         ')
1714
1715         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1716 ')
1717
1718 ########################################
1719 ## <summary>
1720 ##      Create a user pty.
1721 ## </summary>
1722 ## <param name="domain">
1723 ##      <summary>
1724 ##      Domain allowed access.
1725 ##      </summary>
1726 ## </param>
1727 #
1728 interface(`userdom_create_user_pty',`
1729         gen_require(`
1730                 type user_devpts_t;
1731         ')
1732
1733         term_create_pty($1, user_devpts_t)
1734 ')
1735
1736 ########################################
1737 ## <summary>
1738 ##      Get the attributes of user home directories.
1739 ## </summary>
1740 ## <param name="domain">
1741 ##      <summary>
1742 ##      Domain allowed access.
1743 ##      </summary>
1744 ## </param>
1745 #
1746 interface(`userdom_getattr_user_home_dirs',`
1747         gen_require(`
1748                 type user_home_dir_t;
1749         ')
1750
1751         allow $1 user_home_dir_t:dir getattr_dir_perms;
1752         files_search_home($1)
1753 ')
1754
1755 ########################################
1756 ## <summary>
1757 ##      Do not audit attempts to get the attributes of user home directories.
1758 ## </summary>
1759 ## <param name="domain">
1760 ##      <summary>
1761 ##      Domain to not audit.
1762 ##      </summary>
1763 ## </param>
1764 #
1765 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1766         gen_require(`
1767                 type user_home_dir_t;
1768         ')
1769
1770         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1771 ')
1772
1773 ########################################
1774 ## <summary>
1775 ##      Search user home directories.
1776 ## </summary>
1777 ## <param name="domain">
1778 ##      <summary>
1779 ##      Domain allowed access.
1780 ##      </summary>
1781 ## </param>
1782 #
1783 interface(`userdom_search_user_home_dirs',`
1784         gen_require(`
1785                 type user_home_dir_t;
1786         ')
1787
1788         allow $1 user_home_dir_t:dir search_dir_perms;
1789         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1790         files_search_home($1)
1791 ')
1792
1793 ########################################
1794 ## <summary>
1795 ##      Do not audit attempts to search user home directories.
1796 ## </summary>
1797 ## <desc>
1798 ##      <p>
1799 ##      Do not audit attempts to search user home directories.
1800 ##      This will supress SELinux denial messages when the specified
1801 ##      domain is denied the permission to search these directories.
1802 ##      </p>
1803 ## </desc>
1804 ## <param name="domain">
1805 ##      <summary>
1806 ##      Domain to not audit.
1807 ##      </summary>
1808 ## </param>
1809 ## <infoflow type="none"/>
1810 #
1811 interface(`userdom_dontaudit_search_user_home_dirs',`
1812         gen_require(`
1813                 type user_home_dir_t;
1814         ')
1815
1816         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1817 ')
1818
1819 ########################################
1820 ## <summary>
1821 ##      List user home directories.
1822 ## </summary>
1823 ## <param name="domain">
1824 ##      <summary>
1825 ##      Domain allowed access.
1826 ##      </summary>
1827 ## </param>
1828 #
1829 interface(`userdom_list_user_home_dirs',`
1830         gen_require(`
1831                 type user_home_dir_t;
1832         ')
1833
1834         allow $1 user_home_dir_t:dir list_dir_perms;
1835         files_search_home($1)
1836
1837         tunable_policy(`use_nfs_home_dirs',`
1838                 fs_list_nfs($1)
1839         ')
1840
1841         tunable_policy(`use_samba_home_dirs',`
1842                 fs_list_cifs($1)
1843         ')
1844 ')
1845
1846 ########################################
1847 ## <summary>
1848 ##      Do not audit attempts to list user home subdirectories.
1849 ## </summary>
1850 ## <param name="domain">
1851 ##      <summary>
1852 ##      Domain to not audit.
1853 ##      </summary>
1854 ## </param>
1855 #
1856 interface(`userdom_dontaudit_list_user_home_dirs',`
1857         gen_require(`
1858                 type user_home_dir_t;
1859                 type user_home_t;
1860         ')
1861
1862         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1863         dontaudit $1 user_home_t:dir list_dir_perms;
1864 ')
1865
1866 ########################################
1867 ## <summary>
1868 ##      Create user home directories.
1869 ## </summary>
1870 ## <param name="domain">
1871 ##      <summary>
1872 ##      Domain allowed access.
1873 ##      </summary>
1874 ## </param>
1875 #
1876 interface(`userdom_create_user_home_dirs',`
1877         gen_require(`
1878                 type user_home_dir_t;
1879         ')
1880
1881         allow $1 user_home_dir_t:dir create_dir_perms;
1882 ')
1883
1884 ########################################
1885 ## <summary>
1886 ##      Create user home directories.
1887 ## </summary>
1888 ## <param name="domain">
1889 ##      <summary>
1890 ##      Domain allowed access.
1891 ##      </summary>
1892 ## </param>
1893 #
1894 interface(`userdom_manage_user_home_dirs',`
1895         gen_require(`
1896                 type user_home_dir_t;
1897         ')
1898
1899         allow $1 user_home_dir_t:dir manage_dir_perms;
1900 ')
1901
1902 ########################################
1903 ## <summary>
1904 ##      Relabel to user home directories.
1905 ## </summary>
1906 ## <param name="domain">
1907 ##      <summary>
1908 ##      Domain allowed access.
1909 ##      </summary>
1910 ## </param>
1911 #
1912 interface(`userdom_relabelto_user_home_dirs',`
1913         gen_require(`
1914                 type user_home_dir_t;
1915         ')
1916
1917         allow $1 user_home_dir_t:dir relabelto;
1918 ')
1919
1920
1921 ########################################
1922 ## <summary>
1923 ##      Relabel to user home files.
1924 ## </summary>
1925 ## <param name="domain">
1926 ##      <summary>
1927 ##      Domain allowed access.
1928 ##      </summary>
1929 ## </param>
1930 #
1931 interface(`userdom_relabelto_user_home_files',`
1932         gen_require(`
1933                 type user_home_t;
1934         ')
1935
1936         allow $1 user_home_t:file relabelto;
1937 ')
1938 ########################################
1939 ## <summary>
1940 ##      Relabel user home files.
1941 ## </summary>
1942 ## <param name="domain">
1943 ##      <summary>
1944 ##      Domain allowed access.
1945 ##      </summary>
1946 ## </param>
1947 #
1948 interface(`userdom_relabel_user_home_files',`
1949         gen_require(`
1950                 type user_home_t;
1951         ')
1952
1953         allow $1 user_home_t:file relabel_file_perms;
1954 ')
1955
1956 ########################################
1957 ## <summary>
1958 ##      Create directories in the home dir root with
1959 ##      the user home directory type.
1960 ## </summary>
1961 ## <param name="domain">
1962 ##      <summary>
1963 ##      Domain allowed access.
1964 ##      </summary>
1965 ## </param>
1966 #
1967 interface(`userdom_home_filetrans_user_home_dir',`
1968         gen_require(`
1969                 type user_home_dir_t;
1970         ')
1971
1972         files_home_filetrans($1, user_home_dir_t, dir)
1973 ')
1974
1975 ########################################
1976 ## <summary>
1977 ##      Do a domain transition to the specified
1978 ##      domain when executing a program in the
1979 ##      user home directory.
1980 ## </summary>
1981 ## <desc>
1982 ##      <p>
1983 ##      Do a domain transition to the specified
1984 ##      domain when executing a program in the
1985 ##      user home directory.
1986 ##      </p>
1987 ##      <p>
1988 ##      No interprocess communication (signals, pipes,
1989 ##      etc.) is provided by this interface since
1990 ##      the domains are not owned by this module.
1991 ##      </p>
1992 ## </desc>
1993 ## <param name="source_domain">
1994 ##      <summary>
1995 ##      Domain allowed to transition.
1996 ##      </summary>
1997 ## </param>
1998 ## <param name="target_domain">
1999 ##      <summary>
2000 ##      Domain to transition to.
2001 ##      </summary>
2002 ## </param>
2003 #
2004 interface(`userdom_user_home_domtrans',`
2005         gen_require(`
2006                 type user_home_dir_t, user_home_t;
2007         ')
2008
2009         domain_auto_trans($1, user_home_t, $2)
2010         allow $1 user_home_dir_t:dir search_dir_perms;
2011         files_search_home($1)
2012 ')
2013
2014 ########################################
2015 ## <summary>
2016 ##      Do not audit attempts to search user home content directories.
2017 ## </summary>
2018 ## <param name="domain">
2019 ##      <summary>
2020 ##      Domain to not audit.
2021 ##      </summary>
2022 ## </param>
2023 #
2024 interface(`userdom_dontaudit_search_user_home_content',`
2025         gen_require(`
2026                 type user_home_t;
2027         ')
2028
2029         dontaudit $1 user_home_t:dir search_dir_perms;
2030         fs_dontaudit_list_nfs($1)
2031         fs_dontaudit_list_cifs($1)
2032 ')
2033
2034 ########################################
2035 ## <summary>
2036 ##      List contents of users home directory.
2037 ## </summary>
2038 ## <param name="domain">
2039 ##      <summary>
2040 ##      Domain allowed access.
2041 ##      </summary>
2042 ## </param>
2043 #
2044 interface(`userdom_list_user_home_content',`
2045         gen_require(`
2046                 type user_home_dir_t;
2047                 attribute user_home_type;
2048         ')
2049
2050         files_list_home($1)
2051         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2052 ')
2053
2054 ########################################
2055 ## <summary>
2056 ##      Create, read, write, and delete directories
2057 ##      in a user home subdirectory.
2058 ## </summary>
2059 ## <param name="domain">
2060 ##      <summary>
2061 ##      Domain allowed access.
2062 ##      </summary>
2063 ## </param>
2064 #
2065 interface(`userdom_manage_user_home_content_dirs',`
2066         gen_require(`
2067                 type user_home_dir_t, user_home_t;
2068         ')
2069
2070         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2071         files_search_home($1)
2072 ')
2073
2074 ########################################
2075 ## <summary>
2076 ##      Delete directories in a user home subdirectory.
2077 ## </summary>
2078 ## <param name="domain">
2079 ##      <summary>
2080 ##      Domain allowed access.
2081 ##      </summary>
2082 ## </param>
2083 #
2084 interface(`userdom_delete_user_home_content_dirs',`
2085         gen_require(`
2086                 type user_home_t;
2087         ')
2088
2089         allow $1 user_home_t:dir delete_dir_perms;
2090 ')
2091
2092 ########################################
2093 ## <summary>
2094 ##      Delete all directories in a user home subdirectory.
2095 ## </summary>
2096 ## <param name="domain">
2097 ##      <summary>
2098 ##      Domain allowed access.
2099 ##      </summary>
2100 ## </param>
2101 #
2102 interface(`userdom_delete_all_user_home_content_dirs',`
2103         gen_require(`
2104                 attribute user_home_type;
2105         ')
2106
2107         allow $1 user_home_type:dir delete_dir_perms;
2108 ')
2109
2110 ########################################
2111 ## <summary>
2112 ##      Set the attributes of user home files.
2113 ## </summary>
2114 ## <param name="domain">
2115 ##      <summary>
2116 ##      Domain allowed access.
2117 ##      </summary>
2118 ## </param>
2119 ## <rolecap/>
2120 #
2121 interface(`userdom_setattr_user_home_content_files',`
2122         gen_require(`
2123                 type user_home_t;
2124         ')
2125
2126         allow $1 user_home_t:file setattr;
2127 ')
2128
2129 ########################################
2130 ## <summary>
2131 ##      Do not audit attempts to set the
2132 ##      attributes of user home files.
2133 ## </summary>
2134 ## <param name="domain">
2135 ##      <summary>
2136 ##      Domain to not audit.
2137 ##      </summary>
2138 ## </param>
2139 #
2140 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2141         gen_require(`
2142                 type user_home_t;
2143         ')
2144
2145         dontaudit $1 user_home_t:file setattr_file_perms;
2146 ')
2147
2148 ########################################
2149 ## <summary>
2150 ##      Set the attributes of all user home directories.
2151 ## </summary>
2152 ## <param name="domain">
2153 ##      <summary>
2154 ##      Domain allowed access.
2155 ##      </summary>
2156 ## </param>
2157 ## <rolecap/>
2158 #
2159 interface(`userdom_setattr_all_user_home_content_dirs',`
2160         gen_require(`
2161                 attribute user_home_type;
2162         ')
2163
2164         allow $1 user_home_type:dir setattr_dir_perms;
2165 ')
2166
2167 ########################################
2168 ## <summary>
2169 ##      Mmap user home files.
2170 ## </summary>
2171 ## <param name="domain">
2172 ##      <summary>
2173 ##      Domain allowed access.
2174 ##      </summary>
2175 ## </param>
2176 #
2177 interface(`userdom_mmap_user_home_content_files',`
2178         gen_require(`
2179                 type user_home_dir_t, user_home_t;
2180         ')
2181
2182         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2183         files_search_home($1)
2184 ')
2185
2186 ########################################
2187 ## <summary>
2188 ##      Read user home files.
2189 ## </summary>
2190 ## <param name="domain">
2191 ##      <summary>
2192 ##      Domain allowed access.
2193 ##      </summary>
2194 ## </param>
2195 #
2196 interface(`userdom_read_user_home_content_files',`
2197         gen_require(`
2198                 type user_home_dir_t, user_home_t;
2199         ')
2200
2201         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2202         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2203         files_search_home($1)
2204 ')
2205
2206 ########################################
2207 ## <summary>
2208 ##      Do not audit attempts to getattr user home files.
2209 ## </summary>
2210 ## <param name="domain">
2211 ##      <summary>
2212 ##      Domain to not audit.
2213 ##      </summary>
2214 ## </param>
2215 #
2216 interface(`userdom_dontaudit_getattr_user_home_content',`
2217         gen_require(`
2218                 attribute user_home_type;
2219         ')
2220
2221         dontaudit $1 user_home_type:dir getattr;
2222         dontaudit $1 user_home_type:file getattr;
2223 ')
2224
2225 ########################################
2226 ## <summary>
2227 ##      Do not audit attempts to read user home files.
2228 ## </summary>
2229 ## <param name="domain">
2230 ##      <summary>
2231 ##      Domain to not audit.
2232 ##      </summary>
2233 ## </param>
2234 #
2235 interface(`userdom_dontaudit_read_user_home_content_files',`
2236         gen_require(`
2237                 attribute user_home_type;
2238                 type user_home_dir_t;
2239         ')
2240
2241         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2242         dontaudit $1 user_home_type:dir list_dir_perms;
2243         dontaudit $1 user_home_type:file read_file_perms;
2244         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2245 ')
2246
2247 ########################################
2248 ## <summary>
2249 ##      Do not audit attempts to append user home files.
2250 ## </summary>
2251 ## <param name="domain">
2252 ##      <summary>
2253 ##      Domain to not audit.
2254 ##      </summary>
2255 ## </param>
2256 #
2257 interface(`userdom_dontaudit_append_user_home_content_files',`
2258         gen_require(`
2259                 type user_home_t;
2260         ')
2261
2262         dontaudit $1 user_home_t:file append_file_perms;
2263 ')
2264
2265 ########################################
2266 ## <summary>
2267 ##      Do not audit attempts to write user home files.
2268 ## </summary>
2269 ## <param name="domain">
2270 ##      <summary>
2271 ##      Domain to not audit.
2272 ##      </summary>
2273 ## </param>
2274 #
2275 interface(`userdom_dontaudit_write_user_home_content_files',`
2276         gen_require(`
2277                 type user_home_t;
2278         ')
2279
2280         dontaudit $1 user_home_t:file write_file_perms;
2281 ')
2282
2283 ########################################
2284 ## <summary>
2285 ##      Delete files in a user home subdirectory.
2286 ## </summary>
2287 ## <param name="domain">
2288 ##      <summary>
2289 ##      Domain allowed access.
2290 ##      </summary>
2291 ## </param>
2292 #
2293 interface(`userdom_delete_user_home_content_files',`
2294         gen_require(`
2295                 type user_home_t;
2296         ')
2297
2298         allow $1 user_home_t:file delete_file_perms;
2299 ')
2300
2301 ########################################
2302 ## <summary>
2303 ##      Delete all files in a user home subdirectory.
2304 ## </summary>
2305 ## <param name="domain">
2306 ##      <summary>
2307 ##      Domain allowed access.
2308 ##      </summary>
2309 ## </param>
2310 #
2311 interface(`userdom_delete_all_user_home_content_files',`
2312         gen_require(`
2313                 attribute user_home_type;
2314         ')
2315
2316         allow $1 user_home_type:file delete_file_perms;
2317 ')
2318
2319 ########################################
2320 ## <summary>
2321 ##      Delete sock files in a user home subdirectory.
2322 ## </summary>
2323 ## <param name="domain">
2324 ##      <summary>
2325 ##      Domain allowed access.
2326 ##      </summary>
2327 ## </param>
2328 #
2329 interface(`userdom_delete_user_home_content_sock_files',`
2330         gen_require(`
2331                 type user_home_t;
2332         ')
2333
2334         allow $1 user_home_t:sock_file delete_file_perms;
2335 ')
2336
2337 ########################################
2338 ## <summary>
2339 ##      Delete all sock files in a user home subdirectory.
2340 ## </summary>
2341 ## <param name="domain">
2342 ##      <summary>
2343 ##      Domain allowed access.
2344 ##      </summary>
2345 ## </param>
2346 #
2347 interface(`userdom_delete_all_user_home_content_sock_files',`
2348         gen_require(`
2349                 attribute user_home_type;
2350         ')
2351
2352         allow $1 user_home_type:sock_file delete_file_perms;
2353 ')
2354
2355 ########################################
2356 ## <summary>
2357 ##      Do not audit attempts to write user home files.
2358 ## </summary>
2359 ## <param name="domain">
2360 ##      <summary>
2361 ##      Domain to not audit.
2362 ##      </summary>
2363 ## </param>
2364 #
2365 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2366         gen_require(`
2367                 type user_home_t;
2368         ')
2369
2370         dontaudit $1 user_home_t:file relabel_file_perms;
2371 ')
2372
2373 ########################################
2374 ## <summary>
2375 ##      Read user home subdirectory symbolic links.
2376 ## </summary>
2377 ## <param name="domain">
2378 ##      <summary>
2379 ##      Domain allowed access.
2380 ##      </summary>
2381 ## </param>
2382 #
2383 interface(`userdom_read_user_home_content_symlinks',`
2384         gen_require(`
2385                 type user_home_dir_t, user_home_t;
2386         ')
2387
2388         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2389 ')
2390
2391 ########################################
2392 ## <summary>
2393 ##      Execute user home files.
2394 ## </summary>
2395 ## <param name="domain">
2396 ##      <summary>
2397 ##      Domain allowed access.
2398 ##      </summary>
2399 ## </param>
2400 ## <rolecap/>
2401 #
2402 interface(`userdom_exec_user_home_content_files',`
2403         gen_require(`
2404                 type user_home_dir_t;
2405                 attribute user_home_type;
2406         ')
2407
2408         files_search_home($1)
2409         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2410         dontaudit $1 user_home_type:sock_file execute;
2411         ')
2412
2413 ########################################
2414 ## <summary>
2415 ##      Do not audit attempts to execute user home files.
2416 ## </summary>
2417 ## <param name="domain">
2418 ##      <summary>
2419 ##      Domain to not audit.
2420 ##      </summary>
2421 ## </param>
2422 #
2423 interface(`userdom_dontaudit_exec_user_home_content_files',`
2424         gen_require(`
2425                 type user_home_t;
2426         ')
2427
2428         dontaudit $1 user_home_t:file exec_file_perms;
2429 ')
2430
2431 ########################################
2432 ## <summary>
2433 ##      Create, read, write, and delete files
2434 ##      in a user home subdirectory.
2435 ## </summary>
2436 ## <param name="domain">
2437 ##      <summary>
2438 ##      Domain allowed access.
2439 ##      </summary>
2440 ## </param>
2441 #
2442 interface(`userdom_manage_user_home_content_files',`
2443         gen_require(`
2444                 type user_home_dir_t, user_home_t;
2445         ')
2446
2447         manage_files_pattern($1, user_home_t, user_home_t)
2448         allow $1 user_home_dir_t:dir search_dir_perms;
2449         files_search_home($1)
2450 ')
2451
2452 ########################################
2453 ## <summary>
2454 ##      Do not audit attempts to create, read, write, and delete directories
2455 ##      in a user home subdirectory.
2456 ## </summary>
2457 ## <param name="domain">
2458 ##      <summary>
2459 ##      Domain to not audit.
2460 ##      </summary>
2461 ## </param>
2462 #
2463 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2464         gen_require(`
2465                 type user_home_dir_t, user_home_t;
2466         ')
2467
2468         dontaudit $1 user_home_t:dir manage_dir_perms;
2469 ')
2470
2471 ########################################
2472 ## <summary>
2473 ##      Create, read, write, and delete symbolic links
2474 ##      in a user home subdirectory.
2475 ## </summary>
2476 ## <param name="domain">
2477 ##      <summary>
2478 ##      Domain allowed access.
2479 ##      </summary>
2480 ## </param>
2481 #
2482 interface(`userdom_manage_user_home_content_symlinks',`
2483         gen_require(`
2484                 type user_home_dir_t, user_home_t;
2485         ')
2486
2487         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2488         allow $1 user_home_dir_t:dir search_dir_perms;
2489         files_search_home($1)
2490 ')
2491
2492 ########################################
2493 ## <summary>
2494 ##      Delete symbolic links in a user home directory.
2495 ## </summary>
2496 ## <param name="domain">
2497 ##      <summary>
2498 ##      Domain allowed access.
2499 ##      </summary>
2500 ## </param>
2501 #
2502 interface(`userdom_delete_user_home_content_symlinks',`
2503         gen_require(`
2504                 type user_home_t;
2505         ')
2506
2507         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2508 ')
2509
2510 ########################################
2511 ## <summary>
2512 ##      Delete all symbolic links in a user home directory.
2513 ## </summary>
2514 ## <param name="domain">
2515 ##      <summary>
2516 ##      Domain allowed access.
2517 ##      </summary>
2518 ## </param>
2519 #
2520 interface(`userdom_delete_all_user_home_content_symlinks',`
2521         gen_require(`
2522                 attribute user_home_type;
2523         ')
2524
2525         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2526 ')
2527
2528 ########################################
2529 ## <summary>
2530 ##      Create, read, write, and delete named pipes
2531 ##      in a user home subdirectory.
2532 ## </summary>
2533 ## <param name="domain">
2534 ##      <summary>
2535 ##      Domain allowed access.
2536 ##      </summary>
2537 ## </param>
2538 #
2539 interface(`userdom_manage_user_home_content_pipes',`
2540         gen_require(`
2541                 type user_home_dir_t, user_home_t;
2542         ')
2543
2544         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2545         allow $1 user_home_dir_t:dir search_dir_perms;
2546         files_search_home($1)
2547 ')
2548
2549 ########################################
2550 ## <summary>
2551 ##      Create, read, write, and delete named sockets
2552 ##      in a user home subdirectory.
2553 ## </summary>
2554 ## <param name="domain">
2555 ##      <summary>
2556 ##      Domain allowed access.
2557 ##      </summary>
2558 ## </param>
2559 #
2560 interface(`userdom_manage_user_home_content_sockets',`
2561         gen_require(`
2562                 type user_home_dir_t, user_home_t;
2563         ')
2564
2565         allow $1 user_home_dir_t:dir search_dir_perms;
2566         manage_sock_files_pattern($1, user_home_t, user_home_t)
2567         files_search_home($1)
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Create objects in a user home directory
2573 ##      with an automatic type transition to
2574 ##      a specified private type.
2575 ## </summary>
2576 ## <param name="domain">
2577 ##      <summary>
2578 ##      Domain allowed access.
2579 ##      </summary>
2580 ## </param>
2581 ## <param name="private_type">
2582 ##      <summary>
2583 ##      The type of the object to create.
2584 ##      </summary>
2585 ## </param>
2586 ## <param name="object_class">
2587 ##      <summary>
2588 ##      The class of the object to be created.
2589 ##      </summary>
2590 ## </param>
2591 #
2592 interface(`userdom_user_home_dir_filetrans',`
2593         gen_require(`
2594                 type user_home_dir_t;
2595         ')
2596
2597         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2598         files_search_home($1)
2599 ')
2600
2601 ########################################
2602 ## <summary>
2603 ##      Create objects in a user home directory
2604 ##      with an automatic type transition to
2605 ##      a specified private type.
2606 ## </summary>
2607 ## <param name="domain">
2608 ##      <summary>
2609 ##      Domain allowed access.
2610 ##      </summary>
2611 ## </param>
2612 ## <param name="private_type">
2613 ##      <summary>
2614 ##      The type of the object to create.
2615 ##      </summary>
2616 ## </param>
2617 ## <param name="object_class">
2618 ##      <summary>
2619 ##      The class of the object to be created.
2620 ##      </summary>
2621 ## </param>
2622 #
2623 interface(`userdom_user_home_content_filetrans',`
2624         gen_require(`
2625                 type user_home_dir_t, user_home_t;
2626         ')
2627
2628         filetrans_pattern($1, user_home_t, $2, $3)
2629         allow $1 user_home_dir_t:dir search_dir_perms;
2630         files_search_home($1)
2631 ')
2632
2633 ########################################
2634 ## <summary>
2635 ##      Create objects in a user home directory
2636 ##      with an automatic type transition to
2637 ##      the user home file type.
2638 ## </summary>
2639 ## <param name="domain">
2640 ##      <summary>
2641 ##      Domain allowed access.
2642 ##      </summary>
2643 ## </param>
2644 ## <param name="object_class">
2645 ##      <summary>
2646 ##      The class of the object to be created.
2647 ##      </summary>
2648 ## </param>
2649 #
2650 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2651         gen_require(`
2652                 type user_home_dir_t, user_home_t;
2653         ')
2654
2655         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2656         files_search_home($1)
2657 ')
2658
2659 ########################################
2660 ## <summary>
2661 ##      Write to user temporary named sockets.
2662 ## </summary>
2663 ## <param name="domain">
2664 ##      <summary>
2665 ##      Domain allowed access.
2666 ##      </summary>
2667 ## </param>
2668 #
2669 interface(`userdom_write_user_tmp_sockets',`
2670         gen_require(`
2671                 type user_tmp_t;
2672         ')
2673
2674         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2675         files_search_tmp($1)
2676 ')
2677
2678 ########################################
2679 ## <summary>
2680 ##      List user temporary directories.
2681 ## </summary>
2682 ## <param name="domain">
2683 ##      <summary>
2684 ##      Domain allowed access.
2685 ##      </summary>
2686 ## </param>
2687 #
2688 interface(`userdom_list_user_tmp',`
2689         gen_require(`
2690                 type user_tmp_t;
2691         ')
2692
2693         allow $1 user_tmp_t:dir list_dir_perms;
2694         files_search_tmp($1)
2695 ')
2696
2697 ########################################
2698 ## <summary>
2699 ##      Do not audit attempts to list user
2700 ##      temporary directories.
2701 ## </summary>
2702 ## <param name="domain">
2703 ##      <summary>
2704 ##      Domain to not audit.
2705 ##      </summary>
2706 ## </param>
2707 #
2708 interface(`userdom_dontaudit_list_user_tmp',`
2709         gen_require(`
2710                 type user_tmp_t;
2711         ')
2712
2713         dontaudit $1 user_tmp_t:dir list_dir_perms;
2714 ')
2715
2716 ########################################
2717 ## <summary>
2718 ##      Do not audit attempts to manage users
2719 ##      temporary directories.
2720 ## </summary>
2721 ## <param name="domain">
2722 ##      <summary>
2723 ##      Domain to not audit.
2724 ##      </summary>
2725 ## </param>
2726 #
2727 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2728         gen_require(`
2729                 type user_tmp_t;
2730         ')
2731
2732         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2733 ')
2734
2735 ########################################
2736 ## <summary>
2737 ##      Read user temporary files.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain allowed access.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_read_user_tmp_files',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         read_files_pattern($1, user_tmp_t, user_tmp_t)
2751         allow $1 user_tmp_t:dir list_dir_perms;
2752         files_search_tmp($1)
2753 ')
2754
2755 ########################################
2756 ## <summary>
2757 ##      Do not audit attempts to read users
2758 ##      temporary files.
2759 ## </summary>
2760 ## <param name="domain">
2761 ##      <summary>
2762 ##      Domain to not audit.
2763 ##      </summary>
2764 ## </param>
2765 #
2766 interface(`userdom_dontaudit_read_user_tmp_files',`
2767         gen_require(`
2768                 type user_tmp_t;
2769         ')
2770
2771         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2772 ')
2773
2774 ########################################
2775 ## <summary>
2776 ##      Do not audit attempts to append users
2777 ##      temporary files.
2778 ## </summary>
2779 ## <param name="domain">
2780 ##      <summary>
2781 ##      Domain to not audit.
2782 ##      </summary>
2783 ## </param>
2784 #
2785 interface(`userdom_dontaudit_append_user_tmp_files',`
2786         gen_require(`
2787                 type user_tmp_t;
2788         ')
2789
2790         dontaudit $1 user_tmp_t:file append_file_perms;
2791 ')
2792
2793 ########################################
2794 ## <summary>
2795 ##      Read and write user temporary files.
2796 ## </summary>
2797 ## <param name="domain">
2798 ##      <summary>
2799 ##      Domain allowed access.
2800 ##      </summary>
2801 ## </param>
2802 #
2803 interface(`userdom_rw_user_tmp_files',`
2804         gen_require(`
2805                 type user_tmp_t;
2806         ')
2807
2808         allow $1 user_tmp_t:dir list_dir_perms;
2809         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2810         files_search_tmp($1)
2811 ')
2812
2813 ########################################
2814 ## <summary>
2815 ##      Do not audit attempts to manage users
2816 ##      temporary files.
2817 ## </summary>
2818 ## <param name="domain">
2819 ##      <summary>
2820 ##      Domain to not audit.
2821 ##      </summary>
2822 ## </param>
2823 #
2824 interface(`userdom_dontaudit_manage_user_tmp_files',`
2825         gen_require(`
2826                 type user_tmp_t;
2827         ')
2828
2829         dontaudit $1 user_tmp_t:file manage_file_perms;
2830 ')
2831
2832 ########################################
2833 ## <summary>
2834 ##      Read user temporary symbolic links.
2835 ## </summary>
2836 ## <param name="domain">
2837 ##      <summary>
2838 ##      Domain allowed access.
2839 ##      </summary>
2840 ## </param>
2841 #
2842 interface(`userdom_read_user_tmp_symlinks',`
2843         gen_require(`
2844                 type user_tmp_t;
2845         ')
2846
2847         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2848         allow $1 user_tmp_t:dir list_dir_perms;
2849         files_search_tmp($1)
2850 ')
2851
2852 ########################################
2853 ## <summary>
2854 ##      Create, read, write, and delete user
2855 ##      temporary directories.
2856 ## </summary>
2857 ## <param name="domain">
2858 ##      <summary>
2859 ##      Domain allowed access.
2860 ##      </summary>
2861 ## </param>
2862 #
2863 interface(`userdom_manage_user_tmp_dirs',`
2864         gen_require(`
2865                 type user_tmp_t;
2866         ')
2867
2868         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2869         files_search_tmp($1)
2870 ')
2871
2872 ########################################
2873 ## <summary>
2874 ##      Create, read, write, and delete user
2875 ##      temporary files.
2876 ## </summary>
2877 ## <param name="domain">
2878 ##      <summary>
2879 ##      Domain allowed access.
2880 ##      </summary>
2881 ## </param>
2882 #
2883 interface(`userdom_manage_user_tmp_files',`
2884         gen_require(`
2885                 type user_tmp_t;
2886         ')
2887
2888         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2889         files_search_tmp($1)
2890 ')
2891
2892 ########################################
2893 ## <summary>
2894 ##      Create, read, write, and delete user
2895 ##      temporary symbolic links.
2896 ## </summary>
2897 ## <param name="domain">
2898 ##      <summary>
2899 ##      Domain allowed access.
2900 ##      </summary>
2901 ## </param>
2902 #
2903 interface(`userdom_manage_user_tmp_symlinks',`
2904         gen_require(`
2905                 type user_tmp_t;
2906         ')
2907
2908         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2909         files_search_tmp($1)
2910 ')
2911
2912 ########################################
2913 ## <summary>
2914 ##      Create, read, write, and delete user
2915 ##      temporary named pipes.
2916 ## </summary>
2917 ## <param name="domain">
2918 ##      <summary>
2919 ##      Domain allowed access.
2920 ##      </summary>
2921 ## </param>
2922 #
2923 interface(`userdom_manage_user_tmp_pipes',`
2924         gen_require(`
2925                 type user_tmp_t;
2926         ')
2927
2928         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2929         files_search_tmp($1)
2930 ')
2931
2932 ########################################
2933 ## <summary>
2934 ##      Create, read, write, and delete user
2935 ##      temporary named sockets.
2936 ## </summary>
2937 ## <param name="domain">
2938 ##      <summary>
2939 ##      Domain allowed access.
2940 ##      </summary>
2941 ## </param>
2942 #
2943 interface(`userdom_manage_user_tmp_sockets',`
2944         gen_require(`
2945                 type user_tmp_t;
2946         ')
2947
2948         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2949         files_search_tmp($1)
2950 ')
2951
2952 ########################################
2953 ## <summary>
2954 ##      Create objects in a user temporary directory
2955 ##      with an automatic type transition to
2956 ##      a specified private type.
2957 ## </summary>
2958 ## <param name="domain">
2959 ##      <summary>
2960 ##      Domain allowed access.
2961 ##      </summary>
2962 ## </param>
2963 ## <param name="private_type">
2964 ##      <summary>
2965 ##      The type of the object to create.
2966 ##      </summary>
2967 ## </param>
2968 ## <param name="object_class">
2969 ##      <summary>
2970 ##      The class of the object to be created.
2971 ##      </summary>
2972 ## </param>
2973 #
2974 interface(`userdom_user_tmp_filetrans',`
2975         gen_require(`
2976                 type user_tmp_t;
2977         ')
2978
2979         filetrans_pattern($1, user_tmp_t, $2, $3)
2980         files_search_tmp($1)
2981 ')
2982
2983 ########################################
2984 ## <summary>
2985 ##      Create objects in the temporary directory
2986 ##      with an automatic type transition to
2987 ##      the user temporary type.
2988 ## </summary>
2989 ## <param name="domain">
2990 ##      <summary>
2991 ##      Domain allowed access.
2992 ##      </summary>
2993 ## </param>
2994 ## <param name="object_class">
2995 ##      <summary>
2996 ##      The class of the object to be created.
2997 ##      </summary>
2998 ## </param>
2999 #
3000 interface(`userdom_tmp_filetrans_user_tmp',`
3001         gen_require(`
3002                 type user_tmp_t;
3003         ')
3004
3005         files_tmp_filetrans($1, user_tmp_t, $2)
3006 ')
3007
3008 ########################################
3009 ## <summary>
3010 ##      Read user tmpfs files.
3011 ## </summary>
3012 ## <param name="domain">
3013 ##      <summary>
3014 ##      Domain allowed access.
3015 ##      </summary>
3016 ## </param>
3017 #
3018 interface(`userdom_read_user_tmpfs_files',`
3019         gen_require(`
3020                 type user_tmpfs_t;
3021         ')
3022
3023         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3024         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3025         allow $1 user_tmpfs_t:dir list_dir_perms;
3026         fs_search_tmpfs($1)
3027 ')
3028
3029 ########################################
3030 ## <summary>
3031 ##      Read/Write user tmpfs files.
3032 ## </summary>
3033 ## <param name="domain">
3034 ##      <summary>
3035 ##      Domain allowed access.
3036 ##      </summary>
3037 ## </param>
3038 #
3039 interface(`userdom_rw_user_tmpfs_files',`
3040         gen_require(`
3041                 type user_tmpfs_t;
3042         ')
3043
3044         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3045         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3046         allow $1 user_tmpfs_t:dir list_dir_perms;
3047         fs_search_tmpfs($1)
3048 ')
3049
3050 ########################################
3051 ## <summary>
3052 ##      Get the attributes of a user domain tty.
3053 ## </summary>
3054 ## <param name="domain">
3055 ##      <summary>
3056 ##      Domain allowed access.
3057 ##      </summary>
3058 ## </param>
3059 #
3060 interface(`userdom_getattr_user_ttys',`
3061         gen_require(`
3062                 type user_tty_device_t;
3063         ')
3064
3065         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3066 ')
3067
3068 ########################################
3069 ## <summary>
3070 ##      Do not audit attempts to get the attributes of a user domain tty.
3071 ## </summary>
3072 ## <param name="domain">
3073 ##      <summary>
3074 ##      Domain to not audit.
3075 ##      </summary>
3076 ## </param>
3077 #
3078 interface(`userdom_dontaudit_getattr_user_ttys',`
3079         gen_require(`
3080                 type user_tty_device_t;
3081         ')
3082
3083         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3084 ')
3085
3086 ########################################
3087 ## <summary>
3088 ##      Set the attributes of a user domain tty.
3089 ## </summary>
3090 ## <param name="domain">
3091 ##      <summary>
3092 ##      Domain allowed access.
3093 ##      </summary>
3094 ## </param>
3095 #
3096 interface(`userdom_setattr_user_ttys',`
3097         gen_require(`
3098                 type user_tty_device_t;
3099         ')
3100
3101         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3102 ')
3103
3104 ########################################
3105 ## <summary>
3106 ##      Do not audit attempts to set the attributes of a user domain tty.
3107 ## </summary>
3108 ## <param name="domain">
3109 ##      <summary>
3110 ##      Domain to not audit.
3111 ##      </summary>
3112 ## </param>
3113 #
3114 interface(`userdom_dontaudit_setattr_user_ttys',`
3115         gen_require(`
3116                 type user_tty_device_t;
3117         ')
3118
3119         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3120 ')
3121
3122 ########################################
3123 ## <summary>
3124 ##      Read and write a user domain tty.
3125 ## </summary>
3126 ## <param name="domain">
3127 ##      <summary>
3128 ##      Domain allowed access.
3129 ##      </summary>
3130 ## </param>
3131 #
3132 interface(`userdom_use_user_ttys',`
3133         gen_require(`
3134                 type user_tty_device_t;
3135         ')
3136
3137         allow $1 user_tty_device_t:chr_file rw_term_perms;
3138 ')
3139
3140 ########################################
3141 ## <summary>
3142 ##      Read and write a inherited user domain tty.
3143 ## </summary>
3144 ## <param name="domain">
3145 ##      <summary>
3146 ##      Domain allowed access.
3147 ##      </summary>
3148 ## </param>
3149 #
3150 interface(`userdom_use_inherited_user_ttys',`
3151         gen_require(`
3152                 type user_tty_device_t;
3153         ')
3154
3155         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3156 ')
3157
3158 ########################################
3159 ## <summary>
3160 ##      Read and write a user domain pty.
3161 ## </summary>
3162 ## <param name="domain">
3163 ##      <summary>
3164 ##      Domain allowed access.
3165 ##      </summary>
3166 ## </param>
3167 #
3168 interface(`userdom_use_user_ptys',`
3169         gen_require(`
3170                 type user_devpts_t;
3171         ')
3172
3173         allow $1 user_devpts_t:chr_file rw_term_perms;
3174 ')
3175
3176 ########################################
3177 ## <summary>
3178 ##      Read and write a inherited user domain pty.
3179 ## </summary>
3180 ## <param name="domain">
3181 ##      <summary>
3182 ##      Domain allowed access.
3183 ##      </summary>
3184 ## </param>
3185 #
3186 interface(`userdom_use_inherited_user_ptys',`
3187         gen_require(`
3188                 type user_devpts_t;
3189         ')
3190
3191         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3192 ')
3193
3194 ########################################
3195 ## <summary>
3196 ##      Read and write a inherited user TTYs and PTYs.
3197 ## </summary>
3198 ## <desc>
3199 ##      <p>
3200 ##      Allow the specified domain to read and write inherited user
3201 ##      TTYs and PTYs. This will allow the domain to
3202 ##      interact with the user via the terminal. Typically
3203 ##      all interactive applications will require this
3204 ##      access.
3205 ##      </p>
3206 ## </desc>
3207 ## <param name="domain">
3208 ##      <summary>
3209 ##      Domain allowed access.
3210 ##      </summary>
3211 ## </param>
3212 ## <infoflow type="both" weight="10"/>
3213 #
3214 interface(`userdom_use_inherited_user_terminals',`
3215         gen_require(`
3216                 type user_tty_device_t, user_devpts_t;
3217         ')
3218
3219         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3220         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3221 ')
3222
3223 #######################################
3224 ## <summary>
3225 ##  Allow attempts to read and write
3226 ##  a user domain tty and pty.
3227 ## </summary>
3228 ## <param name="domain">
3229 ##  <summary>
3230 ##  Domain to not audit.
3231 ##  </summary>
3232 ## </param>
3233 #
3234 interface(`userdom_use_user_terminals',`
3235     gen_require(`
3236         type user_tty_device_t, user_devpts_t;
3237     ')
3238
3239     allow $1 user_tty_device_t:chr_file rw_term_perms;
3240     allow $1 user_devpts_t:chr_file rw_term_perms;
3241 ')
3242
3243 ########################################
3244 ## <summary>
3245 ##      Do not audit attempts to read and write
3246 ##      a user domain tty and pty.
3247 ## </summary>
3248 ## <param name="domain">
3249 ##      <summary>
3250 ##      Domain to not audit.
3251 ##      </summary>
3252 ## </param>
3253 #
3254 interface(`userdom_dontaudit_use_user_terminals',`
3255         gen_require(`
3256                 type user_tty_device_t, user_devpts_t;
3257         ')
3258
3259         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3260         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3261 ')
3262
3263
3264 ########################################
3265 ## <summary>
3266 ##      Get attributes of user domain tty and pty.
3267 ## </summary>
3268 ## <param name="domain">
3269 ##      <summary>
3270 ##      Domain allowed access.
3271 ##      </summary>
3272 ## </param>
3273 #
3274 interface(`userdom_getattr_user_terminals',`
3275         gen_require(`
3276                 type user_tty_device_t, user_devpts_t;
3277         ')
3278
3279         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3280 ')
3281
3282 ########################################
3283 ## <summary>
3284 ##      Execute a shell in all user domains.  This
3285 ##      is an explicit transition, requiring the
3286 ##      caller to use setexeccon().
3287 ## </summary>
3288 ## <param name="domain">
3289 ##      <summary>
3290 ##      Domain allowed to transition.
3291 ##      </summary>
3292 ## </param>
3293 #
3294 interface(`userdom_spec_domtrans_all_users',`
3295         gen_require(`
3296                 attribute userdomain;
3297         ')
3298
3299         corecmd_shell_spec_domtrans($1, userdomain)
3300         allow userdomain $1:fd use;
3301         allow userdomain $1:fifo_file rw_file_perms;
3302         allow userdomain $1:process sigchld;
3303 ')
3304
3305 ########################################
3306 ## <summary>
3307 ##      Execute an Xserver session in all unprivileged user domains.  This
3308 ##      is an explicit transition, requiring the
3309 ##      caller to use setexeccon().
3310 ## </summary>
3311 ## <param name="domain">
3312 ##      <summary>
3313 ##      Domain allowed to transition.
3314 ##      </summary>
3315 ## </param>
3316 #
3317 interface(`userdom_xsession_spec_domtrans_all_users',`
3318         gen_require(`
3319                 attribute userdomain;
3320         ')
3321
3322         xserver_xsession_spec_domtrans($1, userdomain)
3323         allow userdomain $1:fd use;
3324         allow userdomain $1:fifo_file rw_file_perms;
3325         allow userdomain $1:process sigchld;
3326 ')
3327
3328 ########################################
3329 ## <summary>
3330 ##      Execute a shell in all unprivileged user domains.  This
3331 ##      is an explicit transition, requiring the
3332 ##      caller to use setexeccon().
3333 ## </summary>
3334 ## <param name="domain">
3335 ##      <summary>
3336 ##      Domain allowed to transition.
3337 ##      </summary>
3338 ## </param>
3339 #
3340 interface(`userdom_spec_domtrans_unpriv_users',`
3341         gen_require(`
3342                 attribute unpriv_userdomain;
3343         ')
3344
3345         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3346         allow unpriv_userdomain $1:fd use;
3347         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3348         allow unpriv_userdomain $1:process sigchld;
3349 ')
3350
3351 ########################################
3352 ## <summary>
3353 ##      Execute an Xserver session in all unprivileged user domains.  This
3354 ##      is an explicit transition, requiring the
3355 ##      caller to use setexeccon().
3356 ## </summary>
3357 ## <param name="domain">
3358 ##      <summary>
3359 ##      Domain allowed to transition.
3360 ##      </summary>
3361 ## </param>
3362 #
3363 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3364         gen_require(`
3365                 attribute unpriv_userdomain;
3366         ')
3367
3368         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3369         allow unpriv_userdomain $1:fd use;
3370         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3371         allow unpriv_userdomain $1:process sigchld;
3372 ')
3373
3374 ########################################
3375 ## <summary>
3376 ##      Manage unpriviledged user SysV sempaphores.
3377 ## </summary>
3378 ## <param name="domain">
3379 ##      <summary>
3380 ##      Domain allowed access.
3381 ##      </summary>
3382 ## </param>
3383 #
3384 interface(`userdom_manage_unpriv_user_semaphores',`
3385         gen_require(`
3386                 attribute unpriv_userdomain;
3387         ')
3388
3389         allow $1 unpriv_userdomain:sem create_sem_perms;
3390 ')
3391
3392 ########################################
3393 ## <summary>
3394 ##      Manage unpriviledged user SysV shared
3395 ##      memory segments.
3396 ## </summary>
3397 ## <param name="domain">
3398 ##      <summary>
3399 ##      Domain allowed access.
3400 ##      </summary>
3401 ## </param>
3402 #
3403 interface(`userdom_manage_unpriv_user_shared_mem',`
3404         gen_require(`
3405                 attribute unpriv_userdomain;
3406         ')
3407
3408         allow $1 unpriv_userdomain:shm create_shm_perms;
3409 ')
3410
3411 ########################################
3412 ## <summary>
3413 ##      Execute bin_t in the unprivileged user domains. This
3414 ##      is an explicit transition, requiring the
3415 ##      caller to use setexeccon().
3416 ## </summary>
3417 ## <param name="domain">
3418 ##      <summary>
3419 ##      Domain allowed to transition.
3420 ##      </summary>
3421 ## </param>
3422 #
3423 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3424         gen_require(`
3425                 attribute unpriv_userdomain;
3426         ')
3427
3428         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3429         allow unpriv_userdomain $1:fd use;
3430         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3431         allow unpriv_userdomain $1:process sigchld;
3432 ')
3433
3434 ########################################
3435 ## <summary>
3436 ##      Execute all entrypoint files in unprivileged user
3437 ##      domains. This is an explicit transition, requiring the
3438 ##      caller to use setexeccon().
3439 ## </summary>
3440 ## <param name="domain">
3441 ##      <summary>
3442 ##      Domain allowed access.
3443 ##      </summary>
3444 ## </param>
3445 #
3446 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3447         gen_require(`
3448                 attribute unpriv_userdomain;
3449         ')
3450
3451         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3452         allow unpriv_userdomain $1:fd use;
3453         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3454         allow unpriv_userdomain $1:process sigchld;
3455 ')
3456
3457 ########################################
3458 ## <summary>
3459 ##      Search users home directories.
3460 ## </summary>
3461 ## <param name="domain">
3462 ##      <summary>
3463 ##      Domain allowed access.
3464 ##      </summary>
3465 ## </param>
3466 #
3467 interface(`userdom_search_user_home_content',`
3468         gen_require(`
3469                 type user_home_dir_t;
3470                 attribute user_home_type;
3471         ')
3472
3473         files_list_home($1)
3474         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3475         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3476 ')
3477
3478 ########################################
3479 ## <summary>
3480 ##      Send general signals to unprivileged user domains.
3481 ## </summary>
3482 ## <param name="domain">
3483 ##      <summary>
3484 ##      Domain allowed access.
3485 ##      </summary>
3486 ## </param>
3487 #
3488 interface(`userdom_signal_unpriv_users',`
3489         gen_require(`
3490                 attribute unpriv_userdomain;
3491         ')
3492
3493         allow $1 unpriv_userdomain:process signal;
3494 ')
3495
3496 ########################################
3497 ## <summary>
3498 ##      Inherit the file descriptors from unprivileged user domains.
3499 ## </summary>
3500 ## <param name="domain">
3501 ##      <summary>
3502 ##      Domain allowed access.
3503 ##      </summary>
3504 ## </param>
3505 #
3506 interface(`userdom_use_unpriv_users_fds',`
3507         gen_require(`
3508                 attribute unpriv_userdomain;
3509         ')
3510
3511         allow $1 unpriv_userdomain:fd use;
3512 ')
3513
3514 ########################################
3515 ## <summary>
3516 ##      Do not audit attempts to inherit the file descriptors
3517 ##      from unprivileged user domains.
3518 ## </summary>
3519 ## <desc>
3520 ##      <p>
3521 ##      Do not audit attempts to inherit the file descriptors
3522 ##      from unprivileged user domains. This will supress
3523 ##      SELinux denial messages when the specified domain is denied
3524 ##      the permission to inherit these file descriptors.
3525 ##      </p>
3526 ## </desc>
3527 ## <param name="domain">
3528 ##      <summary>
3529 ##      Domain to not audit.
3530 ##      </summary>
3531 ## </param>
3532 ## <infoflow type="none"/>
3533 #
3534 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3535         gen_require(`
3536                 attribute unpriv_userdomain;
3537         ')
3538
3539         dontaudit $1 unpriv_userdomain:fd use;
3540 ')
3541
3542 ########################################
3543 ## <summary>
3544 ##      Do not audit attempts to use user ptys.
3545 ## </summary>
3546 ## <param name="domain">
3547 ##      <summary>
3548 ##      Domain to not audit.
3549 ##      </summary>
3550 ## </param>
3551 #
3552 interface(`userdom_dontaudit_use_user_ptys',`
3553         gen_require(`
3554                 type user_devpts_t;
3555         ')
3556
3557         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3558 ')
3559
3560 ########################################
3561 ## <summary>
3562 ##      Relabel files to unprivileged user pty types.
3563 ## </summary>
3564 ## <param name="domain">
3565 ##      <summary>
3566 ##      Domain allowed access.
3567 ##      </summary>
3568 ## </param>
3569 #
3570 interface(`userdom_relabelto_user_ptys',`
3571         gen_require(`
3572                 type user_devpts_t;
3573         ')
3574
3575         allow $1 user_devpts_t:chr_file relabelto;
3576 ')
3577
3578 ########################################
3579 ## <summary>
3580 ##      Do not audit attempts to relabel files from
3581 ##      user pty types.
3582 ## </summary>
3583 ## <param name="domain">
3584 ##      <summary>
3585 ##      Domain to not audit.
3586 ##      </summary>
3587 ## </param>
3588 #
3589 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3590         gen_require(`
3591                 type user_devpts_t;
3592         ')
3593
3594         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3595 ')
3596
3597 ########################################
3598 ## <summary>
3599 ##      Write all users files in /tmp
3600 ## </summary>
3601 ## <param name="domain">
3602 ##      <summary>
3603 ##      Domain allowed access.
3604 ##      </summary>
3605 ## </param>
3606 #
3607 interface(`userdom_write_user_tmp_files',`
3608         gen_require(`
3609                 type user_tmp_t;
3610         ')
3611
3612         write_files_pattern($1, user_tmp_t, user_tmp_t)
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Do not audit attempts to write users
3618 ##      temporary files.
3619 ## </summary>
3620 ## <param name="domain">
3621 ##      <summary>
3622 ##      Domain to not audit.
3623 ##      </summary>
3624 ## </param>
3625 #
3626 interface(`userdom_dontaudit_write_user_tmp_files',`
3627         gen_require(`
3628                 type user_tmp_t;
3629         ')
3630
3631         dontaudit $1 user_tmp_t:file write;
3632 ')
3633
3634 ########################################
3635 ## <summary>
3636 ##      Do not audit attempts to read/write users
3637 ##      temporary fifo files.
3638 ## </summary>
3639 ## <param name="domain">
3640 ##      <summary>
3641 ##      Domain to not audit.
3642 ##      </summary>
3643 ## </param>
3644 #
3645 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3646         gen_require(`
3647                 type user_tmp_t;
3648         ')
3649
3650         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3651 ')
3652
3653 ########################################
3654 ## <summary>
3655 ##      Do not audit attempts to use user ttys.
3656 ## </summary>
3657 ## <param name="domain">
3658 ##      <summary>
3659 ##      Domain to not audit.
3660 ##      </summary>
3661 ## </param>
3662 #
3663 interface(`userdom_dontaudit_use_user_ttys',`
3664         gen_require(`
3665                 type user_tty_device_t;
3666         ')
3667
3668         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3669 ')
3670
3671 ########################################
3672 ## <summary>
3673 ##      Read the process state of all user domains.
3674 ## </summary>
3675 ## <param name="domain">
3676 ##      <summary>
3677 ##      Domain allowed access.
3678 ##      </summary>
3679 ## </param>
3680 #
3681 interface(`userdom_read_all_users_state',`
3682         gen_require(`
3683                 attribute userdomain;
3684         ')
3685
3686         read_files_pattern($1, userdomain, userdomain)
3687         read_lnk_files_pattern($1,userdomain,userdomain)
3688         kernel_search_proc($1)
3689 ')
3690
3691 ########################################
3692 ## <summary>
3693 ##      Get the attributes of all user domains.
3694 ## </summary>
3695 ## <param name="domain">
3696 ##      <summary>
3697 ##      Domain allowed access.
3698 ##      </summary>
3699 ## </param>
3700 #
3701 interface(`userdom_getattr_all_users',`
3702         gen_require(`
3703                 attribute userdomain;
3704         ')
3705
3706         allow $1 userdomain:process getattr;
3707 ')
3708
3709 ########################################
3710 ## <summary>
3711 ##      Inherit the file descriptors from all user domains
3712 ## </summary>
3713 ## <param name="domain">
3714 ##      <summary>
3715 ##      Domain allowed access.
3716 ##      </summary>
3717 ## </param>
3718 #
3719 interface(`userdom_use_all_users_fds',`
3720         gen_require(`
3721                 attribute userdomain;
3722         ')
3723
3724         allow $1 userdomain:fd use;
3725 ')
3726
3727 ########################################
3728 ## <summary>
3729 ##      Do not audit attempts to inherit the file
3730 ##      descriptors from any user domains.
3731 ## </summary>
3732 ## <param name="domain">
3733 ##      <summary>
3734 ##      Domain to not audit.
3735 ##      </summary>
3736 ## </param>
3737 #
3738 interface(`userdom_dontaudit_use_all_users_fds',`
3739         gen_require(`
3740                 attribute userdomain;
3741         ')
3742
3743         dontaudit $1 userdomain:fd use;
3744 ')
3745
3746 ########################################
3747 ## <summary>
3748 ##      Send general signals to all user domains.
3749 ## </summary>
3750 ## <param name="domain">
3751 ##      <summary>
3752 ##      Domain allowed access.
3753 ##      </summary>
3754 ## </param>
3755 #
3756 interface(`userdom_signal_all_users',`
3757         gen_require(`
3758                 attribute userdomain;
3759         ')
3760
3761         allow $1 userdomain:process signal;
3762 ')
3763
3764 ########################################
3765 ## <summary>
3766 ##      Send kill signals to all user domains.
3767 ## </summary>
3768 ## <param name="domain">
3769 ##      <summary>
3770 ##      Domain allowed access.
3771 ##      </summary>
3772 ## </param>
3773 #
3774 interface(`userdom_kill_all_users',`
3775         gen_require(`
3776                 attribute userdomain;
3777         ')
3778
3779         allow $1 userdomain:process sigkill;
3780 ')
3781
3782 ########################################
3783 ## <summary>
3784 ##      Send a SIGCHLD signal to all user domains.
3785 ## </summary>
3786 ## <param name="domain">
3787 ##      <summary>
3788 ##      Domain allowed access.
3789 ##      </summary>
3790 ## </param>
3791 #
3792 interface(`userdom_sigchld_all_users',`
3793         gen_require(`
3794                 attribute userdomain;
3795         ')
3796
3797         allow $1 userdomain:process sigchld;
3798 ')
3799
3800 ########################################
3801 ## <summary>
3802 ##      Create keys for all user domains.
3803 ## </summary>
3804 ## <param name="domain">
3805 ##      <summary>
3806 ##      Domain allowed access.
3807 ##      </summary>
3808 ## </param>
3809 #
3810 interface(`userdom_create_all_users_keys',`
3811         gen_require(`
3812                 attribute userdomain;
3813         ')
3814
3815         allow $1 userdomain:key create;
3816 ')
3817
3818 ########################################
3819 ## <summary>
3820 ##      Send a dbus message to all user domains.
3821 ## </summary>
3822 ## <param name="domain">
3823 ##      <summary>
3824 ##      Domain allowed access.
3825 ##      </summary>
3826 ## </param>
3827 #
3828 interface(`userdom_dbus_send_all_users',`
3829         gen_require(`
3830                 attribute userdomain;
3831                 class dbus send_msg;
3832         ')
3833
3834         allow $1 userdomain:dbus send_msg;
3835 ')
3836
3837 ########################################
3838 ## <summary>
3839 ##      Allow apps to set rlimits on userdomain
3840 ## </summary>
3841 ## <param name="domain">
3842 ##      <summary>
3843 ##      Domain allowed access.
3844 ##      </summary>
3845 ## </param>
3846 #
3847 interface(`userdom_set_rlimitnh',`
3848         gen_require(`
3849                 attribute userdomain;
3850         ')
3851
3852         allow $1 userdomain:process rlimitinh;
3853 ')
3854
3855 ########################################
3856 ## <summary>
3857 ##      Define this type as a Allow apps to set rlimits on userdomain
3858 ## </summary>
3859 ## <param name="domain">
3860 ##      <summary>
3861 ##      Domain allowed access.
3862 ##      </summary>
3863 ## </param>
3864 ## <param name="userdomain_prefix">
3865 ##      <summary>
3866 ##      The prefix of the user domain (e.g., user
3867 ##      is the prefix for user_t).
3868 ## </summary>
3869 ## </param>
3870 ## <param name="domain">
3871 ##      <summary>
3872 ##      Domain allowed access.
3873 ##      </summary>
3874 ## </param>
3875 #
3876 template(`userdom_unpriv_usertype',`
3877         gen_require(`
3878                 attribute unpriv_userdomain, userdomain;
3879                 attribute $1_usertype;
3880         ')
3881         typeattribute $2  $1_usertype;
3882         typeattribute $2  unpriv_userdomain;
3883         typeattribute $2  userdomain;
3884
3885         auth_use_nsswitch($2)
3886         ubac_constrained($2)
3887 ')
3888
3889 ########################################
3890 ## <summary>
3891 ##      Connect to users over an unix stream socket.
3892 ## </summary>
3893 ## <param name="domain">
3894 ##      <summary>
3895 ##      Domain allowed access.
3896 ##      </summary>
3897 ## </param>
3898 #
3899 interface(`userdom_stream_connect',`
3900         gen_require(`
3901                 type user_tmp_t;
3902                 attribute userdomain;
3903         ')
3904
3905         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3906 ')
3907
3908 ########################################
3909 ## <summary>
3910 ##      Ptrace user domains.
3911 ## </summary>
3912 ## <param name="domain">
3913 ##      <summary>
3914 ##      Domain allowed access.
3915 ##      </summary>
3916 ## </param>
3917 #
3918 interface(`userdom_ptrace_all_users',`
3919         gen_require(`
3920                 attribute userdomain;
3921         ')
3922
3923         allow $1 userdomain:process ptrace;
3924 ')
3925
3926 ########################################
3927 ## <summary>
3928 ##      dontaudit Search /root
3929 ## </summary>
3930 ## <param name="domain">
3931 ##      <summary>
3932 ##      Domain to not audit.
3933 ##      </summary>
3934 ## </param>
3935 #
3936 interface(`userdom_dontaudit_search_admin_dir',`
3937         gen_require(`
3938                 type admin_home_t;
3939         ')
3940
3941         dontaudit $1 admin_home_t:dir search_dir_perms;
3942 ')
3943
3944 ########################################
3945 ## <summary>
3946 ##      dontaudit list /root
3947 ## </summary>
3948 ## <param name="domain">
3949 ##      <summary>
3950 ##      Domain to not audit.
3951 ##      </summary>
3952 ## </param>
3953 #
3954 interface(`userdom_dontaudit_list_admin_dir',`
3955         gen_require(`
3956                 type admin_home_t;
3957         ')
3958
3959         dontaudit $1 admin_home_t:dir list_dir_perms;
3960 ')
3961
3962 ########################################
3963 ## <summary>
3964 ##      Allow domain to  list /root
3965 ## </summary>
3966 ## <param name="domain">
3967 ##      <summary>
3968 ##      Domain allowed access.
3969 ##      </summary>
3970 ## </param>
3971 #
3972 interface(`userdom_list_admin_dir',`
3973         gen_require(`
3974                 type admin_home_t;
3975         ')
3976
3977         allow $1 admin_home_t:dir list_dir_perms;
3978 ')
3979
3980 ########################################
3981 ## <summary>
3982 ##      Allow Search /root
3983 ## </summary>
3984 ## <param name="domain">
3985 ##      <summary>
3986 ##      Domain allowed access.
3987 ##      </summary>
3988 ## </param>
3989 #
3990 interface(`userdom_search_admin_dir',`
3991         gen_require(`
3992                 type admin_home_t;
3993         ')
3994
3995         allow $1 admin_home_t:dir search_dir_perms;
3996 ')
3997
3998 ########################################
3999 ## <summary>
4000 ##      RW unpriviledged user SysV sempaphores.
4001 ## </summary>
4002 ## <param name="domain">
4003 ##      <summary>
4004 ##      Domain allowed access.
4005 ##      </summary>
4006 ## </param>
4007 #
4008 interface(`userdom_rw_semaphores',`
4009         gen_require(`
4010                 attribute unpriv_userdomain;
4011         ')
4012
4013         allow $1 unpriv_userdomain:sem rw_sem_perms;
4014 ')
4015
4016 ########################################
4017 ## <summary>
4018 ##      Send a message to unpriv users over a unix domain
4019 ##      datagram socket.
4020 ## </summary>
4021 ## <param name="domain">
4022 ##      <summary>
4023 ##      Domain allowed access.
4024 ##      </summary>
4025 ## </param>
4026 #
4027 interface(`userdom_dgram_send',`
4028         gen_require(`
4029                 attribute unpriv_userdomain;
4030         ')
4031
4032         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4033 ')
4034
4035 ######################################
4036 ## <summary>
4037 ##      Send a message to users over a unix domain
4038 ##      datagram socket.
4039 ## </summary>
4040 ## <param name="domain">
4041 ##      <summary>
4042 ##      Domain allowed access.
4043 ##      </summary>
4044 ## </param>
4045 #
4046 interface(`userdom_users_dgram_send',`
4047         gen_require(`
4048                  attribute userdomain;
4049       ')
4050
4051        allow $1 userdomain:unix_dgram_socket sendto;
4052 ')
4053
4054 #######################################
4055 ## <summary>
4056 ##      Allow execmod on files in homedirectory
4057 ## </summary>
4058 ## <param name="domain">
4059 ##      <summary>
4060 ##      Domain allowed access.
4061 ##      </summary>
4062 ## </param>
4063 ## <rolebase/>
4064 #
4065 interface(`userdom_execmod_user_home_files',`
4066         gen_require(`
4067                 type user_home_type;
4068         ')
4069
4070         allow $1 user_home_type:file execmod;
4071 ')
4072
4073 ########################################
4074 ## <summary>
4075 ##      Read admin home files.
4076 ## </summary>
4077 ## <param name="domain">
4078 ##      <summary>
4079 ##      Domain allowed access.
4080 ##      </summary>
4081 ## </param>
4082 ## <rolecap/>
4083 #
4084 interface(`userdom_read_admin_home_files',`
4085         gen_require(`
4086                 type admin_home_t;
4087         ')
4088
4089         read_files_pattern($1, admin_home_t, admin_home_t)
4090 ')
4091
4092 ########################################
4093 ## <summary>
4094 ##      Execute admin home files.
4095 ## </summary>
4096 ## <param name="domain">
4097 ##      <summary>
4098 ##      Domain allowed access.
4099 ##      </summary>
4100 ## </param>
4101 ## <rolecap/>
4102 #
4103 interface(`userdom_exec_admin_home_files',`
4104         gen_require(`
4105                 type admin_home_t;
4106         ')
4107
4108         exec_files_pattern($1, admin_home_t, admin_home_t)
4109 ')
4110
4111 ########################################
4112 ## <summary>
4113 ##      Append files inherited
4114 ##      in the /root directory.
4115 ## </summary>
4116 ## <param name="domain">
4117 ##      <summary>
4118 ##      Domain allowed access.
4119 ##      </summary>
4120 ## </param>
4121 #
4122 interface(`userdom_inherit_append_admin_home_files',`
4123         gen_require(`
4124                 type admin_home_t;
4125         ')
4126
4127         allow $1 admin_home_t:file { getattr append };
4128 ')
4129
4130
4131 #######################################
4132 ## <summary>
4133 ##      Manage all files/directories in the homedir
4134 ## </summary>
4135 ## <param name="userdomain">
4136 ##      <summary>
4137 ##      The user domain
4138 ##      </summary>
4139 ## </param>
4140 ## <rolebase/>
4141 #
4142 interface(`userdom_manage_user_home_content',`
4143         gen_require(`
4144                 type user_home_dir_t, user_home_t;
4145                 attribute user_home_type;
4146         ')
4147
4148         files_list_home($1)
4149         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4150         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4151         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4152         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4153         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4154         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4155
4156 ')
4157
4158
4159 ########################################
4160 ## <summary>
4161 ##      Create objects in a user home directory
4162 ##      with an automatic type transition to
4163 ##      the user home file type.
4164 ## </summary>
4165 ## <param name="domain">
4166 ##      <summary>
4167 ##      Domain allowed access.
4168 ##      </summary>
4169 ## </param>
4170 ## <param name="object_class">
4171 ##      <summary>
4172 ##      The class of the object to be created.
4173 ##      </summary>
4174 ## </param>
4175 #
4176 interface(`userdom_user_home_dir_filetrans_pattern',`
4177         gen_require(`
4178                 type user_home_dir_t, user_home_t;
4179         ')
4180
4181         type_transition $1 user_home_dir_t:$2 user_home_t;
4182 ')
4183
4184 ########################################
4185 ## <summary>
4186 ##      Create objects in the /root directory
4187 ##      with an automatic type transition to
4188 ##      a specified private type.
4189 ## </summary>
4190 ## <param name="domain">
4191 ##      <summary>
4192 ##      Domain allowed access.
4193 ##      </summary>
4194 ## </param>
4195 ## <param name="private_type">
4196 ##      <summary>
4197 ##      The type of the object to create.
4198 ##      </summary>
4199 ## </param>
4200 ## <param name="object_class">
4201 ##      <summary>
4202 ##      The class of the object to be created.
4203 ##      </summary>
4204 ## </param>
4205 #
4206 interface(`userdom_admin_home_dir_filetrans',`
4207         gen_require(`
4208                 type admin_home_t;
4209         ')
4210
4211         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4212 ')
4213
4214 ########################################
4215 ## <summary>
4216 ##      Send signull to unprivileged user domains.
4217 ## </summary>
4218 ## <param name="domain">
4219 ##      <summary>
4220 ##      Domain allowed access.
4221 ##      </summary>
4222 ## </param>
4223 #
4224 interface(`userdom_signull_unpriv_users',`
4225         gen_require(`
4226                 attribute unpriv_userdomain;
4227         ')
4228
4229         allow $1 unpriv_userdomain:process signull;
4230 ')
4231
4232 ########################################
4233 ## <summary>
4234 ##      Write all users files in /tmp
4235 ## </summary>
4236 ## <param name="domain">
4237 ##      <summary>
4238 ##      Domain allowed access.
4239 ##      </summary>
4240 ## </param>
4241 #
4242 interface(`userdom_write_user_tmp_dirs',`
4243         gen_require(`
4244                 type user_tmp_t;
4245         ')
4246
4247         write_files_pattern($1, user_tmp_t, user_tmp_t)
4248 ')
4249
4250 ########################################
4251 ## <summary>
4252 ##      Manage keys for all user domains.
4253 ## </summary>
4254 ## <param name="domain">
4255 ##      <summary>
4256 ##      Domain allowed access.
4257 ##      </summary>
4258 ## </param>
4259 #
4260 interface(`userdom_manage_all_users_keys',`
4261         gen_require(`
4262                 attribute userdomain;
4263         ')
4264
4265         allow $1 userdomain:key manage_key_perms;
4266 ')
4267
4268
4269 ########################################
4270 ## <summary>
4271 ##      Do not audit attempts to read and write
4272 ##      unserdomain stream.
4273 ## </summary>
4274 ## <param name="domain">
4275 ##      <summary>
4276 ##      Domain to not audit.
4277 ##      </summary>
4278 ## </param>
4279 #
4280 interface(`userdom_dontaudit_rw_stream',`
4281         gen_require(`
4282                 attribute userdomain;
4283         ')
4284
4285         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4286 ')
4287
4288 ########################################
4289 ## <summary>
4290 ##      Do not audit attempts to read and write
4291 ##      unserdomain datagram socket.
4292 ## </summary>
4293 ## <param name="domain">
4294 ##      <summary>
4295 ##      Domain to not audit.
4296 ##      </summary>
4297 ## </param>
4298 #
4299 interface(`userdom_dontaudit_rw_dgram_socket',`
4300         gen_require(`
4301                 attribute userdomain;
4302         ')
4303
4304         dontaudit $1 userdomain:unix_dgram_socket { read write };
4305 ')
4306
4307 ########################################
4308 ## <summary>
4309 ##      Append files
4310 ##      in a user home subdirectory.
4311 ## </summary>
4312 ## <param name="domain">
4313 ##      <summary>
4314 ##      Domain allowed access.
4315 ##      </summary>
4316 ## </param>
4317 #
4318 interface(`userdom_append_user_home_content_files',`
4319         gen_require(`
4320                 type user_home_dir_t, user_home_t;
4321         ')
4322
4323         append_files_pattern($1, user_home_t, user_home_t)
4324         allow $1 user_home_dir_t:dir search_dir_perms;
4325         files_search_home($1)
4326 ')
4327
4328 ########################################
4329 ## <summary>
4330 ##      Read files inherited
4331 ##      in a user home subdirectory.
4332 ## </summary>
4333 ## <param name="domain">
4334 ##      <summary>
4335 ##      Domain allowed access.
4336 ##      </summary>
4337 ## </param>
4338 #
4339 interface(`userdom_read_inherited_user_home_content_files',`
4340         gen_require(`
4341                 attribute user_home_type;
4342         ')
4343
4344         allow $1 user_home_type:file { getattr read };
4345 ')
4346
4347 ########################################
4348 ## <summary>
4349 ##      Append files inherited
4350 ##      in a user home subdirectory.
4351 ## </summary>
4352 ## <param name="domain">
4353 ##      <summary>
4354 ##      Domain allowed access.
4355 ##      </summary>
4356 ## </param>
4357 #
4358 interface(`userdom_inherit_append_user_home_content_files',`
4359         gen_require(`
4360                 type user_home_t;
4361         ')
4362
4363         allow $1 user_home_t:file { getattr append };
4364 ')
4365
4366 ########################################
4367 ## <summary>
4368 ##      Append files inherited
4369 ##      in a user tmp files.
4370 ## </summary>
4371 ## <param name="domain">
4372 ##      <summary>
4373 ##      Domain allowed access.
4374 ##      </summary>
4375 ## </param>
4376 #
4377 interface(`userdom_inherit_append_user_tmp_files',`
4378         gen_require(`
4379                 type user_tmp_t;
4380         ')
4381
4382         allow $1 user_tmp_t:file { getattr append };
4383 ')
4384
4385 ######################################
4386 ## <summary>
4387 ##      Read audio files in the users homedir.
4388 ## </summary>
4389 ## <param name="domain">
4390 ##      <summary>
4391 ##      Domain allowed access.
4392 ##      </summary>
4393 ## </param>
4394 ## <rolecap/>
4395 #
4396 interface(`userdom_read_home_audio_files',`
4397         gen_require(`
4398                 type audio_home_t;
4399         ')
4400
4401         userdom_search_user_home_dirs($1)
4402         allow $1 audio_home_t:dir list_dir_perms;
4403         read_files_pattern($1, audio_home_t, audio_home_t)
4404         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4405 ')
4406
4407 ########################################
4408 ## <summary>
4409 ##      Do not audit attempts to write all user home content files.
4410 ## </summary>
4411 ## <param name="domain">
4412 ##      <summary>
4413 ##      Domain to not audit.
4414 ##      </summary>
4415 ## </param>
4416 #
4417 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4418         gen_require(`
4419                 attribute user_home_type;
4420         ')
4421
4422         dontaudit $1 user_home_type:file write_file_perms;
4423 ')
4424
4425 ########################################
4426 ## <summary>
4427 ##      Do not audit attempts to write all user tmp content files.
4428 ## </summary>
4429 ## <param name="domain">
4430 ##      <summary>
4431 ##      Domain to not audit.
4432 ##      </summary>
4433 ## </param>
4434 #
4435 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4436         gen_require(`
4437                 attribute user_tmp_type;
4438         ')
4439
4440         dontaudit $1 user_tmp_type:file write_file_perms;
4441 ')
4442
4443 ########################################
4444 ## <summary>
4445 ##      Manage all user temporary content.
4446 ## </summary>
4447 ## <param name="domain">
4448 ##      <summary>
4449 ##      Domain allowed access.
4450 ##      </summary>
4451 ## </param>
4452 #
4453 interface(`userdom_manage_all_user_tmp_content',`
4454         gen_require(`
4455                 attribute user_tmp_type;
4456         ')
4457
4458         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4459         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4460         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4461         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4462         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4463         files_search_tmp($1)
4464 ')
4465
4466 ########################################
4467 ## <summary>
4468 ##      List all user temporary content.
4469 ## </summary>
4470 ## <param name="domain">
4471 ##      <summary>
4472 ##      Domain allowed access.
4473 ##      </summary>
4474 ## </param>
4475 #
4476 interface(`userdom_list_all_user_tmp_content',`
4477         gen_require(`
4478                 attribute user_tmp_type;
4479         ')
4480
4481         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4482         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4483         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4484         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4485         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4486         files_search_var($1)
4487         files_search_tmp($1)
4488 ')
4489
4490 ########################################
4491 ## <summary>
4492 ##      Manage all user tmpfs content.
4493 ## </summary>
4494 ## <param name="domain">
4495 ##      <summary>
4496 ##      Domain allowed access.
4497 ##      </summary>
4498 ## </param>
4499 #
4500 interface(`userdom_manage_all_user_tmpfs_content',`
4501         gen_require(`
4502                 attribute user_tmpfs_type;
4503         ')
4504
4505         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4506         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4507         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4508         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4509         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4510         fs_search_tmpfs($1)
4511 ')
4512
4513 ########################################
4514 ## <summary>
4515 ##      Delete all user temporary content.
4516 ## </summary>
4517 ## <param name="domain">
4518 ##      <summary>
4519 ##      Domain allowed access.
4520 ##      </summary>
4521 ## </param>
4522 #
4523 interface(`userdom_delete_all_user_tmp_content',`
4524         gen_require(`
4525                 attribute user_tmp_type;
4526         ')
4527
4528         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4529         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4530         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4531         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4532         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4533         # /var/tmp
4534         files_search_var($1)
4535         files_delete_tmp_dir_entry($1)
4536 ')
4537
4538 ########################################
4539 ## <summary>
4540 ##      Read system SSL certificates in the users homedir.
4541 ## </summary>
4542 ## <param name="domain">
4543 ##      <summary>
4544 ##      Domain allowed access.
4545 ##      </summary>
4546 ## </param>
4547 #
4548 interface(`userdom_read_home_certs',`
4549         gen_require(`
4550                 type home_cert_t;
4551         ')
4552
4553         userdom_search_user_home_content($1)
4554         allow $1 home_cert_t:dir list_dir_perms;
4555         read_files_pattern($1, home_cert_t, home_cert_t)
4556         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4557 ')
4558
4559 #######################################
4560 ## <summary>
4561 ##  Dontaudit Write system SSL certificates in the users homedir.
4562 ## </summary>
4563 ## <param name="domain">
4564 ##  <summary>
4565 ##      Domain to not audit.
4566 ##  </summary>
4567 ## </param>
4568 #
4569 interface(`userdom_dontaudit_write_home_certs',`
4570     gen_require(`
4571         type home_cert_t;
4572     ')
4573
4574     dontaudit $1 home_cert_t:file write;
4575 ')
4576
4577 ########################################
4578 ## <summary>
4579 ##      dontaudit Search getatrr /root files
4580 ## </summary>
4581 ## <param name="domain">
4582 ##      <summary>
4583 ##      Domain to not audit.
4584 ##      </summary>
4585 ## </param>
4586 #
4587 interface(`userdom_dontaudit_getattr_admin_home_files',`
4588         gen_require(`
4589                 type admin_home_t;
4590         ')
4591
4592         dontaudit $1 admin_home_t:file getattr;
4593 ')
4594
4595 ########################################
4596 ## <summary>
4597 ##      dontaudit read /root lnk files
4598 ## </summary>
4599 ## <param name="domain">
4600 ##      <summary>
4601 ##      Domain to not audit.
4602 ##      </summary>
4603 ## </param>
4604 #
4605 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4606         gen_require(`
4607                 type admin_home_t;
4608         ')
4609
4610         dontaudit $1 admin_home_t:lnk_file read;
4611 ')
4612
4613 ########################################
4614 ## <summary>
4615 ##      dontaudit read /root files
4616 ## </summary>
4617 ## <param name="domain">
4618 ##      <summary>
4619 ##      Domain to not audit.
4620 ##      </summary>
4621 ## </param>
4622 #
4623 interface(`userdom_dontaudit_read_admin_home_files',`
4624         gen_require(`
4625                 type admin_home_t;
4626         ')
4627
4628         dontaudit $1 admin_home_t:file read_file_perms;
4629 ')
4630
4631 ########################################
4632 ## <summary>
4633 ##      Create, read, write, and delete user
4634 ##      temporary chr files.
4635 ## </summary>
4636 ## <param name="domain">
4637 ##      <summary>
4638 ##      Domain allowed access.
4639 ##      </summary>
4640 ## </param>
4641 #
4642 interface(`userdom_manage_user_tmp_chr_files',`
4643         gen_require(`
4644                 type user_tmp_t;
4645         ')
4646
4647         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4648         files_search_tmp($1)
4649 ')
4650
4651 ########################################
4652 ## <summary>
4653 ##      Create, read, write, and delete user
4654 ##      temporary blk files.
4655 ## </summary>
4656 ## <param name="domain">
4657 ##      <summary>
4658 ##      Domain allowed access.
4659 ##      </summary>
4660 ## </param>
4661 #
4662 interface(`userdom_manage_user_tmp_blk_files',`
4663         gen_require(`
4664                 type user_tmp_t;
4665         ')
4666
4667         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4668         files_search_tmp($1)
4669 ')
4670
4671 ########################################
4672 ## <summary>
4673 ##      Dontaudit attempt to set attributes on  user temporary directories.
4674 ## </summary>
4675 ## <param name="domain">
4676 ##      <summary>
4677 ##      Domain to not audit.
4678 ##      </summary>
4679 ## </param>
4680 #
4681 interface(`userdom_dontaudit_setattr_user_tmp',`
4682         gen_require(`
4683                 type user_tmp_t;
4684         ')
4685
4686         dontaudit $1 user_tmp_t:dir setattr;
4687 ')
4688
4689 ########################################
4690 ## <summary>
4691 ##      Write all inherited users files in /tmp
4692 ## </summary>
4693 ## <param name="domain">
4694 ##      <summary>
4695 ##      Domain allowed access.
4696 ##      </summary>
4697 ## </param>
4698 #
4699 interface(`userdom_write_inherited_user_tmp_files',`
4700         gen_require(`
4701                 type user_tmp_t;
4702         ')
4703
4704         allow $1 user_tmp_t:file write;
4705 ')
4706
4707 ########################################
4708 ## <summary>
4709 ##      Delete all users files in /tmp
4710 ## </summary>
4711 ## <param name="domain">
4712 ##      <summary>
4713 ##      Domain allowed access.
4714 ##      </summary>
4715 ## </param>
4716 #
4717 interface(`userdom_delete_user_tmp_files',`
4718         gen_require(`
4719                 type user_tmp_t;
4720         ')
4721
4722         allow $1 user_tmp_t:file delete_file_perms;
4723 ')
4724
4725 ########################################
4726 ## <summary>
4727 ##      Delete user tmpfs files.
4728 ## </summary>
4729 ## <param name="domain">
4730 ##      <summary>
4731 ##      Domain allowed access.
4732 ##      </summary>
4733 ## </param>
4734 #
4735 interface(`userdom_delete_user_tmpfs_files',`
4736         gen_require(`
4737                 type user_tmpfs_t;
4738         ')
4739
4740         allow $1 user_tmpfs_t:file delete_file_perms;
4741 ')
4742
4743 ########################################
4744 ## <summary>
4745 ##      Read/Write unpriviledged user SysV shared
4746 ##      memory segments.
4747 ## </summary>
4748 ## <param name="domain">
4749 ##      <summary>
4750 ##      Domain allowed access.
4751 ##      </summary>
4752 ## </param>
4753 #
4754 interface(`userdom_rw_unpriv_user_shared_mem',`
4755         gen_require(`
4756                 attribute unpriv_userdomain;
4757         ')
4758
4759         allow $1 unpriv_userdomain:shm rw_shm_perms;
4760 ')
4761
4762 ########################################
4763 ## <summary>
4764 ##      Do not audit attempts to search user
4765 ##      temporary directories.
4766 ## </summary>
4767 ## <param name="domain">
4768 ##      <summary>
4769 ##      Domain to not audit.
4770 ##      </summary>
4771 ## </param>
4772 #
4773 interface(`userdom_dontaudit_search_user_tmp',`
4774         gen_require(`
4775                 type user_tmp_t;
4776         ')
4777
4778         dontaudit $1 user_tmp_t:dir search_dir_perms;
4779 ')
4780
4781 ########################################
4782 ## <summary>
4783 ##      Execute a file in a user home directory
4784 ##      in the specified domain.
4785 ## </summary>
4786 ## <desc>
4787 ##      <p>
4788 ##      Execute a file in a user home directory
4789 ##      in the specified domain.
4790 ##      </p>
4791 ##      <p>
4792 ##      No interprocess communication (signals, pipes,
4793 ##      etc.) is provided by this interface since
4794 ##      the domains are not owned by this module.
4795 ##      </p>
4796 ## </desc>
4797 ## <param name="domain">
4798 ##      <summary>
4799 ##      Domain allowed access.
4800 ##      </summary>
4801 ## </param>
4802 ## <param name="target_domain">
4803 ##      <summary>
4804 ##      The type of the new process.
4805 ##      </summary>
4806 ## </param>
4807 #
4808 interface(`userdom_domtrans_user_home',`
4809         gen_require(`
4810                 type user_home_t;
4811         ')
4812
4813         read_lnk_files_pattern($1, user_home_t, user_home_t)
4814         domain_transition_pattern($1, user_home_t, $2)
4815         type_transition $1 user_home_t:process $2;
4816 ')
4817
4818 ########################################
4819 ## <summary>
4820 ##      Execute a file in a user tmp directory
4821 ##      in the specified domain.
4822 ## </summary>
4823 ## <desc>
4824 ##      <p>
4825 ##      Execute a file in a user tmp directory
4826 ##      in the specified domain.
4827 ##      </p>
4828 ##      <p>
4829 ##      No interprocess communication (signals, pipes,
4830 ##      etc.) is provided by this interface since
4831 ##      the domains are not owned by this module.
4832 ##      </p>
4833 ## </desc>
4834 ## <param name="domain">
4835 ##      <summary>
4836 ##      Domain allowed access.
4837 ##      </summary>
4838 ## </param>
4839 ## <param name="target_domain">
4840 ##      <summary>
4841 ##      The type of the new process.
4842 ##      </summary>
4843 ## </param>
4844 #
4845 interface(`userdom_domtrans_user_tmp',`
4846         gen_require(`
4847                 type user_tmp_t;
4848         ')
4849
4850         files_search_tmp($1)
4851         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4852         domain_transition_pattern($1, user_tmp_t, $2)
4853         type_transition $1 user_tmp_t:process $2;
4854 ')
4855
4856 ########################################
4857 ## <summary>
4858 ##      Do not audit attempts to read all user home content files.
4859 ## </summary>
4860 ## <param name="domain">
4861 ##      <summary>
4862 ##      Domain to not audit.
4863 ##      </summary>
4864 ## </param>
4865 #
4866 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4867         gen_require(`
4868                 attribute user_home_type;
4869         ')
4870
4871         dontaudit $1 user_home_type:file read_file_perms;
4872 ')
4873
4874 ########################################
4875 ## <summary>
4876 ##      Do not audit attempts to read all user tmp content files.
4877 ## </summary>
4878 ## <param name="domain">
4879 ##      <summary>
4880 ##      Domain to not audit.
4881 ##      </summary>
4882 ## </param>
4883 #
4884 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4885         gen_require(`
4886                 attribute user_tmp_type;
4887         ')
4888
4889         dontaudit $1 user_tmp_type:file read_file_perms;
4890 ')
4891
4892 #######################################
4893 ## <summary>
4894 ## Read and write unpriviledged user SysV sempaphores.
4895 ## </summary>
4896 ## <param name="domain">
4897 ## <summary>
4898 ## Domain allowed access.
4899 ## </summary>
4900 ## </param>
4901 #
4902 interface(`userdom_rw_unpriv_user_semaphores',`
4903    gen_require(`
4904        attribute unpriv_userdomain;
4905    ')
4906
4907    allow $1 unpriv_userdomain:sem rw_sem_perms;
4908 ')