policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         allow $1_usertype $1_usertype:fd use;
  52         allow $1_usertype $1_t:key { create view read write search link setattr };
  53
  54         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  55         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_usertype $1_usertype:shm create_shm_perms;
  58         allow $1_usertype $1_usertype:sem create_sem_perms;
  59         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  60         allow $1_usertype $1_usertype:msg { send receive };
  61         allow $1_usertype $1_usertype:context contains;
  62         dontaudit $1_usertype $1_usertype:socket create;
  63
  64         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  65         term_create_pty($1_usertype, user_devpts_t)
  66         # avoid annoying messages on terminal hangup on role change
  67         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  68
  69         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  70         # avoid annoying messages on terminal hangup on role change
  71         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  72
  73         application_exec_all($1_usertype)
  74
  75         kernel_read_kernel_sysctls($1_usertype)
  76         kernel_read_all_sysctls($1_usertype)
  77         kernel_dontaudit_list_unlabeled($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  84         kernel_dontaudit_list_proc($1_usertype)
  85
  86         dev_dontaudit_getattr_all_blk_files($1_usertype)
  87         dev_dontaudit_getattr_all_chr_files($1_usertype)
  88         dev_getattr_mtrr_dev($1_t)
  89
  90         # When the user domain runs ps, there will be a number of access
  91         # denials when ps tries to search /proc. Do not audit these denials.
  92         domain_dontaudit_read_all_domains_state($1_usertype)
  93         domain_dontaudit_getattr_all_domains($1_usertype)
  94         domain_dontaudit_getsession_all_domains($1_usertype)
  95         dev_dontaudit_all_access_check($1_usertype)
  96
  97         files_read_etc_files($1_usertype)
  98         files_list_mnt($1_usertype)
  99         files_list_var($1_usertype)
 100         files_read_mnt_files($1_usertype)
 101         files_dontaudit_access_check_mnt($1_usertype)
 102         files_read_etc_runtime_files($1_usertype)
 103         files_read_usr_files($1_usertype)
 104         files_read_usr_src_files($1_usertype)
 105         # Read directories and files with the readable_t type.
 106         # This type is a general type for "world"-readable files.
 107         files_list_world_readable($1_usertype)
 108         files_read_world_readable_files($1_usertype)
 109         files_read_world_readable_symlinks($1_usertype)
 110         files_read_world_readable_pipes($1_usertype)
 111         files_read_world_readable_sockets($1_usertype)
 112         # old broswer_domain():
 113         files_dontaudit_getattr_all_dirs($1_usertype)
 114         files_dontaudit_list_non_security($1_usertype)
 115         files_dontaudit_getattr_all_files($1_usertype)
 116         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 117         files_dontaudit_getattr_non_security_pipes($1_usertype)
 118         files_dontaudit_getattr_non_security_sockets($1_usertype)
 119         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 120
 121         files_exec_usr_files($1_t)
 122
 123         fs_list_cgroup_dirs($1_usertype)
 124         fs_dontaudit_rw_cgroup_files($1_usertype)
 125
 126         storage_rw_fuse($1_usertype)
 127
 128         auth_use_nsswitch($1_t)
 129
 130         init_stream_connect($1_usertype)
 131         # The library functions always try to open read-write first,
 132         # then fall back to read-only if it fails.
 133         init_dontaudit_rw_utmp($1_usertype)
 134
 135         libs_exec_ld_so($1_usertype)
 136
 137         logging_send_audit_msgs($1_t)
 138
 139         miscfiles_read_localization($1_t)
 140         miscfiles_read_generic_certs($1_t)
 141
 142         miscfiles_read_all_certs($1_usertype)
 143         miscfiles_read_localization($1_usertype)
 144         miscfiles_read_man_pages($1_usertype)
 145         miscfiles_read_public_files($1_usertype)
 146
 147         systemd_dbus_chat_logind($1_usertype)
 148
 149         tunable_policy(`allow_execmem',`
 150                 # Allow loading DSOs that require executable stack.
 151                 allow $1_t self:process execmem;
 152         ')
 153
 154         tunable_policy(`allow_execmem && allow_execstack',`
 155                 # Allow making the stack executable via mprotect.
 156                 allow $1_t self:process execstack;
 157         ')
 158
 159         optional_policy(`
 160                 abrt_stream_connect($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 fs_list_cgroup_dirs($1_usertype)
 165         ')
 166
 167         optional_policy(`
 168                 ssh_rw_stream_sockets($1_usertype)
 169                 ssh_delete_tmp($1_t)
 170                 ssh_signal($1_t)
 171         ')
 172 ')
 173
 174 #######################################
 175 ## <summary>
 176 ##      Allow a home directory for which the
 177 ##      role has read-only access.
 178 ## </summary>
 179 ## <desc>
 180 ##      <p>
 181 ##      Allow a home directory for which the
 182 ##      role has read-only access.
 183 ##      </p>
 184 ##      <p>
 185 ##      This does not allow execute access.
 186 ##      </p>
 187 ## </desc>
 188 ## <param name="role">
 189 ##      <summary>
 190 ##      The user role
 191 ##      </summary>
 192 ## </param>
 193 ## <param name="userdomain">
 194 ##      <summary>
 195 ##      The user domain
 196 ##      </summary>
 197 ## </param>
 198 ## <rolebase/>
 199 #
 200 interface(`userdom_ro_home_role',`
 201         gen_require(`
 202                 type user_home_t, user_home_dir_t;
 203         ')
 204
 205         role $1 types { user_home_t user_home_dir_t };
 206
 207         ##############################
 208         #
 209         # Domain access to home dir
 210         #
 211
 212         type_member $2 user_home_dir_t:dir user_home_dir_t;
 213
 214         # read-only home directory
 215         allow $2 user_home_dir_t:dir list_dir_perms;
 216         allow $2 user_home_t:dir list_dir_perms;
 217         allow $2 user_home_t:file entrypoint;
 218         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 219         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 220         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 221         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         files_list_home($2)
 223
 224 ')
 225
 226 #######################################
 227 ## <summary>
 228 ##      Allow a home directory for which the
 229 ##      role has full access.
 230 ## </summary>
 231 ## <desc>
 232 ##      <p>
 233 ##      Allow a home directory for which the
 234 ##      role has full access.
 235 ##      </p>
 236 ##      <p>
 237 ##      This does not allow execute access.
 238 ##      </p>
 239 ## </desc>
 240 ## <param name="role">
 241 ##      <summary>
 242 ##      The user role
 243 ##      </summary>
 244 ## </param>
 245 ## <param name="userdomain">
 246 ##      <summary>
 247 ##      The user domain
 248 ##      </summary>
 249 ## </param>
 250 ## <rolebase/>
 251 #
 252 interface(`userdom_manage_home_role',`
 253         gen_require(`
 254                 type user_home_t, user_home_dir_t;
 255                 attribute user_home_type;
 256         ')
 257
 258         role $1 types { user_home_type user_home_dir_t };
 259
 260         ##############################
 261         #
 262         # Domain access to home dir
 263         #
 264
 265         type_member $2 user_home_dir_t:dir user_home_dir_t;
 266
 267         # full control of the home directory
 268         allow $2 user_home_t:dir mounton;
 269         allow $2 user_home_t:file entrypoint;
 270
 271         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 272         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 273         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 284         files_list_home($2)
 285
 286         # cjp: this should probably be removed:
 287         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 288
 289         tunable_policy(`use_nfs_home_dirs',`
 290                 fs_mount_nfs($2)
 291                 fs_mounton_nfs($2)
 292                 fs_manage_nfs_dirs($2)
 293                 fs_manage_nfs_files($2)
 294                 fs_manage_nfs_symlinks($2)
 295                 fs_manage_nfs_named_sockets($2)
 296                 fs_manage_nfs_named_pipes($2)
 297         ')
 298
 299         tunable_policy(`use_samba_home_dirs',`
 300                 fs_mount_cifs($2)
 301                 fs_mounton_cifs($2)
 302                 fs_manage_cifs_dirs($2)
 303                 fs_manage_cifs_files($2)
 304                 fs_manage_cifs_symlinks($2)
 305                 fs_manage_cifs_named_sockets($2)
 306                 fs_manage_cifs_named_pipes($2)
 307         ')
 308 ')
 309
 310 #######################################
 311 ## <summary>
 312 ##      Manage user temporary files
 313 ## </summary>
 314 ## <param name="role">
 315 ##      <summary>
 316 ##      Role allowed access.
 317 ##      </summary>
 318 ## </param>
 319 ## <param name="domain">
 320 ##      <summary>
 321 ##      Domain allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <rolebase/>
 325 #
 326 interface(`userdom_manage_tmp_role',`
 327         gen_require(`
 328                 attribute user_tmp_type;
 329                 type user_tmp_t;
 330         ')
 331
 332         role $1 types user_tmp_t;
 333
 334         files_poly_member_tmp($2, user_tmp_t)
 335
 336         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 337         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 338         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 339         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 340         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 341         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 342         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 343         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 344         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 345         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 346         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 347 ')
 348
 349 #######################################
 350 ## <summary>
 351 ##      Dontaudit search of user bin dirs.
 352 ## </summary>
 353 ## <param name="domain">
 354 ##      <summary>
 355 ##      Domain to not audit.
 356 ##      </summary>
 357 ## </param>
 358 #
 359 interface(`userdom_dontaudit_search_user_bin_dirs',`
 360         gen_require(`
 361                 type home_bin_t;
 362         ')
 363
 364         dontaudit $1 home_bin_t:dir search_dir_perms;
 365 ')
 366
 367 #######################################
 368 ## <summary>
 369 ##      Execute user bin files.
 370 ## </summary>
 371 ## <param name="domain">
 372 ##      <summary>
 373 ##      Domain allowed access.
 374 ##      </summary>
 375 ## </param>
 376 #
 377 interface(`userdom_exec_user_bin_files',`
 378         gen_require(`
 379                 attribute user_home_type;
 380                 type home_bin_t, user_home_dir_t;
 381         ')
 382
 383         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 384         files_search_home($1)
 385 ')
 386
 387 #######################################
 388 ## <summary>
 389 ##      The execute access user temporary files.
 390 ## </summary>
 391 ## <param name="domain">
 392 ##      <summary>
 393 ##      Domain allowed access.
 394 ##      </summary>
 395 ## </param>
 396 ## <rolebase/>
 397 #
 398 interface(`userdom_exec_user_tmp_files',`
 399         gen_require(`
 400                 type user_tmp_t;
 401         ')
 402
 403         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 404         dontaudit $1 user_tmp_t:sock_file execute;
 405         files_search_tmp($1)
 406 ')
 407
 408 #######################################
 409 ## <summary>
 410 ##      Role access for the user tmpfs type
 411 ##      that the user has full access.
 412 ## </summary>
 413 ## <desc>
 414 ##      <p>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ##      </p>
 418 ##      <p>
 419 ##      This does not allow execute access.
 420 ##      </p>
 421 ## </desc>
 422 ## <param name="role">
 423 ##      <summary>
 424 ##      Role allowed access.
 425 ##      </summary>
 426 ## </param>
 427 ## <param name="domain">
 428 ##      <summary>
 429 ##      Domain allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <rolecap/>
 433 #
 434 interface(`userdom_manage_tmpfs_role',`
 435         gen_require(`
 436                 attribute user_tmpfs_type;
 437                 type user_tmpfs_t;
 438         ')
 439
 440         role $1 types user_tmpfs_t;
 441
 442         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 444         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 448         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 453 ')
 454
 455 #######################################
 456 ## <summary>
 457 ##      The interface allowing the user basic
 458 ##      network permissions
 459 ## </summary>
 460 ## <param name="userdomain">
 461 ##      <summary>
 462 ##      The user domain
 463 ##      </summary>
 464 ## </param>
 465 ## <rolebase/>
 466 #
 467 interface(`userdom_basic_networking',`
 468
 469         allow $1 self:tcp_socket create_stream_socket_perms;
 470         allow $1 self:udp_socket create_socket_perms;
 471
 472         corenet_all_recvfrom_unlabeled($1)
 473         corenet_all_recvfrom_netlabel($1)
 474         corenet_tcp_sendrecv_generic_if($1)
 475         corenet_udp_sendrecv_generic_if($1)
 476         corenet_tcp_sendrecv_generic_node($1)
 477         corenet_udp_sendrecv_generic_node($1)
 478         corenet_tcp_sendrecv_all_ports($1)
 479         corenet_udp_sendrecv_all_ports($1)
 480         corenet_tcp_connect_all_ports($1)
 481         corenet_sendrecv_all_client_packets($1)
 482
 483         optional_policy(`
 484                 init_tcp_recvfrom_all_daemons($1)
 485                 init_udp_recvfrom_all_daemons($1)
 486         ')
 487
 488         optional_policy(`
 489                 ipsec_match_default_spd($1)
 490         ')
 491
 492 ')
 493
 494 #######################################
 495 ## <summary>
 496 ##      The template for creating a user xwindows client.  (Deprecated)
 497 ## </summary>
 498 ## <param name="userdomain_prefix">
 499 ##      <summary>
 500 ##      The prefix of the user domain (e.g., user
 501 ##      is the prefix for user_t).
 502 ##      </summary>
 503 ## </param>
 504 ## <rolebase/>
 505 #
 506 template(`userdom_xwindows_client_template',`
 507         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 508         gen_require(`
 509                 type $1_t, user_tmpfs_t;
 510         ')
 511
 512         dev_rw_xserver_misc($1_t)
 513         dev_rw_power_management($1_t)
 514         dev_read_input($1_t)
 515         dev_read_misc($1_t)
 516         dev_write_misc($1_t)
 517         # open office is looking for the following
 518         dev_getattr_agp_dev($1_t)
 519         dev_dontaudit_rw_dri($1_t)
 520         # GNOME checks for usb and other devices:
 521         dev_rw_usbfs($1_t)
 522         dev_rw_generic_usb_dev($1_t)
 523
 524         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 525         xserver_xsession_entry_type($1_t)
 526         xserver_dontaudit_write_log($1_t)
 527         xserver_stream_connect_xdm($1_t)
 528         # certain apps want to read xdm.pid file
 529         xserver_read_xdm_pid($1_t)
 530         # gnome-session creates socket under /tmp/.ICE-unix/
 531         xserver_create_xdm_tmp_sockets($1_t)
 532         # Needed for escd, remove if we get escd policy
 533         xserver_manage_xdm_tmp_files($1_t)
 534 ')
 535
 536 #######################################
 537 ## <summary>
 538 ##      The template for allowing the user to change passwords.
 539 ## </summary>
 540 ## <param name="userdomain_prefix">
 541 ##      <summary>
 542 ##      The prefix of the user domain (e.g., user
 543 ##      is the prefix for user_t).
 544 ##      </summary>
 545 ## </param>
 546 ## <rolebase/>
 547 #
 548 template(`userdom_change_password_template',`
 549         gen_require(`
 550                 type $1_t;
 551                 role $1_r;
 552         ')
 553
 554         optional_policy(`
 555                 usermanage_run_chfn($1_t,$1_r)
 556                 usermanage_run_passwd($1_t,$1_r)
 557         ')
 558 ')
 559
 560 #######################################
 561 ## <summary>
 562 ##      The template containing rules common to unprivileged
 563 ##      users and administrative users.
 564 ## </summary>
 565 ## <desc>
 566 ##      <p>
 567 ##      This template creates a user domain, types, and
 568 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 569 ##      </p>
 570 ## </desc>
 571 ## <param name="userdomain_prefix">
 572 ##      <summary>
 573 ##      The prefix of the user domain (e.g., user
 574 ##      is the prefix for user_t).
 575 ##      </summary>
 576 ## </param>
 577 #
 578 template(`userdom_common_user_template',`
 579         gen_require(`
 580                 attribute unpriv_userdomain;
 581         ')
 582
 583         userdom_basic_networking($1_usertype)
 584
 585         ##############################
 586         #
 587         # User domain Local policy
 588         #
 589
 590         # evolution and gnome-session try to create a netlink socket
 591         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 592         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 593         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 594         allow $1_t self:socket create_socket_perms;
 595
 596         allow $1_usertype unpriv_userdomain:fd use;
 597
 598         kernel_read_system_state($1_usertype)
 599         kernel_read_network_state($1_usertype)
 600         kernel_read_software_raid_state($1_usertype)
 601         kernel_read_net_sysctls($1_usertype)
 602         # Very permissive allowing every domain to see every type:
 603         kernel_get_sysvipc_info($1_usertype)
 604         # Find CDROM devices:
 605         kernel_read_device_sysctls($1_usertype)
 606         kernel_request_load_module($1_usertype)
 607
 608         corenet_udp_bind_generic_node($1_usertype)
 609         corenet_udp_bind_generic_port($1_usertype)
 610
 611         dev_read_rand($1_usertype)
 612         dev_write_sound($1_usertype)
 613         dev_read_sound($1_usertype)
 614         dev_read_sound_mixer($1_usertype)
 615         dev_write_sound_mixer($1_usertype)
 616
 617         files_exec_etc_files($1_usertype)
 618         files_search_locks($1_usertype)
 619         # Check to see if cdrom is mounted
 620         files_search_mnt($1_usertype)
 621         # cjp: perhaps should cut back on file reads:
 622         files_read_var_files($1_usertype)
 623         files_read_var_symlinks($1_usertype)
 624         files_read_generic_spool($1_usertype)
 625         files_read_var_lib_files($1_usertype)
 626         # Stat lost+found.
 627         files_getattr_lost_found_dirs($1_usertype)
 628         files_read_config_files($1_usertype)
 629         fs_read_noxattr_fs_files($1_usertype)
 630         fs_read_noxattr_fs_symlinks($1_usertype)
 631         fs_rw_cgroup_files($1_usertype)
 632
 633         application_getattr_socket($1_usertype)
 634
 635         logging_send_syslog_msg($1_usertype)
 636         logging_send_audit_msgs($1_usertype)
 637         selinux_get_enforce_mode($1_usertype)
 638
 639         # cjp: some of this probably can be removed
 640         selinux_get_fs_mount($1_usertype)
 641         selinux_validate_context($1_usertype)
 642         selinux_compute_access_vector($1_usertype)
 643         selinux_compute_create_context($1_usertype)
 644         selinux_compute_relabel_context($1_usertype)
 645         selinux_compute_user_contexts($1_usertype)
 646
 647         # for eject
 648         storage_getattr_fixed_disk_dev($1_usertype)
 649
 650         auth_read_login_records($1_usertype)
 651         auth_run_pam($1_t,$1_r)
 652         auth_run_utempter($1_t,$1_r)
 653
 654         init_read_utmp($1_usertype)
 655
 656         seutil_read_file_contexts($1_usertype)
 657         seutil_read_default_contexts($1_usertype)
 658         seutil_run_newrole($1_t,$1_r)
 659         seutil_exec_checkpolicy($1_t)
 660         seutil_exec_setfiles($1_usertype)
 661         # for when the network connection is killed
 662         # this is needed when a login role can change
 663         # to this one.
 664         seutil_dontaudit_signal_newrole($1_t)
 665
 666         tunable_policy(`user_direct_mouse',`
 667                 dev_read_mouse($1_usertype)
 668         ')
 669
 670         tunable_policy(`user_ttyfile_stat',`
 671                 term_getattr_all_ttys($1_t)
 672         ')
 673
 674         optional_policy(`
 675                 alsa_read_rw_config($1_usertype)
 676                 alsa_manage_home_files($1_t)
 677                 alsa_relabel_home_files($1_t)
 678                 alsa_filetrans_named_content($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 chrome_role($1_r, $1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 colord_read_lib_files($1_usertype)
 696         ')
 697
 698         optional_policy(`
 699                 dbus_system_bus_client($1_usertype)
 700
 701                 allow $1_usertype $1_usertype:dbus  send_msg;
 702
 703                 optional_policy(`
 704                         avahi_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         policykit_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         bluetooth_dbus_chat($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         consolekit_dbus_chat($1_usertype)
 717                         consolekit_read_log($1_usertype)
 718                 ')
 719
 720                 optional_policy(`
 721                         devicekit_dbus_chat($1_usertype)
 722                         devicekit_dbus_chat_power($1_usertype)
 723                         devicekit_dbus_chat_disk($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         evolution_dbus_chat($1_usertype)
 728                         evolution_alarm_dbus_chat($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         gnome_dbus_chat_gconfdefault($1_usertype)
 733                 ')
 734
 735                 optional_policy(`
 736                         hal_dbus_chat($1_usertype)
 737                 ')
 738
 739                 optional_policy(`
 740                         kde_dbus_chat_backlighthelper($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         modemmanager_dbus_chat($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         networkmanager_dbus_chat($1_usertype)
 749                         networkmanager_read_lib_files($1_usertype)
 750                 ')
 751
 752                 optional_policy(`
 753                         vpn_dbus_chat($1_usertype)
 754                 ')
 755         ')
 756
 757         optional_policy(`
 758                 git_session_role($1_r, $1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inetd_use_fds($1_usertype)
 763                 inetd_rw_tcp_sockets($1_usertype)
 764         ')
 765
 766         optional_policy(`
 767                 inn_read_config($1_usertype)
 768                 inn_read_news_lib($1_usertype)
 769                 inn_read_news_spool($1_usertype)
 770         ')
 771
 772         optional_policy(`
 773                 lircd_stream_connect($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 locate_read_lib_files($1_usertype)
 778         ')
 779
 780         # for running depmod as part of the kernel packaging process
 781         optional_policy(`
 782                 modutils_read_module_config($1_usertype)
 783         ')
 784
 785         optional_policy(`
 786                 mta_rw_spool($1_usertype)
 787                 mta_manage_queue($1_usertype)
 788                 mta_filetrans_home_content($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 nsplugin_role($1_r, $1_usertype)
 793         ')
 794
 795         optional_policy(`
 796                 tunable_policy(`allow_user_mysql_connect',`
 797                         mysql_stream_connect($1_t)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 oident_manage_user_content($1_t)
 803                 oident_relabel_user_content($1_t)
 804         ')
 805
 806         optional_policy(`
 807                 # to allow monitoring of pcmcia status
 808                 pcmcia_read_pid($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 pcscd_read_pub_files($1_usertype)
 813                 pcscd_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 tunable_policy(`allow_user_postgresql_connect',`
 818                         postgresql_stream_connect($1_usertype)
 819                         postgresql_tcp_connect($1_usertype)
 820                 ')
 821         ')
 822
 823         optional_policy(`
 824                 resmgr_stream_connect($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpc_dontaudit_getattr_exports($1_usertype)
 829                 rpc_manage_nfs_rw_content($1_usertype)
 830         ')
 831
 832         optional_policy(`
 833                 rpcbind_stream_connect($1_usertype)
 834         ')
 835
 836         optional_policy(`
 837                 samba_stream_connect_winbind($1_usertype)
 838         ')
 839
 840         optional_policy(`
 841                 sandbox_transition($1_usertype, $1_r)
 842         ')
 843
 844         optional_policy(`
 845                 seunshare_role_template($1, $1_r, $1_t)
 846         ')
 847
 848         optional_policy(`
 849                 slrnpull_search_spool($1_usertype)
 850         ')
 851
 852 ')
 853
 854 #######################################
 855 ## <summary>
 856 ##      The template for creating a login user.
 857 ## </summary>
 858 ## <desc>
 859 ##      <p>
 860 ##      This template creates a user domain, types, and
 861 ##      rules for the user's tty, pty, home directories,
 862 ##      tmp, and tmpfs files.
 863 ##      </p>
 864 ## </desc>
 865 ## <param name="userdomain_prefix">
 866 ##      <summary>
 867 ##      The prefix of the user domain (e.g., user
 868 ##      is the prefix for user_t).
 869 ##      </summary>
 870 ## </param>
 871 #
 872 template(`userdom_login_user_template', `
 873         gen_require(`
 874                 class context contains;
 875         ')
 876
 877         userdom_base_user_template($1)
 878
 879         userdom_manage_home_role($1_r, $1_usertype)
 880
 881         userdom_manage_tmp_role($1_r, $1_usertype)
 882         userdom_manage_tmpfs_role($1_r, $1_usertype)
 883
 884         ifelse(`$1',`unconfined',`',`
 885                 gen_tunable(allow_$1_exec_content, true)
 886
 887                 tunable_policy(`allow_$1_exec_content',`
 888                         userdom_exec_user_tmp_files($1_usertype)
 889                         userdom_exec_user_home_content_files($1_usertype)
 890                 ')
 891                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 892                         fs_exec_nfs_files($1_usertype)
 893                 ')
 894
 895                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 896                         fs_exec_cifs_files($1_usertype)
 897                 ')
 898         ')
 899
 900         userdom_change_password_template($1)
 901
 902         ##############################
 903         #
 904         # User domain Local policy
 905         #
 906
 907         allow $1_t self:capability { setgid chown fowner };
 908         dontaudit $1_t self:capability { sys_nice fsetid };
 909
 910         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 911         dontaudit $1_t self:process setrlimit;
 912         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 913
 914         allow $1_t self:context contains;
 915
 916         kernel_dontaudit_read_system_state($1_usertype)
 917         kernel_dontaudit_list_all_proc($1_usertype)
 918
 919         dev_read_sysfs($1_usertype)
 920         dev_read_urand($1_usertype)
 921
 922         domain_use_interactive_fds($1_usertype)
 923         # Command completion can fire hundreds of denials
 924         domain_dontaudit_exec_all_entry_files($1_usertype)
 925
 926         files_dontaudit_list_default($1_usertype)
 927         files_dontaudit_read_default_files($1_usertype)
 928         # Stat lost+found.
 929         files_getattr_lost_found_dirs($1_usertype)
 930
 931         fs_get_all_fs_quotas($1_usertype)
 932         fs_getattr_all_fs($1_usertype)
 933         fs_search_all($1_usertype)
 934         fs_list_inotifyfs($1_usertype)
 935         fs_rw_anon_inodefs_files($1_usertype)
 936
 937         auth_dontaudit_write_login_records($1_t)
 938         auth_rw_cache($1_t)
 939
 940         application_exec_all($1_t)
 941         # The library functions always try to open read-write first,
 942         # then fall back to read-only if it fails.
 943         init_dontaudit_rw_utmp($1_t)
 944
 945         # Stop warnings about access to /dev/console
 946         init_dontaudit_use_fds($1_usertype)
 947         init_dontaudit_use_script_fds($1_usertype)
 948
 949         libs_exec_lib_files($1_usertype)
 950
 951         logging_dontaudit_getattr_all_logs($1_usertype)
 952
 953         # for running TeX programs
 954         miscfiles_read_tetex_data($1_usertype)
 955         miscfiles_exec_tetex_data($1_usertype)
 956
 957         seutil_read_config($1_usertype)
 958
 959         optional_policy(`
 960                 cups_read_config($1_usertype)
 961                 cups_stream_connect($1_usertype)
 962                 cups_stream_connect_ptal($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 kerberos_use($1_usertype)
 967                 kerberos_filetrans_home_content($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 mta_dontaudit_read_spool_symlinks($1_usertype)
 972         ')
 973
 974         optional_policy(`
 975                 quota_dontaudit_getattr_db($1_usertype)
 976         ')
 977
 978         optional_policy(`
 979                 rpm_read_db($1_usertype)
 980                 rpm_dontaudit_manage_db($1_usertype)
 981                 rpm_read_cache($1_usertype)
 982         ')
 983
 984         optional_policy(`
 985                 oddjob_run_mkhomedir($1_t, $1_r)
 986         ')
 987 ')
 988
 989 #######################################
 990 ## <summary>
 991 ##      The template for creating a unprivileged login user.
 992 ## </summary>
 993 ## <desc>
 994 ##      <p>
 995 ##      This template creates a user domain, types, and
 996 ##      rules for the user's tty, pty, home directories,
 997 ##      tmp, and tmpfs files.
 998 ##      </p>
 999 ## </desc>
1000 ## <param name="userdomain_prefix">
1001 ##      <summary>
1002 ##      The prefix of the user domain (e.g., user
1003 ##      is the prefix for user_t).
1004 ##      </summary>
1005 ## </param>
1006 #
1007 template(`userdom_restricted_user_template',`
1008         gen_require(`
1009                 attribute unpriv_userdomain;
1010         ')
1011
1012         userdom_login_user_template($1)
1013
1014         typeattribute $1_t unpriv_userdomain;
1015         domain_interactive_fd($1_t)
1016
1017         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1018         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1019
1020         ##############################
1021         #
1022         # Local policy
1023         #
1024
1025         optional_policy(`
1026                 loadkeys_run($1_t, $1_r)
1027         ')
1028 ')
1029
1030 #######################################
1031 ## <summary>
1032 ##      The template for creating a unprivileged xwindows login user.
1033 ## </summary>
1034 ## <desc>
1035 ##      <p>
1036 ##      The template for creating a unprivileged xwindows login user.
1037 ##      </p>
1038 ##      <p>
1039 ##      This template creates a user domain, types, and
1040 ##      rules for the user's tty, pty, home directories,
1041 ##      tmp, and tmpfs files.
1042 ##      </p>
1043 ## </desc>
1044 ## <param name="userdomain_prefix">
1045 ##      <summary>
1046 ##      The prefix of the user domain (e.g., user
1047 ##      is the prefix for user_t).
1048 ##      </summary>
1049 ## </param>
1050 #
1051 template(`userdom_restricted_xwindows_user_template',`
1052
1053         userdom_restricted_user_template($1)
1054
1055         ##############################
1056         #
1057         # Local policy
1058         #
1059
1060         auth_role($1_r, $1_t)
1061         auth_search_pam_console_data($1_usertype)
1062         auth_dontaudit_read_login_records($1_usertype)
1063
1064         dev_read_sound($1_usertype)
1065         dev_write_sound($1_usertype)
1066         # gnome keyring wants to read this.
1067         dev_dontaudit_read_rand($1_usertype)
1068         # temporarily allow since openoffice requires this
1069         dev_read_rand($1_usertype)
1070
1071         dev_read_video_dev($1_usertype)
1072         dev_write_video_dev($1_usertype)
1073         dev_rw_wireless($1_usertype)
1074
1075         libs_dontaudit_setattr_lib_files($1_usertype)
1076
1077         tunable_policy(`user_rw_noexattrfile',`
1078                 dev_rw_usbfs($1_t)
1079                 dev_rw_generic_usb_dev($1_usertype)
1080
1081                 fs_manage_noxattr_fs_files($1_usertype)
1082                 fs_manage_noxattr_fs_dirs($1_usertype)
1083                 fs_manage_dos_dirs($1_usertype)
1084                 fs_manage_dos_files($1_usertype)
1085                 storage_raw_read_removable_device($1_usertype)
1086                 storage_raw_write_removable_device($1_usertype)
1087         ')
1088
1089         logging_send_syslog_msg($1_usertype)
1090         logging_dontaudit_send_audit_msgs($1_t)
1091
1092         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1093         logging_send_audit_msgs($1_t)
1094         selinux_get_enforce_mode($1_t)
1095         seutil_exec_restorecond($1_t)
1096         seutil_read_file_contexts($1_t)
1097         seutil_read_default_contexts($1_t)
1098
1099         xserver_restricted_role($1_r, $1_t)
1100
1101         optional_policy(`
1102                 alsa_read_rw_config($1_usertype)
1103         ')
1104
1105          # cjp: needed by KDE apps
1106          # bug: #682499
1107          optional_policy(`
1108                 gnome_read_usr_config($1_usertype)
1109                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1110                 # cjp: telepathy F15 bugs
1111                 telepathy_role($1_r, $1_t, $1)
1112         ')
1113
1114         optional_policy(`
1115                 dbus_role_template($1, $1_r, $1_usertype)
1116                 dbus_system_bus_client($1_usertype)
1117                 allow $1_usertype $1_usertype:dbus send_msg;
1118
1119                 optional_policy(`
1120                         abrt_dbus_chat($1_usertype)
1121                         abrt_run_helper($1_usertype, $1_r)
1122                 ')
1123
1124                 optional_policy(`
1125                         consolekit_dontaudit_read_log($1_usertype)
1126                         consolekit_dbus_chat($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         cups_dbus_chat($1_usertype)
1131                         cups_dbus_chat_config($1_usertype)
1132                 ')
1133
1134                 optional_policy(`
1135                         devicekit_dbus_chat($1_usertype)
1136                         devicekit_dbus_chat_disk($1_usertype)
1137                         devicekit_dbus_chat_power($1_usertype)
1138                 ')
1139
1140                 optional_policy(`
1141                         fprintd_dbus_chat($1_t)
1142                 ')
1143         ')
1144
1145         optional_policy(`
1146                 openoffice_role_template($1, $1_r, $1_usertype)
1147         ')
1148
1149         optional_policy(`
1150                 policykit_role($1_r, $1_usertype)
1151         ')
1152
1153         optional_policy(`
1154                 pulseaudio_role($1_r, $1_usertype)
1155                 pulseaudio_filetrans_admin_home_content($1_usertype)
1156                 pulseaudio_filetrans_home_content($1_usertype)
1157         ')
1158
1159         optional_policy(`
1160                 rtkit_scheduled($1_usertype)
1161         ')
1162
1163         optional_policy(`
1164                 setroubleshoot_dontaudit_stream_connect($1_t)
1165         ')
1166
1167         optional_policy(`
1168                 udev_read_db($1_usertype)
1169         ')
1170
1171         optional_policy(`
1172                 wm_role_template($1, $1_r, $1_t)
1173         ')
1174 ')
1175
1176 #######################################
1177 ## <summary>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ## </summary>
1181 ## <desc>
1182 ##      <p>
1183 ##      The template for creating a unprivileged user roughly
1184 ##      equivalent to a regular linux user.
1185 ##      </p>
1186 ##      <p>
1187 ##      This template creates a user domain, types, and
1188 ##      rules for the user's tty, pty, home directories,
1189 ##      tmp, and tmpfs files.
1190 ##      </p>
1191 ## </desc>
1192 ## <param name="userdomain_prefix">
1193 ##      <summary>
1194 ##      The prefix of the user domain (e.g., user
1195 ##      is the prefix for user_t).
1196 ##      </summary>
1197 ## </param>
1198 #
1199 template(`userdom_unpriv_user_template', `
1200
1201         ##############################
1202         #
1203         # Declarations
1204         #
1205
1206         # Inherit rules for ordinary users.
1207         userdom_restricted_xwindows_user_template($1)
1208         userdom_common_user_template($1)
1209
1210         ##############################
1211         #
1212         # Local policy
1213         #
1214
1215         # port access is audited even if dac would not have allowed it, so dontaudit it here
1216 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1217         # Need the following rule to allow users to run vpnc
1218         corenet_tcp_bind_xserver_port($1_t)
1219         corenet_tcp_bind_generic_node($1_usertype)
1220
1221         storage_rw_fuse($1_t)
1222
1223         files_exec_usr_files($1_t)
1224    # cjp: why?
1225         files_read_kernel_symbol_table($1_t)
1226
1227         ifndef(`enable_mls',`
1228                 fs_exec_noxattr($1_t)
1229
1230                 tunable_policy(`user_rw_noexattrfile',`
1231                         fs_manage_noxattr_fs_files($1_t)
1232                         fs_manage_noxattr_fs_dirs($1_t)
1233                         # Write floppies
1234                         storage_raw_read_removable_device($1_t)
1235                         storage_raw_write_removable_device($1_t)
1236                 ',`
1237                         storage_raw_read_removable_device($1_t)
1238                 ')
1239         ')
1240
1241         miscfiles_read_hwdata($1_usertype)
1242
1243         # Allow users to run TCP servers (bind to ports and accept connection from
1244         # the same domain and outside users) disabling this forces FTP passive mode
1245         # and may change other protocols
1246
1247         tunable_policy(`user_share_music',`
1248                 corenet_tcp_bind_daap_port($1_usertype)
1249         ')
1250
1251         tunable_policy(`user_tcp_server',`
1252                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1253         ')
1254
1255         tunable_policy(`user_setrlimit',`
1256                 allow $1_usertype self:process setrlimit;
1257         ')
1258
1259         optional_policy(`
1260                 cdrecord_role($1_r, $1_t)
1261         ')
1262
1263         optional_policy(`
1264                 cron_role($1_r, $1_t)
1265         ')
1266
1267         optional_policy(`
1268                 games_rw_data($1_usertype)
1269         ')
1270
1271         optional_policy(`
1272                 gpg_role($1_r, $1_usertype)
1273         ')
1274
1275         optional_policy(`
1276                 gnomeclock_dbus_chat($1_t)
1277         ')
1278
1279         optional_policy(`
1280                 gpm_stream_connect($1_usertype)
1281         ')
1282
1283         optional_policy(`
1284                 execmem_role_template($1, $1_r, $1_t)
1285         ')
1286
1287         optional_policy(`
1288                 java_role_template($1, $1_r, $1_t)
1289         ')
1290
1291         optional_policy(`
1292                 mono_role_template($1, $1_r, $1_t)
1293         ')
1294
1295         optional_policy(`
1296                 mount_run_fusermount($1_t, $1_r)
1297                 mount_read_pid_files($1_t)
1298         ')
1299
1300         optional_policy(`
1301                 wine_role_template($1, $1_r, $1_t)
1302         ')
1303
1304         optional_policy(`
1305                 postfix_run_postdrop($1_t, $1_r)
1306                 postfix_search_spool($1_t)
1307         ')
1308
1309         # Run pppd in pppd_t by default for user
1310         optional_policy(`
1311                 ppp_run_cond($1_t, $1_r)
1312         ')
1313
1314         optional_policy(`
1315                 vdagent_getattr_log($1_t)
1316                 vdagent_getattr_exec($1_t)
1317                 vdagent_stream_connect($1_t)
1318         ')
1319 ')
1320
1321 #######################################
1322 ## <summary>
1323 ##      The template for creating an administrative user.
1324 ## </summary>
1325 ## <desc>
1326 ##      <p>
1327 ##      This template creates a user domain, types, and
1328 ##      rules for the user's tty, pty, home directories,
1329 ##      tmp, and tmpfs files.
1330 ##      </p>
1331 ##      <p>
1332 ##      The privileges given to administrative users are:
1333 ##      <ul>
1334 ##              <li>Raw disk access</li>
1335 ##              <li>Set all sysctls</li>
1336 ##              <li>All kernel ring buffer controls</li>
1337 ##              <li>Create, read, write, and delete all files but shadow</li>
1338 ##              <li>Manage source and binary format SELinux policy</li>
1339 ##              <li>Run insmod</li>
1340 ##      </ul>
1341 ##      </p>
1342 ## </desc>
1343 ## <param name="userdomain_prefix">
1344 ##      <summary>
1345 ##      The prefix of the user domain (e.g., sysadm
1346 ##      is the prefix for sysadm_t).
1347 ##      </summary>
1348 ## </param>
1349 #
1350 template(`userdom_admin_user_template',`
1351         gen_require(`
1352                 attribute admindomain;
1353                 class passwd { passwd chfn chsh rootok crontab };
1354         ')
1355
1356         ##############################
1357         #
1358         # Declarations
1359         #
1360
1361         # Inherit rules for ordinary users.
1362         userdom_login_user_template($1)
1363         userdom_common_user_template($1)
1364
1365         domain_obj_id_change_exemption($1_t)
1366         role system_r types $1_t;
1367
1368         typeattribute $1_t admindomain;
1369
1370         ifdef(`direct_sysadm_daemon',`
1371                 domain_system_change_exemption($1_t)
1372         ')
1373
1374         ##############################
1375         #
1376         # $1_t local policy
1377         #
1378
1379         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1380         allow $1_t self:capability2 syslog;
1381         allow $1_t self:process { setexec setfscreate };
1382         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1383         allow $1_t self:tun_socket create;
1384         # Set password information for other users.
1385         allow $1_t self:passwd { passwd chfn chsh };
1386         # Skip authentication when pam_rootok is specified.
1387         allow $1_t self:passwd rootok;
1388
1389         # Manipulate other users crontab.
1390         allow $1_t self:passwd crontab;
1391
1392         kernel_read_software_raid_state($1_t)
1393         kernel_getattr_core_if($1_t)
1394         kernel_getattr_message_if($1_t)
1395         kernel_change_ring_buffer_level($1_t)
1396         kernel_clear_ring_buffer($1_t)
1397         kernel_read_ring_buffer($1_t)
1398         kernel_get_sysvipc_info($1_t)
1399         kernel_rw_all_sysctls($1_t)
1400         # signal unlabeled processes:
1401         kernel_kill_unlabeled($1_t)
1402         kernel_signal_unlabeled($1_t)
1403         kernel_sigstop_unlabeled($1_t)
1404         kernel_signull_unlabeled($1_t)
1405         kernel_sigchld_unlabeled($1_t)
1406         kernel_signal($1_t)
1407
1408         corenet_tcp_bind_generic_port($1_t)
1409         # allow setting up tunnels
1410         corenet_rw_tun_tap_dev($1_t)
1411
1412         dev_getattr_generic_blk_files($1_t)
1413         dev_getattr_generic_chr_files($1_t)
1414         # for lsof
1415         dev_getattr_mtrr_dev($1_t)
1416         # Allow MAKEDEV to work
1417         dev_create_all_blk_files($1_t)
1418         dev_create_all_chr_files($1_t)
1419         dev_delete_all_blk_files($1_t)
1420         dev_delete_all_chr_files($1_t)
1421         dev_rename_all_blk_files($1_t)
1422         dev_rename_all_chr_files($1_t)
1423         dev_create_generic_symlinks($1_t)
1424         dev_rw_generic_usb_dev($1_t)
1425         dev_rw_usbfs($1_t)
1426
1427         domain_setpriority_all_domains($1_t)
1428         domain_read_all_domains_state($1_t)
1429         domain_getattr_all_domains($1_t)
1430         domain_getcap_all_domains($1_t)
1431         domain_dontaudit_ptrace_all_domains($1_t)
1432         # signal all domains:
1433         domain_kill_all_domains($1_t)
1434         domain_signal_all_domains($1_t)
1435         domain_signull_all_domains($1_t)
1436         domain_sigstop_all_domains($1_t)
1437         domain_sigstop_all_domains($1_t)
1438         domain_sigchld_all_domains($1_t)
1439         # for lsof
1440         domain_getattr_all_sockets($1_t)
1441         domain_dontaudit_getattr_all_sockets($1_t)
1442
1443         files_exec_usr_src_files($1_t)
1444
1445         fs_getattr_all_fs($1_t)
1446         fs_getattr_all_files($1_t)
1447         fs_list_all($1_t)
1448         fs_set_all_quotas($1_t)
1449         fs_exec_noxattr($1_t)
1450
1451         storage_raw_read_removable_device($1_t)
1452         storage_raw_write_removable_device($1_t)
1453         storage_dontaudit_read_fixed_disk($1_t)
1454
1455         term_use_all_inherited_terms($1_t)
1456         term_use_unallocated_ttys($1_t)
1457
1458         auth_getattr_shadow($1_t)
1459         # Manage almost all files
1460         files_manage_non_security_dirs($1_t)
1461         files_manage_non_security_files($1_t)
1462         # Relabel almost all files
1463         files_relabel_non_security_files($1_t)
1464
1465         init_telinit($1_t)
1466
1467         logging_send_syslog_msg($1_t)
1468
1469         optional_policy(`
1470                 modutils_domtrans_insmod($1_t)
1471                 modutils_domtrans_depmod($1_t)
1472         ')
1473
1474         # The following rule is temporary until such time that a complete
1475         # policy management infrastructure is in place so that an administrator
1476         # cannot directly manipulate policy files with arbitrary programs.
1477         seutil_manage_src_policy($1_t)
1478         # Violates the goal of limiting write access to checkpolicy.
1479         # But presently necessary for installing the file_contexts file.
1480         seutil_manage_bin_policy($1_t)
1481
1482         systemd_config_all_services($1_t)
1483
1484         userdom_manage_user_home_content_dirs($1_t)
1485         userdom_manage_user_home_content_files($1_t)
1486         userdom_manage_user_home_content_symlinks($1_t)
1487         userdom_manage_user_home_content_pipes($1_t)
1488         userdom_manage_user_home_content_sockets($1_t)
1489         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1490
1491         tunable_policy(`user_rw_noexattrfile',`
1492                 fs_manage_noxattr_fs_files($1_t)
1493                 fs_manage_noxattr_fs_dirs($1_t)
1494         ',`
1495                 fs_read_noxattr_fs_files($1_t)
1496         ')
1497
1498         optional_policy(`
1499                 postgresql_unconfined($1_t)
1500         ')
1501
1502         optional_policy(`
1503                 userhelper_exec($1_t)
1504         ')
1505 ')
1506
1507 ########################################
1508 ## <summary>
1509 ##      Allow user to run as a secadm
1510 ## </summary>
1511 ## <desc>
1512 ##      <p>
1513 ##      Create objects in a user home directory
1514 ##      with an automatic type transition to
1515 ##      a specified private type.
1516 ##      </p>
1517 ##      <p>
1518 ##      This is a templated interface, and should only
1519 ##      be called from a per-userdomain template.
1520 ##      </p>
1521 ## </desc>
1522 ## <param name="domain">
1523 ##      <summary>
1524 ##      Domain allowed access.
1525 ##      </summary>
1526 ## </param>
1527 ## <param name="role">
1528 ##      <summary>
1529 ##      The role  of the object to create.
1530 ##      </summary>
1531 ## </param>
1532 #
1533 template(`userdom_security_admin_template',`
1534         allow $1 self:capability { dac_read_search dac_override };
1535
1536         corecmd_exec_shell($1)
1537
1538         domain_obj_id_change_exemption($1)
1539
1540         dev_relabel_all_dev_nodes($1)
1541
1542         files_create_boot_flag($1)
1543         files_create_default_dir($1)
1544         files_root_filetrans_default($1, dir)
1545
1546         # Necessary for managing /boot/efi
1547         fs_manage_dos_files($1)
1548
1549         mls_process_read_up($1)
1550         mls_file_read_all_levels($1)
1551         mls_file_upgrade($1)
1552         mls_file_downgrade($1)
1553
1554         selinux_set_enforce_mode($1)
1555         selinux_set_all_booleans($1)
1556         selinux_set_parameters($1)
1557         selinux_read_policy($1)
1558
1559         files_relabel_all_files($1)
1560         auth_relabel_shadow($1)
1561
1562         init_exec($1)
1563
1564         logging_send_syslog_msg($1)
1565         logging_read_audit_log($1)
1566         logging_read_generic_logs($1)
1567         logging_read_audit_config($1)
1568
1569         seutil_manage_bin_policy($1)
1570         seutil_manage_default_contexts($1)
1571         seutil_manage_file_contexts($1)
1572         seutil_manage_module_store($1)
1573         seutil_manage_config($1)
1574         seutil_run_checkpolicy($1,$2)
1575         seutil_run_loadpolicy($1,$2)
1576         seutil_run_semanage($1,$2)
1577         seutil_run_setsebool($1,$2)
1578         seutil_run_setfiles($1, $2)
1579
1580         seutil_manage_bin_policy($1)
1581     seutil_manage_default_contexts($1)
1582     seutil_manage_file_contexts($1)
1583     seutil_manage_module_store($1)
1584     seutil_manage_config($1)
1585
1586         optional_policy(`
1587                 aide_run($1,$2)
1588         ')
1589
1590         optional_policy(`
1591                 consoletype_exec($1)
1592         ')
1593
1594         optional_policy(`
1595                 dmesg_exec($1)
1596         ')
1597
1598         optional_policy(`
1599                 ipsec_run_setkey($1,$2)
1600         ')
1601
1602         optional_policy(`
1603                 netlabel_run_mgmt($1,$2)
1604         ')
1605
1606         optional_policy(`
1607                 samhain_run($1, $2)
1608         ')
1609 ')
1610
1611 ########################################
1612 ## <summary>
1613 ##      Make the specified type usable in a
1614 ##      user home directory.
1615 ## </summary>
1616 ## <param name="type">
1617 ##      <summary>
1618 ##      Type to be used as a file in the
1619 ##      user home directory.
1620 ##      </summary>
1621 ## </param>
1622 #
1623 interface(`userdom_user_home_content',`
1624         gen_require(`
1625                 type user_home_t;
1626                 attribute user_home_type;
1627         ')
1628
1629         allow $1 user_home_t:filesystem associate;
1630         files_type($1)
1631         ubac_constrained($1)
1632
1633         files_poly_member($1)
1634         typeattribute $1  user_home_type;
1635 ')
1636
1637 ########################################
1638 ## <summary>
1639 ##      Make the specified type usable in a
1640 ##      generic temporary directory.
1641 ## </summary>
1642 ## <param name="type">
1643 ##      <summary>
1644 ##      Type to be used as a file in the
1645 ##      generic temporary directory.
1646 ##      </summary>
1647 ## </param>
1648 #
1649 interface(`userdom_user_tmp_content',`
1650         gen_require(`
1651                 attribute user_tmp_type;
1652         ')
1653
1654         typeattribute $1 user_tmp_type;
1655
1656         files_tmp_file($1)
1657         ubac_constrained($1)
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Make the specified type usable in a
1663 ##      generic tmpfs_t directory.
1664 ## </summary>
1665 ## <param name="type">
1666 ##      <summary>
1667 ##      Type to be used as a file in the
1668 ##      generic temporary directory.
1669 ##      </summary>
1670 ## </param>
1671 #
1672 interface(`userdom_user_tmpfs_content',`
1673         gen_require(`
1674                 attribute user_tmpfs_type;
1675         ')
1676
1677         typeattribute $1 user_tmpfs_type;
1678
1679         files_tmpfs_file($1)
1680         ubac_constrained($1)
1681 ')
1682
1683 ########################################
1684 ## <summary>
1685 ##      Allow domain to attach to TUN devices created by administrative users.
1686 ## </summary>
1687 ## <param name="domain">
1688 ##      <summary>
1689 ##      Domain allowed access.
1690 ##      </summary>
1691 ## </param>
1692 #
1693 interface(`userdom_attach_admin_tun_iface',`
1694         gen_require(`
1695                 attribute admindomain;
1696         ')
1697
1698         allow $1 admindomain:tun_socket relabelfrom;
1699         allow $1 self:tun_socket relabelto;
1700 ')
1701
1702 ########################################
1703 ## <summary>
1704 ##      Set the attributes of a user pty.
1705 ## </summary>
1706 ## <param name="domain">
1707 ##      <summary>
1708 ##      Domain allowed access.
1709 ##      </summary>
1710 ## </param>
1711 #
1712 interface(`userdom_setattr_user_ptys',`
1713         gen_require(`
1714                 type user_devpts_t;
1715         ')
1716
1717         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1718 ')
1719
1720 ########################################
1721 ## <summary>
1722 ##      Create a user pty.
1723 ## </summary>
1724 ## <param name="domain">
1725 ##      <summary>
1726 ##      Domain allowed access.
1727 ##      </summary>
1728 ## </param>
1729 #
1730 interface(`userdom_create_user_pty',`
1731         gen_require(`
1732                 type user_devpts_t;
1733         ')
1734
1735         term_create_pty($1, user_devpts_t)
1736 ')
1737
1738 ########################################
1739 ## <summary>
1740 ##      Get the attributes of user home directories.
1741 ## </summary>
1742 ## <param name="domain">
1743 ##      <summary>
1744 ##      Domain allowed access.
1745 ##      </summary>
1746 ## </param>
1747 #
1748 interface(`userdom_getattr_user_home_dirs',`
1749         gen_require(`
1750                 type user_home_dir_t;
1751         ')
1752
1753         allow $1 user_home_dir_t:dir getattr_dir_perms;
1754         files_search_home($1)
1755 ')
1756
1757 ########################################
1758 ## <summary>
1759 ##      Do not audit attempts to get the attributes of user home directories.
1760 ## </summary>
1761 ## <param name="domain">
1762 ##      <summary>
1763 ##      Domain to not audit.
1764 ##      </summary>
1765 ## </param>
1766 #
1767 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1768         gen_require(`
1769                 type user_home_dir_t;
1770         ')
1771
1772         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1773 ')
1774
1775 ########################################
1776 ## <summary>
1777 ##      Search user home directories.
1778 ## </summary>
1779 ## <param name="domain">
1780 ##      <summary>
1781 ##      Domain allowed access.
1782 ##      </summary>
1783 ## </param>
1784 #
1785 interface(`userdom_search_user_home_dirs',`
1786         gen_require(`
1787                 type user_home_dir_t;
1788         ')
1789
1790         allow $1 user_home_dir_t:dir search_dir_perms;
1791         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1792         files_search_home($1)
1793 ')
1794
1795 ########################################
1796 ## <summary>
1797 ##      Do not audit attempts to search user home directories.
1798 ## </summary>
1799 ## <desc>
1800 ##      <p>
1801 ##      Do not audit attempts to search user home directories.
1802 ##      This will supress SELinux denial messages when the specified
1803 ##      domain is denied the permission to search these directories.
1804 ##      </p>
1805 ## </desc>
1806 ## <param name="domain">
1807 ##      <summary>
1808 ##      Domain to not audit.
1809 ##      </summary>
1810 ## </param>
1811 ## <infoflow type="none"/>
1812 #
1813 interface(`userdom_dontaudit_search_user_home_dirs',`
1814         gen_require(`
1815                 type user_home_dir_t;
1816         ')
1817
1818         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1819 ')
1820
1821 ########################################
1822 ## <summary>
1823 ##      List user home directories.
1824 ## </summary>
1825 ## <param name="domain">
1826 ##      <summary>
1827 ##      Domain allowed access.
1828 ##      </summary>
1829 ## </param>
1830 #
1831 interface(`userdom_list_user_home_dirs',`
1832         gen_require(`
1833                 type user_home_dir_t;
1834         ')
1835
1836         allow $1 user_home_dir_t:dir list_dir_perms;
1837         files_search_home($1)
1838
1839         tunable_policy(`use_nfs_home_dirs',`
1840                 fs_list_nfs($1)
1841         ')
1842
1843         tunable_policy(`use_samba_home_dirs',`
1844                 fs_list_cifs($1)
1845         ')
1846 ')
1847
1848 ########################################
1849 ## <summary>
1850 ##      Do not audit attempts to list user home subdirectories.
1851 ## </summary>
1852 ## <param name="domain">
1853 ##      <summary>
1854 ##      Domain to not audit.
1855 ##      </summary>
1856 ## </param>
1857 #
1858 interface(`userdom_dontaudit_list_user_home_dirs',`
1859         gen_require(`
1860                 type user_home_dir_t;
1861                 type user_home_t;
1862         ')
1863
1864         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1865         dontaudit $1 user_home_t:dir list_dir_perms;
1866 ')
1867
1868 ########################################
1869 ## <summary>
1870 ##      Create user home directories.
1871 ## </summary>
1872 ## <param name="domain">
1873 ##      <summary>
1874 ##      Domain allowed access.
1875 ##      </summary>
1876 ## </param>
1877 #
1878 interface(`userdom_create_user_home_dirs',`
1879         gen_require(`
1880                 type user_home_dir_t;
1881         ')
1882
1883         allow $1 user_home_dir_t:dir create_dir_perms;
1884 ')
1885
1886 ########################################
1887 ## <summary>
1888 ##      Create user home directories.
1889 ## </summary>
1890 ## <param name="domain">
1891 ##      <summary>
1892 ##      Domain allowed access.
1893 ##      </summary>
1894 ## </param>
1895 #
1896 interface(`userdom_manage_user_home_dirs',`
1897         gen_require(`
1898                 type user_home_dir_t;
1899         ')
1900
1901         allow $1 user_home_dir_t:dir manage_dir_perms;
1902 ')
1903
1904 ########################################
1905 ## <summary>
1906 ##      Relabel to user home directories.
1907 ## </summary>
1908 ## <param name="domain">
1909 ##      <summary>
1910 ##      Domain allowed access.
1911 ##      </summary>
1912 ## </param>
1913 #
1914 interface(`userdom_relabelto_user_home_dirs',`
1915         gen_require(`
1916                 type user_home_dir_t;
1917         ')
1918
1919         allow $1 user_home_dir_t:dir relabelto;
1920 ')
1921
1922
1923 ########################################
1924 ## <summary>
1925 ##      Relabel to user home files.
1926 ## </summary>
1927 ## <param name="domain">
1928 ##      <summary>
1929 ##      Domain allowed access.
1930 ##      </summary>
1931 ## </param>
1932 #
1933 interface(`userdom_relabelto_user_home_files',`
1934         gen_require(`
1935                 type user_home_t;
1936         ')
1937
1938         allow $1 user_home_t:file relabelto;
1939 ')
1940 ########################################
1941 ## <summary>
1942 ##      Relabel user home files.
1943 ## </summary>
1944 ## <param name="domain">
1945 ##      <summary>
1946 ##      Domain allowed access.
1947 ##      </summary>
1948 ## </param>
1949 #
1950 interface(`userdom_relabel_user_home_files',`
1951         gen_require(`
1952                 type user_home_t;
1953         ')
1954
1955         allow $1 user_home_t:file relabel_file_perms;
1956 ')
1957
1958 ########################################
1959 ## <summary>
1960 ##      Create directories in the home dir root with
1961 ##      the user home directory type.
1962 ## </summary>
1963 ## <param name="domain">
1964 ##      <summary>
1965 ##      Domain allowed access.
1966 ##      </summary>
1967 ## </param>
1968 #
1969 interface(`userdom_home_filetrans_user_home_dir',`
1970         gen_require(`
1971                 type user_home_dir_t;
1972         ')
1973
1974         files_home_filetrans($1, user_home_dir_t, dir)
1975 ')
1976
1977 ########################################
1978 ## <summary>
1979 ##      Do a domain transition to the specified
1980 ##      domain when executing a program in the
1981 ##      user home directory.
1982 ## </summary>
1983 ## <desc>
1984 ##      <p>
1985 ##      Do a domain transition to the specified
1986 ##      domain when executing a program in the
1987 ##      user home directory.
1988 ##      </p>
1989 ##      <p>
1990 ##      No interprocess communication (signals, pipes,
1991 ##      etc.) is provided by this interface since
1992 ##      the domains are not owned by this module.
1993 ##      </p>
1994 ## </desc>
1995 ## <param name="source_domain">
1996 ##      <summary>
1997 ##      Domain allowed to transition.
1998 ##      </summary>
1999 ## </param>
2000 ## <param name="target_domain">
2001 ##      <summary>
2002 ##      Domain to transition to.
2003 ##      </summary>
2004 ## </param>
2005 #
2006 interface(`userdom_user_home_domtrans',`
2007         gen_require(`
2008                 type user_home_dir_t, user_home_t;
2009         ')
2010
2011         domain_auto_trans($1, user_home_t, $2)
2012         allow $1 user_home_dir_t:dir search_dir_perms;
2013         files_search_home($1)
2014 ')
2015
2016 ########################################
2017 ## <summary>
2018 ##      Do not audit attempts to search user home content directories.
2019 ## </summary>
2020 ## <param name="domain">
2021 ##      <summary>
2022 ##      Domain to not audit.
2023 ##      </summary>
2024 ## </param>
2025 #
2026 interface(`userdom_dontaudit_search_user_home_content',`
2027         gen_require(`
2028                 type user_home_t;
2029         ')
2030
2031         dontaudit $1 user_home_t:dir search_dir_perms;
2032         fs_dontaudit_list_nfs($1)
2033         fs_dontaudit_list_cifs($1)
2034 ')
2035
2036 ########################################
2037 ## <summary>
2038 ##      List contents of users home directory.
2039 ## </summary>
2040 ## <param name="domain">
2041 ##      <summary>
2042 ##      Domain allowed access.
2043 ##      </summary>
2044 ## </param>
2045 #
2046 interface(`userdom_list_user_home_content',`
2047         gen_require(`
2048                 type user_home_dir_t;
2049                 attribute user_home_type;
2050         ')
2051
2052         files_list_home($1)
2053         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2054 ')
2055
2056 ########################################
2057 ## <summary>
2058 ##      Create, read, write, and delete directories
2059 ##      in a user home subdirectory.
2060 ## </summary>
2061 ## <param name="domain">
2062 ##      <summary>
2063 ##      Domain allowed access.
2064 ##      </summary>
2065 ## </param>
2066 #
2067 interface(`userdom_manage_user_home_content_dirs',`
2068         gen_require(`
2069                 type user_home_dir_t, user_home_t;
2070         ')
2071
2072         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2073         files_search_home($1)
2074 ')
2075
2076 ########################################
2077 ## <summary>
2078 ##      Delete directories in a user home subdirectory.
2079 ## </summary>
2080 ## <param name="domain">
2081 ##      <summary>
2082 ##      Domain allowed access.
2083 ##      </summary>
2084 ## </param>
2085 #
2086 interface(`userdom_delete_user_home_content_dirs',`
2087         gen_require(`
2088                 type user_home_t;
2089         ')
2090
2091         allow $1 user_home_t:dir delete_dir_perms;
2092 ')
2093
2094 ########################################
2095 ## <summary>
2096 ##      Delete all directories in a user home subdirectory.
2097 ## </summary>
2098 ## <param name="domain">
2099 ##      <summary>
2100 ##      Domain allowed access.
2101 ##      </summary>
2102 ## </param>
2103 #
2104 interface(`userdom_delete_all_user_home_content_dirs',`
2105         gen_require(`
2106                 attribute user_home_type;
2107         ')
2108
2109         allow $1 user_home_type:dir delete_dir_perms;
2110 ')
2111
2112 ########################################
2113 ## <summary>
2114 ##      Set the attributes of user home files.
2115 ## </summary>
2116 ## <param name="domain">
2117 ##      <summary>
2118 ##      Domain allowed access.
2119 ##      </summary>
2120 ## </param>
2121 ## <rolecap/>
2122 #
2123 interface(`userdom_setattr_user_home_content_files',`
2124         gen_require(`
2125                 type user_home_t;
2126         ')
2127
2128         allow $1 user_home_t:file setattr;
2129 ')
2130
2131 ########################################
2132 ## <summary>
2133 ##      Do not audit attempts to set the
2134 ##      attributes of user home files.
2135 ## </summary>
2136 ## <param name="domain">
2137 ##      <summary>
2138 ##      Domain to not audit.
2139 ##      </summary>
2140 ## </param>
2141 #
2142 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2143         gen_require(`
2144                 type user_home_t;
2145         ')
2146
2147         dontaudit $1 user_home_t:file setattr_file_perms;
2148 ')
2149
2150 ########################################
2151 ## <summary>
2152 ##      Set the attributes of all user home directories.
2153 ## </summary>
2154 ## <param name="domain">
2155 ##      <summary>
2156 ##      Domain allowed access.
2157 ##      </summary>
2158 ## </param>
2159 ## <rolecap/>
2160 #
2161 interface(`userdom_setattr_all_user_home_content_dirs',`
2162         gen_require(`
2163                 attribute user_home_type;
2164         ')
2165
2166         allow $1 user_home_type:dir setattr_dir_perms;
2167 ')
2168
2169 ########################################
2170 ## <summary>
2171 ##      Mmap user home files.
2172 ## </summary>
2173 ## <param name="domain">
2174 ##      <summary>
2175 ##      Domain allowed access.
2176 ##      </summary>
2177 ## </param>
2178 #
2179 interface(`userdom_mmap_user_home_content_files',`
2180         gen_require(`
2181                 type user_home_dir_t, user_home_t;
2182         ')
2183
2184         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2185         files_search_home($1)
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Read user home files.
2191 ## </summary>
2192 ## <param name="domain">
2193 ##      <summary>
2194 ##      Domain allowed access.
2195 ##      </summary>
2196 ## </param>
2197 #
2198 interface(`userdom_read_user_home_content_files',`
2199         gen_require(`
2200                 type user_home_dir_t, user_home_t;
2201         ')
2202
2203         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2204         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2205         files_search_home($1)
2206 ')
2207
2208 ########################################
2209 ## <summary>
2210 ##      Do not audit attempts to getattr user home files.
2211 ## </summary>
2212 ## <param name="domain">
2213 ##      <summary>
2214 ##      Domain to not audit.
2215 ##      </summary>
2216 ## </param>
2217 #
2218 interface(`userdom_dontaudit_getattr_user_home_content',`
2219         gen_require(`
2220                 attribute user_home_type;
2221         ')
2222
2223         dontaudit $1 user_home_type:dir getattr;
2224         dontaudit $1 user_home_type:file getattr;
2225 ')
2226
2227 ########################################
2228 ## <summary>
2229 ##      Do not audit attempts to read user home files.
2230 ## </summary>
2231 ## <param name="domain">
2232 ##      <summary>
2233 ##      Domain to not audit.
2234 ##      </summary>
2235 ## </param>
2236 #
2237 interface(`userdom_dontaudit_read_user_home_content_files',`
2238         gen_require(`
2239                 attribute user_home_type;
2240                 type user_home_dir_t;
2241         ')
2242
2243         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2244         dontaudit $1 user_home_type:dir list_dir_perms;
2245         dontaudit $1 user_home_type:file read_file_perms;
2246         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2247 ')
2248
2249 ########################################
2250 ## <summary>
2251 ##      Do not audit attempts to append user home files.
2252 ## </summary>
2253 ## <param name="domain">
2254 ##      <summary>
2255 ##      Domain to not audit.
2256 ##      </summary>
2257 ## </param>
2258 #
2259 interface(`userdom_dontaudit_append_user_home_content_files',`
2260         gen_require(`
2261                 type user_home_t;
2262         ')
2263
2264         dontaudit $1 user_home_t:file append_file_perms;
2265 ')
2266
2267 ########################################
2268 ## <summary>
2269 ##      Do not audit attempts to write user home files.
2270 ## </summary>
2271 ## <param name="domain">
2272 ##      <summary>
2273 ##      Domain to not audit.
2274 ##      </summary>
2275 ## </param>
2276 #
2277 interface(`userdom_dontaudit_write_user_home_content_files',`
2278         gen_require(`
2279                 type user_home_t;
2280         ')
2281
2282         dontaudit $1 user_home_t:file write_file_perms;
2283 ')
2284
2285 ########################################
2286 ## <summary>
2287 ##      Delete files in a user home subdirectory.
2288 ## </summary>
2289 ## <param name="domain">
2290 ##      <summary>
2291 ##      Domain allowed access.
2292 ##      </summary>
2293 ## </param>
2294 #
2295 interface(`userdom_delete_user_home_content_files',`
2296         gen_require(`
2297                 type user_home_t;
2298         ')
2299
2300         allow $1 user_home_t:file delete_file_perms;
2301 ')
2302
2303 ########################################
2304 ## <summary>
2305 ##      Delete all files in a user home subdirectory.
2306 ## </summary>
2307 ## <param name="domain">
2308 ##      <summary>
2309 ##      Domain allowed access.
2310 ##      </summary>
2311 ## </param>
2312 #
2313 interface(`userdom_delete_all_user_home_content_files',`
2314         gen_require(`
2315                 attribute user_home_type;
2316         ')
2317
2318         allow $1 user_home_type:file delete_file_perms;
2319 ')
2320
2321 ########################################
2322 ## <summary>
2323 ##      Delete sock files in a user home subdirectory.
2324 ## </summary>
2325 ## <param name="domain">
2326 ##      <summary>
2327 ##      Domain allowed access.
2328 ##      </summary>
2329 ## </param>
2330 #
2331 interface(`userdom_delete_user_home_content_sock_files',`
2332         gen_require(`
2333                 type user_home_t;
2334         ')
2335
2336         allow $1 user_home_t:sock_file delete_file_perms;
2337 ')
2338
2339 ########################################
2340 ## <summary>
2341 ##      Delete all sock files in a user home subdirectory.
2342 ## </summary>
2343 ## <param name="domain">
2344 ##      <summary>
2345 ##      Domain allowed access.
2346 ##      </summary>
2347 ## </param>
2348 #
2349 interface(`userdom_delete_all_user_home_content_sock_files',`
2350         gen_require(`
2351                 attribute user_home_type;
2352         ')
2353
2354         allow $1 user_home_type:sock_file delete_file_perms;
2355 ')
2356
2357 ########################################
2358 ## <summary>
2359 ##      Do not audit attempts to write user home files.
2360 ## </summary>
2361 ## <param name="domain">
2362 ##      <summary>
2363 ##      Domain to not audit.
2364 ##      </summary>
2365 ## </param>
2366 #
2367 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2368         gen_require(`
2369                 type user_home_t;
2370         ')
2371
2372         dontaudit $1 user_home_t:file relabel_file_perms;
2373 ')
2374
2375 ########################################
2376 ## <summary>
2377 ##      Read user home subdirectory symbolic links.
2378 ## </summary>
2379 ## <param name="domain">
2380 ##      <summary>
2381 ##      Domain allowed access.
2382 ##      </summary>
2383 ## </param>
2384 #
2385 interface(`userdom_read_user_home_content_symlinks',`
2386         gen_require(`
2387                 type user_home_dir_t, user_home_t;
2388         ')
2389
2390         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2391 ')
2392
2393 ########################################
2394 ## <summary>
2395 ##      Execute user home files.
2396 ## </summary>
2397 ## <param name="domain">
2398 ##      <summary>
2399 ##      Domain allowed access.
2400 ##      </summary>
2401 ## </param>
2402 ## <rolecap/>
2403 #
2404 interface(`userdom_exec_user_home_content_files',`
2405         gen_require(`
2406                 type user_home_dir_t;
2407                 attribute user_home_type;
2408         ')
2409
2410         files_search_home($1)
2411         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2412         dontaudit $1 user_home_type:sock_file execute;
2413         ')
2414
2415 ########################################
2416 ## <summary>
2417 ##      Do not audit attempts to execute user home files.
2418 ## </summary>
2419 ## <param name="domain">
2420 ##      <summary>
2421 ##      Domain to not audit.
2422 ##      </summary>
2423 ## </param>
2424 #
2425 interface(`userdom_dontaudit_exec_user_home_content_files',`
2426         gen_require(`
2427                 type user_home_t;
2428         ')
2429
2430         dontaudit $1 user_home_t:file exec_file_perms;
2431 ')
2432
2433 ########################################
2434 ## <summary>
2435 ##      Create, read, write, and delete files
2436 ##      in a user home subdirectory.
2437 ## </summary>
2438 ## <param name="domain">
2439 ##      <summary>
2440 ##      Domain allowed access.
2441 ##      </summary>
2442 ## </param>
2443 #
2444 interface(`userdom_manage_user_home_content_files',`
2445         gen_require(`
2446                 type user_home_dir_t, user_home_t;
2447         ')
2448
2449         manage_files_pattern($1, user_home_t, user_home_t)
2450         allow $1 user_home_dir_t:dir search_dir_perms;
2451         files_search_home($1)
2452 ')
2453
2454 ########################################
2455 ## <summary>
2456 ##      Do not audit attempts to create, read, write, and delete directories
2457 ##      in a user home subdirectory.
2458 ## </summary>
2459 ## <param name="domain">
2460 ##      <summary>
2461 ##      Domain to not audit.
2462 ##      </summary>
2463 ## </param>
2464 #
2465 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2466         gen_require(`
2467                 type user_home_dir_t, user_home_t;
2468         ')
2469
2470         dontaudit $1 user_home_t:dir manage_dir_perms;
2471 ')
2472
2473 ########################################
2474 ## <summary>
2475 ##      Create, read, write, and delete symbolic links
2476 ##      in a user home subdirectory.
2477 ## </summary>
2478 ## <param name="domain">
2479 ##      <summary>
2480 ##      Domain allowed access.
2481 ##      </summary>
2482 ## </param>
2483 #
2484 interface(`userdom_manage_user_home_content_symlinks',`
2485         gen_require(`
2486                 type user_home_dir_t, user_home_t;
2487         ')
2488
2489         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2490         allow $1 user_home_dir_t:dir search_dir_perms;
2491         files_search_home($1)
2492 ')
2493
2494 ########################################
2495 ## <summary>
2496 ##      Delete symbolic links in a user home directory.
2497 ## </summary>
2498 ## <param name="domain">
2499 ##      <summary>
2500 ##      Domain allowed access.
2501 ##      </summary>
2502 ## </param>
2503 #
2504 interface(`userdom_delete_user_home_content_symlinks',`
2505         gen_require(`
2506                 type user_home_t;
2507         ')
2508
2509         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2510 ')
2511
2512 ########################################
2513 ## <summary>
2514 ##      Delete all symbolic links in a user home directory.
2515 ## </summary>
2516 ## <param name="domain">
2517 ##      <summary>
2518 ##      Domain allowed access.
2519 ##      </summary>
2520 ## </param>
2521 #
2522 interface(`userdom_delete_all_user_home_content_symlinks',`
2523         gen_require(`
2524                 attribute user_home_type;
2525         ')
2526
2527         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2528 ')
2529
2530 ########################################
2531 ## <summary>
2532 ##      Create, read, write, and delete named pipes
2533 ##      in a user home subdirectory.
2534 ## </summary>
2535 ## <param name="domain">
2536 ##      <summary>
2537 ##      Domain allowed access.
2538 ##      </summary>
2539 ## </param>
2540 #
2541 interface(`userdom_manage_user_home_content_pipes',`
2542         gen_require(`
2543                 type user_home_dir_t, user_home_t;
2544         ')
2545
2546         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2547         allow $1 user_home_dir_t:dir search_dir_perms;
2548         files_search_home($1)
2549 ')
2550
2551 ########################################
2552 ## <summary>
2553 ##      Create, read, write, and delete named sockets
2554 ##      in a user home subdirectory.
2555 ## </summary>
2556 ## <param name="domain">
2557 ##      <summary>
2558 ##      Domain allowed access.
2559 ##      </summary>
2560 ## </param>
2561 #
2562 interface(`userdom_manage_user_home_content_sockets',`
2563         gen_require(`
2564                 type user_home_dir_t, user_home_t;
2565         ')
2566
2567         allow $1 user_home_dir_t:dir search_dir_perms;
2568         manage_sock_files_pattern($1, user_home_t, user_home_t)
2569         files_search_home($1)
2570 ')
2571
2572 ########################################
2573 ## <summary>
2574 ##      Create objects in a user home directory
2575 ##      with an automatic type transition to
2576 ##      a specified private type.
2577 ## </summary>
2578 ## <param name="domain">
2579 ##      <summary>
2580 ##      Domain allowed access.
2581 ##      </summary>
2582 ## </param>
2583 ## <param name="private_type">
2584 ##      <summary>
2585 ##      The type of the object to create.
2586 ##      </summary>
2587 ## </param>
2588 ## <param name="object_class">
2589 ##      <summary>
2590 ##      The class of the object to be created.
2591 ##      </summary>
2592 ## </param>
2593 #
2594 interface(`userdom_user_home_dir_filetrans',`
2595         gen_require(`
2596                 type user_home_dir_t;
2597         ')
2598
2599         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2600         files_search_home($1)
2601 ')
2602
2603 ########################################
2604 ## <summary>
2605 ##      Create objects in a user home directory
2606 ##      with an automatic type transition to
2607 ##      a specified private type.
2608 ## </summary>
2609 ## <param name="domain">
2610 ##      <summary>
2611 ##      Domain allowed access.
2612 ##      </summary>
2613 ## </param>
2614 ## <param name="private_type">
2615 ##      <summary>
2616 ##      The type of the object to create.
2617 ##      </summary>
2618 ## </param>
2619 ## <param name="object_class">
2620 ##      <summary>
2621 ##      The class of the object to be created.
2622 ##      </summary>
2623 ## </param>
2624 #
2625 interface(`userdom_user_home_content_filetrans',`
2626         gen_require(`
2627                 type user_home_dir_t, user_home_t;
2628         ')
2629
2630         filetrans_pattern($1, user_home_t, $2, $3)
2631         allow $1 user_home_dir_t:dir search_dir_perms;
2632         files_search_home($1)
2633 ')
2634
2635 ########################################
2636 ## <summary>
2637 ##      Create objects in a user home directory
2638 ##      with an automatic type transition to
2639 ##      the user home file type.
2640 ## </summary>
2641 ## <param name="domain">
2642 ##      <summary>
2643 ##      Domain allowed access.
2644 ##      </summary>
2645 ## </param>
2646 ## <param name="object_class">
2647 ##      <summary>
2648 ##      The class of the object to be created.
2649 ##      </summary>
2650 ## </param>
2651 #
2652 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2653         gen_require(`
2654                 type user_home_dir_t, user_home_t;
2655         ')
2656
2657         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2658         files_search_home($1)
2659 ')
2660
2661 ########################################
2662 ## <summary>
2663 ##      Write to user temporary named sockets.
2664 ## </summary>
2665 ## <param name="domain">
2666 ##      <summary>
2667 ##      Domain allowed access.
2668 ##      </summary>
2669 ## </param>
2670 #
2671 interface(`userdom_write_user_tmp_sockets',`
2672         gen_require(`
2673                 type user_tmp_t;
2674         ')
2675
2676         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2677         files_search_tmp($1)
2678 ')
2679
2680 ########################################
2681 ## <summary>
2682 ##      List user temporary directories.
2683 ## </summary>
2684 ## <param name="domain">
2685 ##      <summary>
2686 ##      Domain allowed access.
2687 ##      </summary>
2688 ## </param>
2689 #
2690 interface(`userdom_list_user_tmp',`
2691         gen_require(`
2692                 type user_tmp_t;
2693         ')
2694
2695         allow $1 user_tmp_t:dir list_dir_perms;
2696         files_search_tmp($1)
2697 ')
2698
2699 ########################################
2700 ## <summary>
2701 ##      Do not audit attempts to list user
2702 ##      temporary directories.
2703 ## </summary>
2704 ## <param name="domain">
2705 ##      <summary>
2706 ##      Domain to not audit.
2707 ##      </summary>
2708 ## </param>
2709 #
2710 interface(`userdom_dontaudit_list_user_tmp',`
2711         gen_require(`
2712                 type user_tmp_t;
2713         ')
2714
2715         dontaudit $1 user_tmp_t:dir list_dir_perms;
2716 ')
2717
2718 ########################################
2719 ## <summary>
2720 ##      Do not audit attempts to manage users
2721 ##      temporary directories.
2722 ## </summary>
2723 ## <param name="domain">
2724 ##      <summary>
2725 ##      Domain to not audit.
2726 ##      </summary>
2727 ## </param>
2728 #
2729 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2730         gen_require(`
2731                 type user_tmp_t;
2732         ')
2733
2734         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2735 ')
2736
2737 ########################################
2738 ## <summary>
2739 ##      Read user temporary files.
2740 ## </summary>
2741 ## <param name="domain">
2742 ##      <summary>
2743 ##      Domain allowed access.
2744 ##      </summary>
2745 ## </param>
2746 #
2747 interface(`userdom_read_user_tmp_files',`
2748         gen_require(`
2749                 type user_tmp_t;
2750         ')
2751
2752         read_files_pattern($1, user_tmp_t, user_tmp_t)
2753         allow $1 user_tmp_t:dir list_dir_perms;
2754         files_search_tmp($1)
2755 ')
2756
2757 ########################################
2758 ## <summary>
2759 ##      Do not audit attempts to read users
2760 ##      temporary files.
2761 ## </summary>
2762 ## <param name="domain">
2763 ##      <summary>
2764 ##      Domain to not audit.
2765 ##      </summary>
2766 ## </param>
2767 #
2768 interface(`userdom_dontaudit_read_user_tmp_files',`
2769         gen_require(`
2770                 type user_tmp_t;
2771         ')
2772
2773         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2774 ')
2775
2776 ########################################
2777 ## <summary>
2778 ##      Do not audit attempts to append users
2779 ##      temporary files.
2780 ## </summary>
2781 ## <param name="domain">
2782 ##      <summary>
2783 ##      Domain to not audit.
2784 ##      </summary>
2785 ## </param>
2786 #
2787 interface(`userdom_dontaudit_append_user_tmp_files',`
2788         gen_require(`
2789                 type user_tmp_t;
2790         ')
2791
2792         dontaudit $1 user_tmp_t:file append_file_perms;
2793 ')
2794
2795 ########################################
2796 ## <summary>
2797 ##      Read and write user temporary files.
2798 ## </summary>
2799 ## <param name="domain">
2800 ##      <summary>
2801 ##      Domain allowed access.
2802 ##      </summary>
2803 ## </param>
2804 #
2805 interface(`userdom_rw_user_tmp_files',`
2806         gen_require(`
2807                 type user_tmp_t;
2808         ')
2809
2810         allow $1 user_tmp_t:dir list_dir_perms;
2811         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2812         files_search_tmp($1)
2813 ')
2814
2815 ########################################
2816 ## <summary>
2817 ##      Do not audit attempts to manage users
2818 ##      temporary files.
2819 ## </summary>
2820 ## <param name="domain">
2821 ##      <summary>
2822 ##      Domain to not audit.
2823 ##      </summary>
2824 ## </param>
2825 #
2826 interface(`userdom_dontaudit_manage_user_tmp_files',`
2827         gen_require(`
2828                 type user_tmp_t;
2829         ')
2830
2831         dontaudit $1 user_tmp_t:file manage_file_perms;
2832 ')
2833
2834 ########################################
2835 ## <summary>
2836 ##      Read user temporary symbolic links.
2837 ## </summary>
2838 ## <param name="domain">
2839 ##      <summary>
2840 ##      Domain allowed access.
2841 ##      </summary>
2842 ## </param>
2843 #
2844 interface(`userdom_read_user_tmp_symlinks',`
2845         gen_require(`
2846                 type user_tmp_t;
2847         ')
2848
2849         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2850         allow $1 user_tmp_t:dir list_dir_perms;
2851         files_search_tmp($1)
2852 ')
2853
2854 ########################################
2855 ## <summary>
2856 ##      Create, read, write, and delete user
2857 ##      temporary directories.
2858 ## </summary>
2859 ## <param name="domain">
2860 ##      <summary>
2861 ##      Domain allowed access.
2862 ##      </summary>
2863 ## </param>
2864 #
2865 interface(`userdom_manage_user_tmp_dirs',`
2866         gen_require(`
2867                 type user_tmp_t;
2868         ')
2869
2870         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2871         files_search_tmp($1)
2872 ')
2873
2874 ########################################
2875 ## <summary>
2876 ##      Create, read, write, and delete user
2877 ##      temporary files.
2878 ## </summary>
2879 ## <param name="domain">
2880 ##      <summary>
2881 ##      Domain allowed access.
2882 ##      </summary>
2883 ## </param>
2884 #
2885 interface(`userdom_manage_user_tmp_files',`
2886         gen_require(`
2887                 type user_tmp_t;
2888         ')
2889
2890         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2891         files_search_tmp($1)
2892 ')
2893
2894 ########################################
2895 ## <summary>
2896 ##      Create, read, write, and delete user
2897 ##      temporary symbolic links.
2898 ## </summary>
2899 ## <param name="domain">
2900 ##      <summary>
2901 ##      Domain allowed access.
2902 ##      </summary>
2903 ## </param>
2904 #
2905 interface(`userdom_manage_user_tmp_symlinks',`
2906         gen_require(`
2907                 type user_tmp_t;
2908         ')
2909
2910         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2911         files_search_tmp($1)
2912 ')
2913
2914 ########################################
2915 ## <summary>
2916 ##      Create, read, write, and delete user
2917 ##      temporary named pipes.
2918 ## </summary>
2919 ## <param name="domain">
2920 ##      <summary>
2921 ##      Domain allowed access.
2922 ##      </summary>
2923 ## </param>
2924 #
2925 interface(`userdom_manage_user_tmp_pipes',`
2926         gen_require(`
2927                 type user_tmp_t;
2928         ')
2929
2930         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2931         files_search_tmp($1)
2932 ')
2933
2934 ########################################
2935 ## <summary>
2936 ##      Create, read, write, and delete user
2937 ##      temporary named sockets.
2938 ## </summary>
2939 ## <param name="domain">
2940 ##      <summary>
2941 ##      Domain allowed access.
2942 ##      </summary>
2943 ## </param>
2944 #
2945 interface(`userdom_manage_user_tmp_sockets',`
2946         gen_require(`
2947                 type user_tmp_t;
2948         ')
2949
2950         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2951         files_search_tmp($1)
2952 ')
2953
2954 ########################################
2955 ## <summary>
2956 ##      Create objects in a user temporary directory
2957 ##      with an automatic type transition to
2958 ##      a specified private type.
2959 ## </summary>
2960 ## <param name="domain">
2961 ##      <summary>
2962 ##      Domain allowed access.
2963 ##      </summary>
2964 ## </param>
2965 ## <param name="private_type">
2966 ##      <summary>
2967 ##      The type of the object to create.
2968 ##      </summary>
2969 ## </param>
2970 ## <param name="object_class">
2971 ##      <summary>
2972 ##      The class of the object to be created.
2973 ##      </summary>
2974 ## </param>
2975 #
2976 interface(`userdom_user_tmp_filetrans',`
2977         gen_require(`
2978                 type user_tmp_t;
2979         ')
2980
2981         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2982         files_search_tmp($1)
2983 ')
2984
2985 ########################################
2986 ## <summary>
2987 ##      Create objects in the temporary directory
2988 ##      with an automatic type transition to
2989 ##      the user temporary type.
2990 ## </summary>
2991 ## <param name="domain">
2992 ##      <summary>
2993 ##      Domain allowed access.
2994 ##      </summary>
2995 ## </param>
2996 ## <param name="object_class">
2997 ##      <summary>
2998 ##      The class of the object to be created.
2999 ##      </summary>
3000 ## </param>
3001 #
3002 interface(`userdom_tmp_filetrans_user_tmp',`
3003         gen_require(`
3004                 type user_tmp_t;
3005         ')
3006
3007         files_tmp_filetrans($1, user_tmp_t, $2)
3008 ')
3009
3010 ########################################
3011 ## <summary>
3012 ##      Read user tmpfs files.
3013 ## </summary>
3014 ## <param name="domain">
3015 ##      <summary>
3016 ##      Domain allowed access.
3017 ##      </summary>
3018 ## </param>
3019 #
3020 interface(`userdom_read_user_tmpfs_files',`
3021         gen_require(`
3022                 type user_tmpfs_t;
3023         ')
3024
3025         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3026         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3027         allow $1 user_tmpfs_t:dir list_dir_perms;
3028         fs_search_tmpfs($1)
3029 ')
3030
3031 ########################################
3032 ## <summary>
3033 ##      Read/Write user tmpfs files.
3034 ## </summary>
3035 ## <param name="domain">
3036 ##      <summary>
3037 ##      Domain allowed access.
3038 ##      </summary>
3039 ## </param>
3040 #
3041 interface(`userdom_rw_user_tmpfs_files',`
3042         gen_require(`
3043                 type user_tmpfs_t;
3044         ')
3045
3046         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3047         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3048         allow $1 user_tmpfs_t:dir list_dir_perms;
3049         fs_search_tmpfs($1)
3050 ')
3051
3052 ########################################
3053 ## <summary>
3054 ##      Get the attributes of a user domain tty.
3055 ## </summary>
3056 ## <param name="domain">
3057 ##      <summary>
3058 ##      Domain allowed access.
3059 ##      </summary>
3060 ## </param>
3061 #
3062 interface(`userdom_getattr_user_ttys',`
3063         gen_require(`
3064                 type user_tty_device_t;
3065         ')
3066
3067         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3068 ')
3069
3070 ########################################
3071 ## <summary>
3072 ##      Do not audit attempts to get the attributes of a user domain tty.
3073 ## </summary>
3074 ## <param name="domain">
3075 ##      <summary>
3076 ##      Domain to not audit.
3077 ##      </summary>
3078 ## </param>
3079 #
3080 interface(`userdom_dontaudit_getattr_user_ttys',`
3081         gen_require(`
3082                 type user_tty_device_t;
3083         ')
3084
3085         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3086 ')
3087
3088 ########################################
3089 ## <summary>
3090 ##      Set the attributes of a user domain tty.
3091 ## </summary>
3092 ## <param name="domain">
3093 ##      <summary>
3094 ##      Domain allowed access.
3095 ##      </summary>
3096 ## </param>
3097 #
3098 interface(`userdom_setattr_user_ttys',`
3099         gen_require(`
3100                 type user_tty_device_t;
3101         ')
3102
3103         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3104 ')
3105
3106 ########################################
3107 ## <summary>
3108 ##      Do not audit attempts to set the attributes of a user domain tty.
3109 ## </summary>
3110 ## <param name="domain">
3111 ##      <summary>
3112 ##      Domain to not audit.
3113 ##      </summary>
3114 ## </param>
3115 #
3116 interface(`userdom_dontaudit_setattr_user_ttys',`
3117         gen_require(`
3118                 type user_tty_device_t;
3119         ')
3120
3121         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3122 ')
3123
3124 ########################################
3125 ## <summary>
3126 ##      Read and write a user domain tty.
3127 ## </summary>
3128 ## <param name="domain">
3129 ##      <summary>
3130 ##      Domain allowed access.
3131 ##      </summary>
3132 ## </param>
3133 #
3134 interface(`userdom_use_user_ttys',`
3135         gen_require(`
3136                 type user_tty_device_t;
3137         ')
3138
3139         allow $1 user_tty_device_t:chr_file rw_term_perms;
3140 ')
3141
3142 ########################################
3143 ## <summary>
3144 ##      Read and write a inherited user domain tty.
3145 ## </summary>
3146 ## <param name="domain">
3147 ##      <summary>
3148 ##      Domain allowed access.
3149 ##      </summary>
3150 ## </param>
3151 #
3152 interface(`userdom_use_inherited_user_ttys',`
3153         gen_require(`
3154                 type user_tty_device_t;
3155         ')
3156
3157         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3158 ')
3159
3160 ########################################
3161 ## <summary>
3162 ##      Read and write a user domain pty.
3163 ## </summary>
3164 ## <param name="domain">
3165 ##      <summary>
3166 ##      Domain allowed access.
3167 ##      </summary>
3168 ## </param>
3169 #
3170 interface(`userdom_use_user_ptys',`
3171         gen_require(`
3172                 type user_devpts_t;
3173         ')
3174
3175         allow $1 user_devpts_t:chr_file rw_term_perms;
3176 ')
3177
3178 ########################################
3179 ## <summary>
3180 ##      Read and write a inherited user domain pty.
3181 ## </summary>
3182 ## <param name="domain">
3183 ##      <summary>
3184 ##      Domain allowed access.
3185 ##      </summary>
3186 ## </param>
3187 #
3188 interface(`userdom_use_inherited_user_ptys',`
3189         gen_require(`
3190                 type user_devpts_t;
3191         ')
3192
3193         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3194 ')
3195
3196 ########################################
3197 ## <summary>
3198 ##      Read and write a inherited user TTYs and PTYs.
3199 ## </summary>
3200 ## <desc>
3201 ##      <p>
3202 ##      Allow the specified domain to read and write inherited user
3203 ##      TTYs and PTYs. This will allow the domain to
3204 ##      interact with the user via the terminal. Typically
3205 ##      all interactive applications will require this
3206 ##      access.
3207 ##      </p>
3208 ## </desc>
3209 ## <param name="domain">
3210 ##      <summary>
3211 ##      Domain allowed access.
3212 ##      </summary>
3213 ## </param>
3214 ## <infoflow type="both" weight="10"/>
3215 #
3216 interface(`userdom_use_inherited_user_terminals',`
3217         gen_require(`
3218                 type user_tty_device_t, user_devpts_t;
3219         ')
3220
3221         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3222         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3223 ')
3224
3225 #######################################
3226 ## <summary>
3227 ##  Allow attempts to read and write
3228 ##  a user domain tty and pty.
3229 ## </summary>
3230 ## <param name="domain">
3231 ##  <summary>
3232 ##  Domain to not audit.
3233 ##  </summary>
3234 ## </param>
3235 #
3236 interface(`userdom_use_user_terminals',`
3237     gen_require(`
3238         type user_tty_device_t, user_devpts_t;
3239     ')
3240
3241     allow $1 user_tty_device_t:chr_file rw_term_perms;
3242     allow $1 user_devpts_t:chr_file rw_term_perms;
3243 ')
3244
3245 ########################################
3246 ## <summary>
3247 ##      Do not audit attempts to read and write
3248 ##      a user domain tty and pty.
3249 ## </summary>
3250 ## <param name="domain">
3251 ##      <summary>
3252 ##      Domain to not audit.
3253 ##      </summary>
3254 ## </param>
3255 #
3256 interface(`userdom_dontaudit_use_user_terminals',`
3257         gen_require(`
3258                 type user_tty_device_t, user_devpts_t;
3259         ')
3260
3261         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3262         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3263 ')
3264
3265
3266 ########################################
3267 ## <summary>
3268 ##      Get attributes of user domain tty and pty.
3269 ## </summary>
3270 ## <param name="domain">
3271 ##      <summary>
3272 ##      Domain allowed access.
3273 ##      </summary>
3274 ## </param>
3275 #
3276 interface(`userdom_getattr_user_terminals',`
3277         gen_require(`
3278                 type user_tty_device_t, user_devpts_t;
3279         ')
3280
3281         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3282 ')
3283
3284 ########################################
3285 ## <summary>
3286 ##      Execute a shell in all user domains.  This
3287 ##      is an explicit transition, requiring the
3288 ##      caller to use setexeccon().
3289 ## </summary>
3290 ## <param name="domain">
3291 ##      <summary>
3292 ##      Domain allowed to transition.
3293 ##      </summary>
3294 ## </param>
3295 #
3296 interface(`userdom_spec_domtrans_all_users',`
3297         gen_require(`
3298                 attribute userdomain;
3299         ')
3300
3301         corecmd_shell_spec_domtrans($1, userdomain)
3302         allow userdomain $1:fd use;
3303         allow userdomain $1:fifo_file rw_file_perms;
3304         allow userdomain $1:process sigchld;
3305 ')
3306
3307 ########################################
3308 ## <summary>
3309 ##      Execute an Xserver session in all unprivileged user domains.  This
3310 ##      is an explicit transition, requiring the
3311 ##      caller to use setexeccon().
3312 ## </summary>
3313 ## <param name="domain">
3314 ##      <summary>
3315 ##      Domain allowed to transition.
3316 ##      </summary>
3317 ## </param>
3318 #
3319 interface(`userdom_xsession_spec_domtrans_all_users',`
3320         gen_require(`
3321                 attribute userdomain;
3322         ')
3323
3324         xserver_xsession_spec_domtrans($1, userdomain)
3325         allow userdomain $1:fd use;
3326         allow userdomain $1:fifo_file rw_file_perms;
3327         allow userdomain $1:process sigchld;
3328 ')
3329
3330 ########################################
3331 ## <summary>
3332 ##      Execute a shell in all unprivileged user domains.  This
3333 ##      is an explicit transition, requiring the
3334 ##      caller to use setexeccon().
3335 ## </summary>
3336 ## <param name="domain">
3337 ##      <summary>
3338 ##      Domain allowed to transition.
3339 ##      </summary>
3340 ## </param>
3341 #
3342 interface(`userdom_spec_domtrans_unpriv_users',`
3343         gen_require(`
3344                 attribute unpriv_userdomain;
3345         ')
3346
3347         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3348         allow unpriv_userdomain $1:fd use;
3349         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3350         allow unpriv_userdomain $1:process sigchld;
3351 ')
3352
3353 ########################################
3354 ## <summary>
3355 ##      Execute an Xserver session in all unprivileged user domains.  This
3356 ##      is an explicit transition, requiring the
3357 ##      caller to use setexeccon().
3358 ## </summary>
3359 ## <param name="domain">
3360 ##      <summary>
3361 ##      Domain allowed to transition.
3362 ##      </summary>
3363 ## </param>
3364 #
3365 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3366         gen_require(`
3367                 attribute unpriv_userdomain;
3368         ')
3369
3370         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3371         allow unpriv_userdomain $1:fd use;
3372         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3373         allow unpriv_userdomain $1:process sigchld;
3374 ')
3375
3376 ########################################
3377 ## <summary>
3378 ##      Manage unpriviledged user SysV sempaphores.
3379 ## </summary>
3380 ## <param name="domain">
3381 ##      <summary>
3382 ##      Domain allowed access.
3383 ##      </summary>
3384 ## </param>
3385 #
3386 interface(`userdom_manage_unpriv_user_semaphores',`
3387         gen_require(`
3388                 attribute unpriv_userdomain;
3389         ')
3390
3391         allow $1 unpriv_userdomain:sem create_sem_perms;
3392 ')
3393
3394 ########################################
3395 ## <summary>
3396 ##      Manage unpriviledged user SysV shared
3397 ##      memory segments.
3398 ## </summary>
3399 ## <param name="domain">
3400 ##      <summary>
3401 ##      Domain allowed access.
3402 ##      </summary>
3403 ## </param>
3404 #
3405 interface(`userdom_manage_unpriv_user_shared_mem',`
3406         gen_require(`
3407                 attribute unpriv_userdomain;
3408         ')
3409
3410         allow $1 unpriv_userdomain:shm create_shm_perms;
3411 ')
3412
3413 ########################################
3414 ## <summary>
3415 ##      Execute bin_t in the unprivileged user domains. This
3416 ##      is an explicit transition, requiring the
3417 ##      caller to use setexeccon().
3418 ## </summary>
3419 ## <param name="domain">
3420 ##      <summary>
3421 ##      Domain allowed to transition.
3422 ##      </summary>
3423 ## </param>
3424 #
3425 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3426         gen_require(`
3427                 attribute unpriv_userdomain;
3428         ')
3429
3430         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3431         allow unpriv_userdomain $1:fd use;
3432         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3433         allow unpriv_userdomain $1:process sigchld;
3434 ')
3435
3436 ########################################
3437 ## <summary>
3438 ##      Execute all entrypoint files in unprivileged user
3439 ##      domains. This is an explicit transition, requiring the
3440 ##      caller to use setexeccon().
3441 ## </summary>
3442 ## <param name="domain">
3443 ##      <summary>
3444 ##      Domain allowed access.
3445 ##      </summary>
3446 ## </param>
3447 #
3448 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3449         gen_require(`
3450                 attribute unpriv_userdomain;
3451         ')
3452
3453         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3454         allow unpriv_userdomain $1:fd use;
3455         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3456         allow unpriv_userdomain $1:process sigchld;
3457 ')
3458
3459 ########################################
3460 ## <summary>
3461 ##      Search users home directories.
3462 ## </summary>
3463 ## <param name="domain">
3464 ##      <summary>
3465 ##      Domain allowed access.
3466 ##      </summary>
3467 ## </param>
3468 #
3469 interface(`userdom_search_user_home_content',`
3470         gen_require(`
3471                 type user_home_dir_t;
3472                 attribute user_home_type;
3473         ')
3474
3475         files_list_home($1)
3476         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3477         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3478 ')
3479
3480 ########################################
3481 ## <summary>
3482 ##      Send general signals to unprivileged user domains.
3483 ## </summary>
3484 ## <param name="domain">
3485 ##      <summary>
3486 ##      Domain allowed access.
3487 ##      </summary>
3488 ## </param>
3489 #
3490 interface(`userdom_signal_unpriv_users',`
3491         gen_require(`
3492                 attribute unpriv_userdomain;
3493         ')
3494
3495         allow $1 unpriv_userdomain:process signal;
3496 ')
3497
3498 ########################################
3499 ## <summary>
3500 ##      Inherit the file descriptors from unprivileged user domains.
3501 ## </summary>
3502 ## <param name="domain">
3503 ##      <summary>
3504 ##      Domain allowed access.
3505 ##      </summary>
3506 ## </param>
3507 #
3508 interface(`userdom_use_unpriv_users_fds',`
3509         gen_require(`
3510                 attribute unpriv_userdomain;
3511         ')
3512
3513         allow $1 unpriv_userdomain:fd use;
3514 ')
3515
3516 ########################################
3517 ## <summary>
3518 ##      Do not audit attempts to inherit the file descriptors
3519 ##      from unprivileged user domains.
3520 ## </summary>
3521 ## <desc>
3522 ##      <p>
3523 ##      Do not audit attempts to inherit the file descriptors
3524 ##      from unprivileged user domains. This will supress
3525 ##      SELinux denial messages when the specified domain is denied
3526 ##      the permission to inherit these file descriptors.
3527 ##      </p>
3528 ## </desc>
3529 ## <param name="domain">
3530 ##      <summary>
3531 ##      Domain to not audit.
3532 ##      </summary>
3533 ## </param>
3534 ## <infoflow type="none"/>
3535 #
3536 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3537         gen_require(`
3538                 attribute unpriv_userdomain;
3539         ')
3540
3541         dontaudit $1 unpriv_userdomain:fd use;
3542 ')
3543
3544 ########################################
3545 ## <summary>
3546 ##      Do not audit attempts to use user ptys.
3547 ## </summary>
3548 ## <param name="domain">
3549 ##      <summary>
3550 ##      Domain to not audit.
3551 ##      </summary>
3552 ## </param>
3553 #
3554 interface(`userdom_dontaudit_use_user_ptys',`
3555         gen_require(`
3556                 type user_devpts_t;
3557         ')
3558
3559         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3560 ')
3561
3562 ########################################
3563 ## <summary>
3564 ##      Relabel files to unprivileged user pty types.
3565 ## </summary>
3566 ## <param name="domain">
3567 ##      <summary>
3568 ##      Domain allowed access.
3569 ##      </summary>
3570 ## </param>
3571 #
3572 interface(`userdom_relabelto_user_ptys',`
3573         gen_require(`
3574                 type user_devpts_t;
3575         ')
3576
3577         allow $1 user_devpts_t:chr_file relabelto;
3578 ')
3579
3580 ########################################
3581 ## <summary>
3582 ##      Do not audit attempts to relabel files from
3583 ##      user pty types.
3584 ## </summary>
3585 ## <param name="domain">
3586 ##      <summary>
3587 ##      Domain to not audit.
3588 ##      </summary>
3589 ## </param>
3590 #
3591 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3592         gen_require(`
3593                 type user_devpts_t;
3594         ')
3595
3596         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3597 ')
3598
3599 ########################################
3600 ## <summary>
3601 ##      Write all users files in /tmp
3602 ## </summary>
3603 ## <param name="domain">
3604 ##      <summary>
3605 ##      Domain allowed access.
3606 ##      </summary>
3607 ## </param>
3608 #
3609 interface(`userdom_write_user_tmp_files',`
3610         gen_require(`
3611                 type user_tmp_t;
3612         ')
3613
3614         write_files_pattern($1, user_tmp_t, user_tmp_t)
3615 ')
3616
3617 ########################################
3618 ## <summary>
3619 ##      Do not audit attempts to write users
3620 ##      temporary files.
3621 ## </summary>
3622 ## <param name="domain">
3623 ##      <summary>
3624 ##      Domain to not audit.
3625 ##      </summary>
3626 ## </param>
3627 #
3628 interface(`userdom_dontaudit_write_user_tmp_files',`
3629         gen_require(`
3630                 type user_tmp_t;
3631         ')
3632
3633         dontaudit $1 user_tmp_t:file write;
3634 ')
3635
3636 ########################################
3637 ## <summary>
3638 ##      Do not audit attempts to read/write users
3639 ##      temporary fifo files.
3640 ## </summary>
3641 ## <param name="domain">
3642 ##      <summary>
3643 ##      Domain to not audit.
3644 ##      </summary>
3645 ## </param>
3646 #
3647 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3648         gen_require(`
3649                 type user_tmp_t;
3650         ')
3651
3652         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3653 ')
3654
3655 ########################################
3656 ## <summary>
3657 ##      Do not audit attempts to use user ttys.
3658 ## </summary>
3659 ## <param name="domain">
3660 ##      <summary>
3661 ##      Domain to not audit.
3662 ##      </summary>
3663 ## </param>
3664 #
3665 interface(`userdom_dontaudit_use_user_ttys',`
3666         gen_require(`
3667                 type user_tty_device_t;
3668         ')
3669
3670         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3671 ')
3672
3673 ########################################
3674 ## <summary>
3675 ##      Read the process state of all user domains.
3676 ## </summary>
3677 ## <param name="domain">
3678 ##      <summary>
3679 ##      Domain allowed access.
3680 ##      </summary>
3681 ## </param>
3682 #
3683 interface(`userdom_read_all_users_state',`
3684         gen_require(`
3685                 attribute userdomain;
3686         ')
3687
3688         read_files_pattern($1, userdomain, userdomain)
3689         read_lnk_files_pattern($1,userdomain,userdomain)
3690         kernel_search_proc($1)
3691 ')
3692
3693 ########################################
3694 ## <summary>
3695 ##      Get the attributes of all user domains.
3696 ## </summary>
3697 ## <param name="domain">
3698 ##      <summary>
3699 ##      Domain allowed access.
3700 ##      </summary>
3701 ## </param>
3702 #
3703 interface(`userdom_getattr_all_users',`
3704         gen_require(`
3705                 attribute userdomain;
3706         ')
3707
3708         allow $1 userdomain:process getattr;
3709 ')
3710
3711 ########################################
3712 ## <summary>
3713 ##      Inherit the file descriptors from all user domains
3714 ## </summary>
3715 ## <param name="domain">
3716 ##      <summary>
3717 ##      Domain allowed access.
3718 ##      </summary>
3719 ## </param>
3720 #
3721 interface(`userdom_use_all_users_fds',`
3722         gen_require(`
3723                 attribute userdomain;
3724         ')
3725
3726         allow $1 userdomain:fd use;
3727 ')
3728
3729 ########################################
3730 ## <summary>
3731 ##      Do not audit attempts to inherit the file
3732 ##      descriptors from any user domains.
3733 ## </summary>
3734 ## <param name="domain">
3735 ##      <summary>
3736 ##      Domain to not audit.
3737 ##      </summary>
3738 ## </param>
3739 #
3740 interface(`userdom_dontaudit_use_all_users_fds',`
3741         gen_require(`
3742                 attribute userdomain;
3743         ')
3744
3745         dontaudit $1 userdomain:fd use;
3746 ')
3747
3748 ########################################
3749 ## <summary>
3750 ##      Send general signals to all user domains.
3751 ## </summary>
3752 ## <param name="domain">
3753 ##      <summary>
3754 ##      Domain allowed access.
3755 ##      </summary>
3756 ## </param>
3757 #
3758 interface(`userdom_signal_all_users',`
3759         gen_require(`
3760                 attribute userdomain;
3761         ')
3762
3763         allow $1 userdomain:process signal;
3764 ')
3765
3766 ########################################
3767 ## <summary>
3768 ##      Send kill signals to all user domains.
3769 ## </summary>
3770 ## <param name="domain">
3771 ##      <summary>
3772 ##      Domain allowed access.
3773 ##      </summary>
3774 ## </param>
3775 #
3776 interface(`userdom_kill_all_users',`
3777         gen_require(`
3778                 attribute userdomain;
3779         ')
3780
3781         allow $1 userdomain:process sigkill;
3782 ')
3783
3784 ########################################
3785 ## <summary>
3786 ##      Send a SIGCHLD signal to all user domains.
3787 ## </summary>
3788 ## <param name="domain">
3789 ##      <summary>
3790 ##      Domain allowed access.
3791 ##      </summary>
3792 ## </param>
3793 #
3794 interface(`userdom_sigchld_all_users',`
3795         gen_require(`
3796                 attribute userdomain;
3797         ')
3798
3799         allow $1 userdomain:process sigchld;
3800 ')
3801
3802 ########################################
3803 ## <summary>
3804 ##      Create keys for all user domains.
3805 ## </summary>
3806 ## <param name="domain">
3807 ##      <summary>
3808 ##      Domain allowed access.
3809 ##      </summary>
3810 ## </param>
3811 #
3812 interface(`userdom_create_all_users_keys',`
3813         gen_require(`
3814                 attribute userdomain;
3815         ')
3816
3817         allow $1 userdomain:key create;
3818 ')
3819
3820 ########################################
3821 ## <summary>
3822 ##      Send a dbus message to all user domains.
3823 ## </summary>
3824 ## <param name="domain">
3825 ##      <summary>
3826 ##      Domain allowed access.
3827 ##      </summary>
3828 ## </param>
3829 #
3830 interface(`userdom_dbus_send_all_users',`
3831         gen_require(`
3832                 attribute userdomain;
3833                 class dbus send_msg;
3834         ')
3835
3836         allow $1 userdomain:dbus send_msg;
3837 ')
3838
3839 ########################################
3840 ## <summary>
3841 ##      Allow apps to set rlimits on userdomain
3842 ## </summary>
3843 ## <param name="domain">
3844 ##      <summary>
3845 ##      Domain allowed access.
3846 ##      </summary>
3847 ## </param>
3848 #
3849 interface(`userdom_set_rlimitnh',`
3850         gen_require(`
3851                 attribute userdomain;
3852         ')
3853
3854         allow $1 userdomain:process rlimitinh;
3855 ')
3856
3857 ########################################
3858 ## <summary>
3859 ##      Define this type as a Allow apps to set rlimits on userdomain
3860 ## </summary>
3861 ## <param name="domain">
3862 ##      <summary>
3863 ##      Domain allowed access.
3864 ##      </summary>
3865 ## </param>
3866 ## <param name="userdomain_prefix">
3867 ##      <summary>
3868 ##      The prefix of the user domain (e.g., user
3869 ##      is the prefix for user_t).
3870 ## </summary>
3871 ## </param>
3872 ## <param name="domain">
3873 ##      <summary>
3874 ##      Domain allowed access.
3875 ##      </summary>
3876 ## </param>
3877 #
3878 template(`userdom_unpriv_usertype',`
3879         gen_require(`
3880                 attribute unpriv_userdomain, userdomain;
3881                 attribute $1_usertype;
3882         ')
3883         typeattribute $2  $1_usertype;
3884         typeattribute $2  unpriv_userdomain;
3885         typeattribute $2  userdomain;
3886
3887         auth_use_nsswitch($2)
3888         ubac_constrained($2)
3889 ')
3890
3891 ########################################
3892 ## <summary>
3893 ##      Connect to users over an unix stream socket.
3894 ## </summary>
3895 ## <param name="domain">
3896 ##      <summary>
3897 ##      Domain allowed access.
3898 ##      </summary>
3899 ## </param>
3900 #
3901 interface(`userdom_stream_connect',`
3902         gen_require(`
3903                 type user_tmp_t;
3904                 attribute userdomain;
3905         ')
3906
3907         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3908 ')
3909
3910 ########################################
3911 ## <summary>
3912 ##      Ptrace user domains.
3913 ## </summary>
3914 ## <param name="domain">
3915 ##      <summary>
3916 ##      Domain allowed access.
3917 ##      </summary>
3918 ## </param>
3919 #
3920 interface(`userdom_ptrace_all_users',`
3921         gen_require(`
3922                 attribute userdomain;
3923         ')
3924
3925         allow $1 userdomain:process ptrace;
3926 ')
3927
3928 ########################################
3929 ## <summary>
3930 ##      dontaudit Search /root
3931 ## </summary>
3932 ## <param name="domain">
3933 ##      <summary>
3934 ##      Domain to not audit.
3935 ##      </summary>
3936 ## </param>
3937 #
3938 interface(`userdom_dontaudit_search_admin_dir',`
3939         gen_require(`
3940                 type admin_home_t;
3941         ')
3942
3943         dontaudit $1 admin_home_t:dir search_dir_perms;
3944 ')
3945
3946 ########################################
3947 ## <summary>
3948 ##      dontaudit list /root
3949 ## </summary>
3950 ## <param name="domain">
3951 ##      <summary>
3952 ##      Domain to not audit.
3953 ##      </summary>
3954 ## </param>
3955 #
3956 interface(`userdom_dontaudit_list_admin_dir',`
3957         gen_require(`
3958                 type admin_home_t;
3959         ')
3960
3961         dontaudit $1 admin_home_t:dir list_dir_perms;
3962 ')
3963
3964 ########################################
3965 ## <summary>
3966 ##      Allow domain to  list /root
3967 ## </summary>
3968 ## <param name="domain">
3969 ##      <summary>
3970 ##      Domain allowed access.
3971 ##      </summary>
3972 ## </param>
3973 #
3974 interface(`userdom_list_admin_dir',`
3975         gen_require(`
3976                 type admin_home_t;
3977         ')
3978
3979         allow $1 admin_home_t:dir list_dir_perms;
3980 ')
3981
3982 ########################################
3983 ## <summary>
3984 ##      Allow Search /root
3985 ## </summary>
3986 ## <param name="domain">
3987 ##      <summary>
3988 ##      Domain allowed access.
3989 ##      </summary>
3990 ## </param>
3991 #
3992 interface(`userdom_search_admin_dir',`
3993         gen_require(`
3994                 type admin_home_t;
3995         ')
3996
3997         allow $1 admin_home_t:dir search_dir_perms;
3998 ')
3999
4000 ########################################
4001 ## <summary>
4002 ##      RW unpriviledged user SysV sempaphores.
4003 ## </summary>
4004 ## <param name="domain">
4005 ##      <summary>
4006 ##      Domain allowed access.
4007 ##      </summary>
4008 ## </param>
4009 #
4010 interface(`userdom_rw_semaphores',`
4011         gen_require(`
4012                 attribute unpriv_userdomain;
4013         ')
4014
4015         allow $1 unpriv_userdomain:sem rw_sem_perms;
4016 ')
4017
4018 ########################################
4019 ## <summary>
4020 ##      Send a message to unpriv users over a unix domain
4021 ##      datagram socket.
4022 ## </summary>
4023 ## <param name="domain">
4024 ##      <summary>
4025 ##      Domain allowed access.
4026 ##      </summary>
4027 ## </param>
4028 #
4029 interface(`userdom_dgram_send',`
4030         gen_require(`
4031                 attribute unpriv_userdomain;
4032         ')
4033
4034         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4035 ')
4036
4037 ######################################
4038 ## <summary>
4039 ##      Send a message to users over a unix domain
4040 ##      datagram socket.
4041 ## </summary>
4042 ## <param name="domain">
4043 ##      <summary>
4044 ##      Domain allowed access.
4045 ##      </summary>
4046 ## </param>
4047 #
4048 interface(`userdom_users_dgram_send',`
4049         gen_require(`
4050                  attribute userdomain;
4051       ')
4052
4053        allow $1 userdomain:unix_dgram_socket sendto;
4054 ')
4055
4056 #######################################
4057 ## <summary>
4058 ##      Allow execmod on files in homedirectory
4059 ## </summary>
4060 ## <param name="domain">
4061 ##      <summary>
4062 ##      Domain allowed access.
4063 ##      </summary>
4064 ## </param>
4065 ## <rolebase/>
4066 #
4067 interface(`userdom_execmod_user_home_files',`
4068         gen_require(`
4069                 type user_home_type;
4070         ')
4071
4072         allow $1 user_home_type:file execmod;
4073 ')
4074
4075 ########################################
4076 ## <summary>
4077 ##      Read admin home files.
4078 ## </summary>
4079 ## <param name="domain">
4080 ##      <summary>
4081 ##      Domain allowed access.
4082 ##      </summary>
4083 ## </param>
4084 ## <rolecap/>
4085 #
4086 interface(`userdom_read_admin_home_files',`
4087         gen_require(`
4088                 type admin_home_t;
4089         ')
4090
4091         read_files_pattern($1, admin_home_t, admin_home_t)
4092 ')
4093
4094 ########################################
4095 ## <summary>
4096 ##      Execute admin home files.
4097 ## </summary>
4098 ## <param name="domain">
4099 ##      <summary>
4100 ##      Domain allowed access.
4101 ##      </summary>
4102 ## </param>
4103 ## <rolecap/>
4104 #
4105 interface(`userdom_exec_admin_home_files',`
4106         gen_require(`
4107                 type admin_home_t;
4108         ')
4109
4110         exec_files_pattern($1, admin_home_t, admin_home_t)
4111 ')
4112
4113 ########################################
4114 ## <summary>
4115 ##      Append files inherited
4116 ##      in the /root directory.
4117 ## </summary>
4118 ## <param name="domain">
4119 ##      <summary>
4120 ##      Domain allowed access.
4121 ##      </summary>
4122 ## </param>
4123 #
4124 interface(`userdom_inherit_append_admin_home_files',`
4125         gen_require(`
4126                 type admin_home_t;
4127         ')
4128
4129         allow $1 admin_home_t:file { getattr append };
4130 ')
4131
4132
4133 #######################################
4134 ## <summary>
4135 ##      Manage all files/directories in the homedir
4136 ## </summary>
4137 ## <param name="userdomain">
4138 ##      <summary>
4139 ##      The user domain
4140 ##      </summary>
4141 ## </param>
4142 ## <rolebase/>
4143 #
4144 interface(`userdom_manage_user_home_content',`
4145         gen_require(`
4146                 type user_home_dir_t, user_home_t;
4147                 attribute user_home_type;
4148         ')
4149
4150         files_list_home($1)
4151         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4152         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4153         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4154         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4155         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4156         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4157
4158 ')
4159
4160
4161 ########################################
4162 ## <summary>
4163 ##      Create objects in a user home directory
4164 ##      with an automatic type transition to
4165 ##      the user home file type.
4166 ## </summary>
4167 ## <param name="domain">
4168 ##      <summary>
4169 ##      Domain allowed access.
4170 ##      </summary>
4171 ## </param>
4172 ## <param name="object_class">
4173 ##      <summary>
4174 ##      The class of the object to be created.
4175 ##      </summary>
4176 ## </param>
4177 #
4178 interface(`userdom_user_home_dir_filetrans_pattern',`
4179         gen_require(`
4180                 type user_home_dir_t, user_home_t;
4181         ')
4182
4183         type_transition $1 user_home_dir_t:$2 user_home_t;
4184 ')
4185
4186 ########################################
4187 ## <summary>
4188 ##      Create objects in the /root directory
4189 ##      with an automatic type transition to
4190 ##      a specified private type.
4191 ## </summary>
4192 ## <param name="domain">
4193 ##      <summary>
4194 ##      Domain allowed access.
4195 ##      </summary>
4196 ## </param>
4197 ## <param name="private_type">
4198 ##      <summary>
4199 ##      The type of the object to create.
4200 ##      </summary>
4201 ## </param>
4202 ## <param name="object_class">
4203 ##      <summary>
4204 ##      The class of the object to be created.
4205 ##      </summary>
4206 ## </param>
4207 #
4208 interface(`userdom_admin_home_dir_filetrans',`
4209         gen_require(`
4210                 type admin_home_t;
4211         ')
4212
4213         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4214 ')
4215
4216 ########################################
4217 ## <summary>
4218 ##      Send signull to unprivileged user domains.
4219 ## </summary>
4220 ## <param name="domain">
4221 ##      <summary>
4222 ##      Domain allowed access.
4223 ##      </summary>
4224 ## </param>
4225 #
4226 interface(`userdom_signull_unpriv_users',`
4227         gen_require(`
4228                 attribute unpriv_userdomain;
4229         ')
4230
4231         allow $1 unpriv_userdomain:process signull;
4232 ')
4233
4234 ########################################
4235 ## <summary>
4236 ##      Write all users files in /tmp
4237 ## </summary>
4238 ## <param name="domain">
4239 ##      <summary>
4240 ##      Domain allowed access.
4241 ##      </summary>
4242 ## </param>
4243 #
4244 interface(`userdom_write_user_tmp_dirs',`
4245         gen_require(`
4246                 type user_tmp_t;
4247         ')
4248
4249         write_files_pattern($1, user_tmp_t, user_tmp_t)
4250 ')
4251
4252 ########################################
4253 ## <summary>
4254 ##      Manage keys for all user domains.
4255 ## </summary>
4256 ## <param name="domain">
4257 ##      <summary>
4258 ##      Domain allowed access.
4259 ##      </summary>
4260 ## </param>
4261 #
4262 interface(`userdom_manage_all_users_keys',`
4263         gen_require(`
4264                 attribute userdomain;
4265         ')
4266
4267         allow $1 userdomain:key manage_key_perms;
4268 ')
4269
4270
4271 ########################################
4272 ## <summary>
4273 ##      Do not audit attempts to read and write
4274 ##      unserdomain stream.
4275 ## </summary>
4276 ## <param name="domain">
4277 ##      <summary>
4278 ##      Domain to not audit.
4279 ##      </summary>
4280 ## </param>
4281 #
4282 interface(`userdom_dontaudit_rw_stream',`
4283         gen_require(`
4284                 attribute userdomain;
4285         ')
4286
4287         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4288 ')
4289
4290 ########################################
4291 ## <summary>
4292 ##      Do not audit attempts to read and write
4293 ##      unserdomain datagram socket.
4294 ## </summary>
4295 ## <param name="domain">
4296 ##      <summary>
4297 ##      Domain to not audit.
4298 ##      </summary>
4299 ## </param>
4300 #
4301 interface(`userdom_dontaudit_rw_dgram_socket',`
4302         gen_require(`
4303                 attribute userdomain;
4304         ')
4305
4306         dontaudit $1 userdomain:unix_dgram_socket { read write };
4307 ')
4308
4309 ########################################
4310 ## <summary>
4311 ##      Append files
4312 ##      in a user home subdirectory.
4313 ## </summary>
4314 ## <param name="domain">
4315 ##      <summary>
4316 ##      Domain allowed access.
4317 ##      </summary>
4318 ## </param>
4319 #
4320 interface(`userdom_append_user_home_content_files',`
4321         gen_require(`
4322                 type user_home_dir_t, user_home_t;
4323         ')
4324
4325         append_files_pattern($1, user_home_t, user_home_t)
4326         allow $1 user_home_dir_t:dir search_dir_perms;
4327         files_search_home($1)
4328 ')
4329
4330 ########################################
4331 ## <summary>
4332 ##      Read files inherited
4333 ##      in a user home subdirectory.
4334 ## </summary>
4335 ## <param name="domain">
4336 ##      <summary>
4337 ##      Domain allowed access.
4338 ##      </summary>
4339 ## </param>
4340 #
4341 interface(`userdom_read_inherited_user_home_content_files',`
4342         gen_require(`
4343                 attribute user_home_type;
4344         ')
4345
4346         allow $1 user_home_type:file { getattr read };
4347 ')
4348
4349 ########################################
4350 ## <summary>
4351 ##      Append files inherited
4352 ##      in a user home subdirectory.
4353 ## </summary>
4354 ## <param name="domain">
4355 ##      <summary>
4356 ##      Domain allowed access.
4357 ##      </summary>
4358 ## </param>
4359 #
4360 interface(`userdom_inherit_append_user_home_content_files',`
4361         gen_require(`
4362                 type user_home_t;
4363         ')
4364
4365         allow $1 user_home_t:file { getattr append };
4366 ')
4367
4368 ########################################
4369 ## <summary>
4370 ##      Append files inherited
4371 ##      in a user tmp files.
4372 ## </summary>
4373 ## <param name="domain">
4374 ##      <summary>
4375 ##      Domain allowed access.
4376 ##      </summary>
4377 ## </param>
4378 #
4379 interface(`userdom_inherit_append_user_tmp_files',`
4380         gen_require(`
4381                 type user_tmp_t;
4382         ')
4383
4384         allow $1 user_tmp_t:file { getattr append };
4385 ')
4386
4387 ######################################
4388 ## <summary>
4389 ##      Read audio files in the users homedir.
4390 ## </summary>
4391 ## <param name="domain">
4392 ##      <summary>
4393 ##      Domain allowed access.
4394 ##      </summary>
4395 ## </param>
4396 ## <rolecap/>
4397 #
4398 interface(`userdom_read_home_audio_files',`
4399         gen_require(`
4400                 type audio_home_t;
4401         ')
4402
4403         userdom_search_user_home_dirs($1)
4404         allow $1 audio_home_t:dir list_dir_perms;
4405         read_files_pattern($1, audio_home_t, audio_home_t)
4406         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4407 ')
4408
4409 ########################################
4410 ## <summary>
4411 ##      Do not audit attempts to write all user home content files.
4412 ## </summary>
4413 ## <param name="domain">
4414 ##      <summary>
4415 ##      Domain to not audit.
4416 ##      </summary>
4417 ## </param>
4418 #
4419 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4420         gen_require(`
4421                 attribute user_home_type;
4422         ')
4423
4424         dontaudit $1 user_home_type:file write_file_perms;
4425 ')
4426
4427 ########################################
4428 ## <summary>
4429 ##      Do not audit attempts to write all user tmp content files.
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain to not audit.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4438         gen_require(`
4439                 attribute user_tmp_type;
4440         ')
4441
4442         dontaudit $1 user_tmp_type:file write_file_perms;
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      Manage all user temporary content.
4448 ## </summary>
4449 ## <param name="domain">
4450 ##      <summary>
4451 ##      Domain allowed access.
4452 ##      </summary>
4453 ## </param>
4454 #
4455 interface(`userdom_manage_all_user_tmp_content',`
4456         gen_require(`
4457                 attribute user_tmp_type;
4458         ')
4459
4460         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4461         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4462         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4463         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4464         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4465         files_search_tmp($1)
4466 ')
4467
4468 ########################################
4469 ## <summary>
4470 ##      List all user temporary content.
4471 ## </summary>
4472 ## <param name="domain">
4473 ##      <summary>
4474 ##      Domain allowed access.
4475 ##      </summary>
4476 ## </param>
4477 #
4478 interface(`userdom_list_all_user_tmp_content',`
4479         gen_require(`
4480                 attribute user_tmp_type;
4481         ')
4482
4483         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4484         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4485         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4486         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4487         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4488         files_search_var($1)
4489         files_search_tmp($1)
4490 ')
4491
4492 ########################################
4493 ## <summary>
4494 ##      Manage all user tmpfs content.
4495 ## </summary>
4496 ## <param name="domain">
4497 ##      <summary>
4498 ##      Domain allowed access.
4499 ##      </summary>
4500 ## </param>
4501 #
4502 interface(`userdom_manage_all_user_tmpfs_content',`
4503         gen_require(`
4504                 attribute user_tmpfs_type;
4505         ')
4506
4507         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4508         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4509         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4510         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4511         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4512         fs_search_tmpfs($1)
4513 ')
4514
4515 ########################################
4516 ## <summary>
4517 ##      Delete all user temporary content.
4518 ## </summary>
4519 ## <param name="domain">
4520 ##      <summary>
4521 ##      Domain allowed access.
4522 ##      </summary>
4523 ## </param>
4524 #
4525 interface(`userdom_delete_all_user_tmp_content',`
4526         gen_require(`
4527                 attribute user_tmp_type;
4528         ')
4529
4530         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4531         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4532         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4533         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4534         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4535         # /var/tmp
4536         files_search_var($1)
4537         files_delete_tmp_dir_entry($1)
4538 ')
4539
4540 ########################################
4541 ## <summary>
4542 ##      Read system SSL certificates in the users homedir.
4543 ## </summary>
4544 ## <param name="domain">
4545 ##      <summary>
4546 ##      Domain allowed access.
4547 ##      </summary>
4548 ## </param>
4549 #
4550 interface(`userdom_read_home_certs',`
4551         gen_require(`
4552                 type home_cert_t;
4553         ')
4554
4555         userdom_search_user_home_content($1)
4556         allow $1 home_cert_t:dir list_dir_perms;
4557         read_files_pattern($1, home_cert_t, home_cert_t)
4558         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4559 ')
4560
4561 #######################################
4562 ## <summary>
4563 ##  Dontaudit Write system SSL certificates in the users homedir.
4564 ## </summary>
4565 ## <param name="domain">
4566 ##  <summary>
4567 ##      Domain to not audit.
4568 ##  </summary>
4569 ## </param>
4570 #
4571 interface(`userdom_dontaudit_write_home_certs',`
4572     gen_require(`
4573         type home_cert_t;
4574     ')
4575
4576     dontaudit $1 home_cert_t:file write;
4577 ')
4578
4579 ########################################
4580 ## <summary>
4581 ##      dontaudit Search getatrr /root files
4582 ## </summary>
4583 ## <param name="domain">
4584 ##      <summary>
4585 ##      Domain to not audit.
4586 ##      </summary>
4587 ## </param>
4588 #
4589 interface(`userdom_dontaudit_getattr_admin_home_files',`
4590         gen_require(`
4591                 type admin_home_t;
4592         ')
4593
4594         dontaudit $1 admin_home_t:file getattr;
4595 ')
4596
4597 ########################################
4598 ## <summary>
4599 ##      dontaudit read /root lnk files
4600 ## </summary>
4601 ## <param name="domain">
4602 ##      <summary>
4603 ##      Domain to not audit.
4604 ##      </summary>
4605 ## </param>
4606 #
4607 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4608         gen_require(`
4609                 type admin_home_t;
4610         ')
4611
4612         dontaudit $1 admin_home_t:lnk_file read;
4613 ')
4614
4615 ########################################
4616 ## <summary>
4617 ##      dontaudit read /root files
4618 ## </summary>
4619 ## <param name="domain">
4620 ##      <summary>
4621 ##      Domain to not audit.
4622 ##      </summary>
4623 ## </param>
4624 #
4625 interface(`userdom_dontaudit_read_admin_home_files',`
4626         gen_require(`
4627                 type admin_home_t;
4628         ')
4629
4630         dontaudit $1 admin_home_t:file read_file_perms;
4631 ')
4632
4633 ########################################
4634 ## <summary>
4635 ##      Create, read, write, and delete user
4636 ##      temporary chr files.
4637 ## </summary>
4638 ## <param name="domain">
4639 ##      <summary>
4640 ##      Domain allowed access.
4641 ##      </summary>
4642 ## </param>
4643 #
4644 interface(`userdom_manage_user_tmp_chr_files',`
4645         gen_require(`
4646                 type user_tmp_t;
4647         ')
4648
4649         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4650         files_search_tmp($1)
4651 ')
4652
4653 ########################################
4654 ## <summary>
4655 ##      Create, read, write, and delete user
4656 ##      temporary blk files.
4657 ## </summary>
4658 ## <param name="domain">
4659 ##      <summary>
4660 ##      Domain allowed access.
4661 ##      </summary>
4662 ## </param>
4663 #
4664 interface(`userdom_manage_user_tmp_blk_files',`
4665         gen_require(`
4666                 type user_tmp_t;
4667         ')
4668
4669         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4670         files_search_tmp($1)
4671 ')
4672
4673 ########################################
4674 ## <summary>
4675 ##      Dontaudit attempt to set attributes on  user temporary directories.
4676 ## </summary>
4677 ## <param name="domain">
4678 ##      <summary>
4679 ##      Domain to not audit.
4680 ##      </summary>
4681 ## </param>
4682 #
4683 interface(`userdom_dontaudit_setattr_user_tmp',`
4684         gen_require(`
4685                 type user_tmp_t;
4686         ')
4687
4688         dontaudit $1 user_tmp_t:dir setattr;
4689 ')
4690
4691 ########################################
4692 ## <summary>
4693 ##      Write all inherited users files in /tmp
4694 ## </summary>
4695 ## <param name="domain">
4696 ##      <summary>
4697 ##      Domain allowed access.
4698 ##      </summary>
4699 ## </param>
4700 #
4701 interface(`userdom_write_inherited_user_tmp_files',`
4702         gen_require(`
4703                 type user_tmp_t;
4704         ')
4705
4706         allow $1 user_tmp_t:file write;
4707 ')
4708
4709 ########################################
4710 ## <summary>
4711 ##      Delete all users files in /tmp
4712 ## </summary>
4713 ## <param name="domain">
4714 ##      <summary>
4715 ##      Domain allowed access.
4716 ##      </summary>
4717 ## </param>
4718 #
4719 interface(`userdom_delete_user_tmp_files',`
4720         gen_require(`
4721                 type user_tmp_t;
4722         ')
4723
4724         allow $1 user_tmp_t:file delete_file_perms;
4725 ')
4726
4727 ########################################
4728 ## <summary>
4729 ##      Delete user tmpfs files.
4730 ## </summary>
4731 ## <param name="domain">
4732 ##      <summary>
4733 ##      Domain allowed access.
4734 ##      </summary>
4735 ## </param>
4736 #
4737 interface(`userdom_delete_user_tmpfs_files',`
4738         gen_require(`
4739                 type user_tmpfs_t;
4740         ')
4741
4742         allow $1 user_tmpfs_t:file delete_file_perms;
4743 ')
4744
4745 ########################################
4746 ## <summary>
4747 ##      Read/Write unpriviledged user SysV shared
4748 ##      memory segments.
4749 ## </summary>
4750 ## <param name="domain">
4751 ##      <summary>
4752 ##      Domain allowed access.
4753 ##      </summary>
4754 ## </param>
4755 #
4756 interface(`userdom_rw_unpriv_user_shared_mem',`
4757         gen_require(`
4758                 attribute unpriv_userdomain;
4759         ')
4760
4761         allow $1 unpriv_userdomain:shm rw_shm_perms;
4762 ')
4763
4764 ########################################
4765 ## <summary>
4766 ##      Do not audit attempts to search user
4767 ##      temporary directories.
4768 ## </summary>
4769 ## <param name="domain">
4770 ##      <summary>
4771 ##      Domain to not audit.
4772 ##      </summary>
4773 ## </param>
4774 #
4775 interface(`userdom_dontaudit_search_user_tmp',`
4776         gen_require(`
4777                 type user_tmp_t;
4778         ')
4779
4780         dontaudit $1 user_tmp_t:dir search_dir_perms;
4781 ')
4782
4783 ########################################
4784 ## <summary>
4785 ##      Execute a file in a user home directory
4786 ##      in the specified domain.
4787 ## </summary>
4788 ## <desc>
4789 ##      <p>
4790 ##      Execute a file in a user home directory
4791 ##      in the specified domain.
4792 ##      </p>
4793 ##      <p>
4794 ##      No interprocess communication (signals, pipes,
4795 ##      etc.) is provided by this interface since
4796 ##      the domains are not owned by this module.
4797 ##      </p>
4798 ## </desc>
4799 ## <param name="domain">
4800 ##      <summary>
4801 ##      Domain allowed access.
4802 ##      </summary>
4803 ## </param>
4804 ## <param name="target_domain">
4805 ##      <summary>
4806 ##      The type of the new process.
4807 ##      </summary>
4808 ## </param>
4809 #
4810 interface(`userdom_domtrans_user_home',`
4811         gen_require(`
4812                 type user_home_t;
4813         ')
4814
4815         read_lnk_files_pattern($1, user_home_t, user_home_t)
4816         domain_transition_pattern($1, user_home_t, $2)
4817         type_transition $1 user_home_t:process $2;
4818 ')
4819
4820 ########################################
4821 ## <summary>
4822 ##      Execute a file in a user tmp directory
4823 ##      in the specified domain.
4824 ## </summary>
4825 ## <desc>
4826 ##      <p>
4827 ##      Execute a file in a user tmp directory
4828 ##      in the specified domain.
4829 ##      </p>
4830 ##      <p>
4831 ##      No interprocess communication (signals, pipes,
4832 ##      etc.) is provided by this interface since
4833 ##      the domains are not owned by this module.
4834 ##      </p>
4835 ## </desc>
4836 ## <param name="domain">
4837 ##      <summary>
4838 ##      Domain allowed access.
4839 ##      </summary>
4840 ## </param>
4841 ## <param name="target_domain">
4842 ##      <summary>
4843 ##      The type of the new process.
4844 ##      </summary>
4845 ## </param>
4846 #
4847 interface(`userdom_domtrans_user_tmp',`
4848         gen_require(`
4849                 type user_tmp_t;
4850         ')
4851
4852         files_search_tmp($1)
4853         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4854         domain_transition_pattern($1, user_tmp_t, $2)
4855         type_transition $1 user_tmp_t:process $2;
4856 ')
4857
4858 ########################################
4859 ## <summary>
4860 ##      Do not audit attempts to read all user home content files.
4861 ## </summary>
4862 ## <param name="domain">
4863 ##      <summary>
4864 ##      Domain to not audit.
4865 ##      </summary>
4866 ## </param>
4867 #
4868 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4869         gen_require(`
4870                 attribute user_home_type;
4871         ')
4872
4873         dontaudit $1 user_home_type:file read_file_perms;
4874 ')
4875
4876 ########################################
4877 ## <summary>
4878 ##      Do not audit attempts to read all user tmp content files.
4879 ## </summary>
4880 ## <param name="domain">
4881 ##      <summary>
4882 ##      Domain to not audit.
4883 ##      </summary>
4884 ## </param>
4885 #
4886 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4887         gen_require(`
4888                 attribute user_tmp_type;
4889         ')
4890
4891         dontaudit $1 user_tmp_type:file read_file_perms;
4892 ')
4893
4894 #######################################
4895 ## <summary>
4896 ## Read and write unpriviledged user SysV sempaphores.
4897 ## </summary>
4898 ## <param name="domain">
4899 ## <summary>
4900 ## Domain allowed access.
4901 ## </summary>
4902 ## </param>
4903 #
4904 interface(`userdom_rw_unpriv_user_semaphores',`
4905    gen_require(`
4906        attribute unpriv_userdomain;
4907    ')
4908
4909    allow $1 unpriv_userdomain:sem rw_sem_perms;
4910 ')