policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 type user_tmp_t;
 321         ')
 322
 323         role $1 types user_tmp_t;
 324
 325         files_poly_member_tmp($2, user_tmp_t)
 326
 327         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 330         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 331         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 332         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 333         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 334 ')
 335
 336 #######################################
 337 ## <summary>
 338 ##      Dontaudit search of user bin dirs.
 339 ## </summary>
 340 ## <param name="domain">
 341 ##      <summary>
 342 ##      Domain to not audit.
 343 ##      </summary>
 344 ## </param>
 345 #
 346 interface(`userdom_dontaudit_search_user_bin_dirs',`
 347         gen_require(`
 348                 type home_bin_t;
 349         ')
 350
 351         dontaudit $1 home_bin_t:dir search_dir_perms;
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Execute user bin files.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain allowed access.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_exec_user_bin_files',`
 365         gen_require(`
 366                 attribute user_home_type;
 367                 type home_bin_t, user_home_dir_t;
 368         ')
 369
 370         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 371         files_search_home($1)
 372 ')
 373
 374 #######################################
 375 ## <summary>
 376 ##      The execute access user temporary files.
 377 ## </summary>
 378 ## <param name="domain">
 379 ##      <summary>
 380 ##      Domain allowed access.
 381 ##      </summary>
 382 ## </param>
 383 ## <rolebase/>
 384 #
 385 interface(`userdom_exec_user_tmp_files',`
 386         gen_require(`
 387                 type user_tmp_t;
 388         ')
 389
 390         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 391         dontaudit $1 user_tmp_t:sock_file execute;
 392         files_search_tmp($1)
 393 ')
 394
 395 #######################################
 396 ## <summary>
 397 ##      Role access for the user tmpfs type
 398 ##      that the user has full access.
 399 ## </summary>
 400 ## <desc>
 401 ##      <p>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ##      </p>
 405 ##      <p>
 406 ##      This does not allow execute access.
 407 ##      </p>
 408 ## </desc>
 409 ## <param name="role">
 410 ##      <summary>
 411 ##      Role allowed access.
 412 ##      </summary>
 413 ## </param>
 414 ## <param name="domain">
 415 ##      <summary>
 416 ##      Domain allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <rolecap/>
 420 #
 421 interface(`userdom_manage_tmpfs_role',`
 422         gen_require(`
 423                 type user_tmpfs_t;
 424         ')
 425
 426         role $1 types user_tmpfs_t;
 427
 428         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 432         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 433         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 434 ')
 435
 436 #######################################
 437 ## <summary>
 438 ##      The interface allowing the user basic
 439 ##      network permissions
 440 ## </summary>
 441 ## <param name="userdomain">
 442 ##      <summary>
 443 ##      The user domain
 444 ##      </summary>
 445 ## </param>
 446 ## <rolebase/>
 447 #
 448 interface(`userdom_basic_networking',`
 449
 450         allow $1 self:tcp_socket create_stream_socket_perms;
 451         allow $1 self:udp_socket create_socket_perms;
 452
 453         corenet_all_recvfrom_unlabeled($1)
 454         corenet_all_recvfrom_netlabel($1)
 455         corenet_tcp_sendrecv_generic_if($1)
 456         corenet_udp_sendrecv_generic_if($1)
 457         corenet_tcp_sendrecv_generic_node($1)
 458         corenet_udp_sendrecv_generic_node($1)
 459         corenet_tcp_sendrecv_all_ports($1)
 460         corenet_udp_sendrecv_all_ports($1)
 461         corenet_tcp_connect_all_ports($1)
 462         corenet_sendrecv_all_client_packets($1)
 463
 464         optional_policy(`
 465                 init_tcp_recvfrom_all_daemons($1)
 466                 init_udp_recvfrom_all_daemons($1)
 467         ')
 468
 469         optional_policy(`
 470                 ipsec_match_default_spd($1)
 471         ')
 472
 473 ')
 474
 475 #######################################
 476 ## <summary>
 477 ##      The template for creating a user xwindows client.  (Deprecated)
 478 ## </summary>
 479 ## <param name="userdomain_prefix">
 480 ##      <summary>
 481 ##      The prefix of the user domain (e.g., user
 482 ##      is the prefix for user_t).
 483 ##      </summary>
 484 ## </param>
 485 ## <rolebase/>
 486 #
 487 template(`userdom_xwindows_client_template',`
 488         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 489         gen_require(`
 490                 type $1_t, user_tmpfs_t;
 491         ')
 492
 493         dev_rw_xserver_misc($1_t)
 494         dev_rw_power_management($1_t)
 495         dev_read_input($1_t)
 496         dev_read_misc($1_t)
 497         dev_write_misc($1_t)
 498         # open office is looking for the following
 499         dev_getattr_agp_dev($1_t)
 500         dev_dontaudit_rw_dri($1_t)
 501         # GNOME checks for usb and other devices:
 502         dev_rw_usbfs($1_t)
 503         dev_rw_generic_usb_dev($1_t)
 504
 505         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 506         xserver_xsession_entry_type($1_t)
 507         xserver_dontaudit_write_log($1_t)
 508         xserver_stream_connect_xdm($1_t)
 509         # certain apps want to read xdm.pid file
 510         xserver_read_xdm_pid($1_t)
 511         # gnome-session creates socket under /tmp/.ICE-unix/
 512         xserver_create_xdm_tmp_sockets($1_t)
 513         # Needed for escd, remove if we get escd policy
 514         xserver_manage_xdm_tmp_files($1_t)
 515 ')
 516
 517 #######################################
 518 ## <summary>
 519 ##      The template for allowing the user to change passwords.
 520 ## </summary>
 521 ## <param name="userdomain_prefix">
 522 ##      <summary>
 523 ##      The prefix of the user domain (e.g., user
 524 ##      is the prefix for user_t).
 525 ##      </summary>
 526 ## </param>
 527 ## <rolebase/>
 528 #
 529 template(`userdom_change_password_template',`
 530         gen_require(`
 531                 type $1_t;
 532                 role $1_r;
 533         ')
 534
 535         optional_policy(`
 536                 usermanage_run_chfn($1_t,$1_r)
 537                 usermanage_run_passwd($1_t,$1_r)
 538         ')
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template containing rules common to unprivileged
 544 ##      users and administrative users.
 545 ## </summary>
 546 ## <desc>
 547 ##      <p>
 548 ##      This template creates a user domain, types, and
 549 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 550 ##      </p>
 551 ## </desc>
 552 ## <param name="userdomain_prefix">
 553 ##      <summary>
 554 ##      The prefix of the user domain (e.g., user
 555 ##      is the prefix for user_t).
 556 ##      </summary>
 557 ## </param>
 558 #
 559 template(`userdom_common_user_template',`
 560         gen_require(`
 561                 attribute unpriv_userdomain;
 562         ')
 563
 564         userdom_basic_networking($1_usertype)
 565
 566         ##############################
 567         #
 568         # User domain Local policy
 569         #
 570
 571         # evolution and gnome-session try to create a netlink socket
 572         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 573         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 574         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 575         allow $1_t self:socket create_socket_perms;
 576
 577         allow $1_usertype unpriv_userdomain:fd use;
 578
 579         kernel_read_system_state($1_usertype)
 580         kernel_read_network_state($1_usertype)
 581         kernel_read_software_raid_state($1_usertype)
 582         kernel_read_net_sysctls($1_usertype)
 583         # Very permissive allowing every domain to see every type:
 584         kernel_get_sysvipc_info($1_usertype)
 585         # Find CDROM devices:
 586         kernel_read_device_sysctls($1_usertype)
 587         kernel_request_load_module($1_usertype)
 588
 589         corenet_udp_bind_generic_node($1_usertype)
 590         corenet_udp_bind_generic_port($1_usertype)
 591
 592         dev_read_rand($1_usertype)
 593         dev_write_sound($1_usertype)
 594         dev_read_sound($1_usertype)
 595         dev_read_sound_mixer($1_usertype)
 596         dev_write_sound_mixer($1_usertype)
 597
 598         files_exec_etc_files($1_usertype)
 599         files_search_locks($1_usertype)
 600         # Check to see if cdrom is mounted
 601         files_search_mnt($1_usertype)
 602         # cjp: perhaps should cut back on file reads:
 603         files_read_var_files($1_usertype)
 604         files_read_var_symlinks($1_usertype)
 605         files_read_generic_spool($1_usertype)
 606         files_read_var_lib_files($1_usertype)
 607         # Stat lost+found.
 608         files_getattr_lost_found_dirs($1_usertype)
 609         files_read_config_files($1_usertype)
 610         fs_read_noxattr_fs_files($1_usertype)
 611         fs_read_noxattr_fs_symlinks($1_usertype)
 612         fs_rw_cgroup_files($1_usertype)
 613
 614         application_getattr_socket($1_usertype)
 615
 616         logging_send_syslog_msg($1_usertype)
 617         logging_send_audit_msgs($1_usertype)
 618         selinux_get_enforce_mode($1_usertype)
 619
 620         # cjp: some of this probably can be removed
 621         selinux_get_fs_mount($1_usertype)
 622         selinux_validate_context($1_usertype)
 623         selinux_compute_access_vector($1_usertype)
 624         selinux_compute_create_context($1_usertype)
 625         selinux_compute_relabel_context($1_usertype)
 626         selinux_compute_user_contexts($1_usertype)
 627
 628         # for eject
 629         storage_getattr_fixed_disk_dev($1_usertype)
 630
 631         auth_read_login_records($1_usertype)
 632         auth_run_pam($1_t,$1_r)
 633         auth_run_utempter($1_t,$1_r)
 634
 635         init_read_utmp($1_usertype)
 636
 637         seutil_read_file_contexts($1_usertype)
 638         seutil_read_default_contexts($1_usertype)
 639         seutil_run_newrole($1_t,$1_r)
 640         seutil_exec_checkpolicy($1_t)
 641         seutil_exec_setfiles($1_usertype)
 642         # for when the network connection is killed
 643         # this is needed when a login role can change
 644         # to this one.
 645         seutil_dontaudit_signal_newrole($1_t)
 646
 647         tunable_policy(`user_direct_mouse',`
 648                 dev_read_mouse($1_usertype)
 649         ')
 650
 651         tunable_policy(`user_ttyfile_stat',`
 652                 term_getattr_all_ttys($1_t)
 653         ')
 654
 655         optional_policy(`
 656                 alsa_read_rw_config($1_usertype)
 657                 alsa_manage_home_files($1_t)
 658                 alsa_relabel_home_files($1_t)
 659         ')
 660
 661         optional_policy(`
 662                 # Allow graphical boot to check battery lifespan
 663                 apm_stream_connect($1_usertype)
 664         ')
 665
 666         optional_policy(`
 667                 canna_stream_connect($1_usertype)
 668         ')
 669
 670         optional_policy(`
 671                 chrome_role($1_r, $1_usertype)
 672         ')
 673
 674         optional_policy(`
 675                 colord_read_lib_files($1_usertype)
 676         ')
 677
 678         optional_policy(`
 679                 dbus_system_bus_client($1_usertype)
 680
 681                 allow $1_usertype $1_usertype:dbus  send_msg;
 682
 683                 optional_policy(`
 684                         avahi_dbus_chat($1_usertype)
 685                 ')
 686
 687                 optional_policy(`
 688                         policykit_dbus_chat($1_usertype)
 689                 ')
 690
 691                 optional_policy(`
 692                         bluetooth_dbus_chat($1_usertype)
 693                 ')
 694
 695                 optional_policy(`
 696                         consolekit_dbus_chat($1_usertype)
 697                         consolekit_read_log($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         devicekit_dbus_chat($1_usertype)
 702                         devicekit_dbus_chat_power($1_usertype)
 703                         devicekit_dbus_chat_disk($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         evolution_dbus_chat($1_usertype)
 708                         evolution_alarm_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         gnome_dbus_chat_gconfdefault($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         hal_dbus_chat($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         kde_dbus_chat_backlighthelper($1_usertype)
 721                 ')
 722
 723                 optional_policy(`
 724                         modemmanager_dbus_chat($1_usertype)
 725                 ')
 726
 727                 optional_policy(`
 728                         networkmanager_dbus_chat($1_usertype)
 729                         networkmanager_read_lib_files($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         vpn_dbus_chat($1_usertype)
 734                 ')
 735         ')
 736
 737         optional_policy(`
 738                 git_session_role($1_r, $1_usertype)
 739         ')
 740
 741         optional_policy(`
 742                 inetd_use_fds($1_usertype)
 743                 inetd_rw_tcp_sockets($1_usertype)
 744         ')
 745
 746         optional_policy(`
 747                 inn_read_config($1_usertype)
 748                 inn_read_news_lib($1_usertype)
 749                 inn_read_news_spool($1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 lircd_stream_connect($1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 locate_read_lib_files($1_usertype)
 758         ')
 759
 760         # for running depmod as part of the kernel packaging process
 761         optional_policy(`
 762                 modutils_read_module_config($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 mta_rw_spool($1_usertype)
 767                 mta_manage_queue($1_usertype)
 768                 mta_filetrans_home_content($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 nsplugin_role($1_r, $1_usertype)
 773         ')
 774
 775         optional_policy(`
 776                 tunable_policy(`allow_user_mysql_connect',`
 777                         mysql_stream_connect($1_t)
 778                 ')
 779         ')
 780
 781         optional_policy(`
 782                 oident_manage_user_content($1_t)
 783                 oident_relabel_user_content($1_t)
 784         ')
 785
 786         optional_policy(`
 787                 # to allow monitoring of pcmcia status
 788                 pcmcia_read_pid($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 pcscd_read_pub_files($1_usertype)
 793                 pcscd_stream_connect($1_usertype)
 794         ')
 795
 796         optional_policy(`
 797                 tunable_policy(`allow_user_postgresql_connect',`
 798                         postgresql_stream_connect($1_usertype)
 799                         postgresql_tcp_connect($1_usertype)
 800                 ')
 801         ')
 802
 803         optional_policy(`
 804                 resmgr_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 rpc_dontaudit_getattr_exports($1_usertype)
 809                 rpc_manage_nfs_rw_content($1_usertype)
 810         ')
 811
 812         optional_policy(`
 813                 rpcbind_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 samba_stream_connect_winbind($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 sandbox_transition($1_usertype, $1_r)
 822         ')
 823
 824         optional_policy(`
 825                 seunshare_role_template($1, $1_r, $1_t)
 826         ')
 827
 828         optional_policy(`
 829                 slrnpull_search_spool($1_usertype)
 830         ')
 831
 832 ')
 833
 834 #######################################
 835 ## <summary>
 836 ##      The template for creating a login user.
 837 ## </summary>
 838 ## <desc>
 839 ##      <p>
 840 ##      This template creates a user domain, types, and
 841 ##      rules for the user's tty, pty, home directories,
 842 ##      tmp, and tmpfs files.
 843 ##      </p>
 844 ## </desc>
 845 ## <param name="userdomain_prefix">
 846 ##      <summary>
 847 ##      The prefix of the user domain (e.g., user
 848 ##      is the prefix for user_t).
 849 ##      </summary>
 850 ## </param>
 851 #
 852 template(`userdom_login_user_template', `
 853         gen_require(`
 854                 class context contains;
 855         ')
 856
 857         userdom_base_user_template($1)
 858
 859         userdom_manage_home_role($1_r, $1_usertype)
 860
 861         userdom_manage_tmp_role($1_r, $1_usertype)
 862         userdom_manage_tmpfs_role($1_r, $1_usertype)
 863
 864         ifelse(`$1',`unconfined',`',`
 865                 gen_tunable(allow_$1_exec_content, true)
 866
 867                 tunable_policy(`allow_$1_exec_content',`
 868                         userdom_exec_user_tmp_files($1_usertype)
 869                         userdom_exec_user_home_content_files($1_usertype)
 870                 ')
 871                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 872                         fs_exec_nfs_files($1_usertype)
 873                 ')
 874
 875                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 876                         fs_exec_cifs_files($1_usertype)
 877                 ')
 878         ')
 879
 880         userdom_change_password_template($1)
 881
 882         ##############################
 883         #
 884         # User domain Local policy
 885         #
 886
 887         allow $1_t self:capability { setgid chown fowner };
 888         dontaudit $1_t self:capability { sys_nice fsetid };
 889
 890         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 891         dontaudit $1_t self:process setrlimit;
 892         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 893
 894         allow $1_t self:context contains;
 895
 896         kernel_dontaudit_read_system_state($1_usertype)
 897         kernel_dontaudit_list_all_proc($1_usertype)
 898
 899         dev_read_sysfs($1_usertype)
 900         dev_read_urand($1_usertype)
 901
 902         domain_use_interactive_fds($1_usertype)
 903         # Command completion can fire hundreds of denials
 904         domain_dontaudit_exec_all_entry_files($1_usertype)
 905
 906         files_dontaudit_list_default($1_usertype)
 907         files_dontaudit_read_default_files($1_usertype)
 908         # Stat lost+found.
 909         files_getattr_lost_found_dirs($1_usertype)
 910
 911         fs_get_all_fs_quotas($1_usertype)
 912         fs_getattr_all_fs($1_usertype)
 913         fs_search_all($1_usertype)
 914         fs_list_inotifyfs($1_usertype)
 915         fs_rw_anon_inodefs_files($1_usertype)
 916
 917         auth_dontaudit_write_login_records($1_t)
 918         auth_rw_cache($1_t)
 919
 920         # Stop warnings about access to /dev/console
 921         init_dontaudit_use_fds($1_usertype)
 922         init_dontaudit_use_script_fds($1_usertype)
 923
 924         libs_exec_lib_files($1_usertype)
 925
 926         logging_dontaudit_getattr_all_logs($1_usertype)
 927
 928         # for running TeX programs
 929         miscfiles_read_tetex_data($1_usertype)
 930         miscfiles_exec_tetex_data($1_usertype)
 931
 932         seutil_read_config($1_usertype)
 933
 934         optional_policy(`
 935                 cups_read_config($1_usertype)
 936                 cups_stream_connect($1_usertype)
 937                 cups_stream_connect_ptal($1_usertype)
 938         ')
 939
 940         optional_policy(`
 941                 kerberos_use($1_usertype)
 942                 kerberos_filetrans_home_content($1_usertype)
 943         ')
 944
 945         optional_policy(`
 946                 mta_dontaudit_read_spool_symlinks($1_usertype)
 947         ')
 948
 949         optional_policy(`
 950                 quota_dontaudit_getattr_db($1_usertype)
 951         ')
 952
 953         optional_policy(`
 954                 rpm_read_db($1_usertype)
 955                 rpm_dontaudit_manage_db($1_usertype)
 956                 rpm_read_cache($1_usertype)
 957         ')
 958
 959         optional_policy(`
 960                 oddjob_run_mkhomedir($1_t, $1_r)
 961         ')
 962 ')
 963
 964 #######################################
 965 ## <summary>
 966 ##      The template for creating a unprivileged login user.
 967 ## </summary>
 968 ## <desc>
 969 ##      <p>
 970 ##      This template creates a user domain, types, and
 971 ##      rules for the user's tty, pty, home directories,
 972 ##      tmp, and tmpfs files.
 973 ##      </p>
 974 ## </desc>
 975 ## <param name="userdomain_prefix">
 976 ##      <summary>
 977 ##      The prefix of the user domain (e.g., user
 978 ##      is the prefix for user_t).
 979 ##      </summary>
 980 ## </param>
 981 #
 982 template(`userdom_restricted_user_template',`
 983         gen_require(`
 984                 attribute unpriv_userdomain;
 985         ')
 986
 987         userdom_login_user_template($1)
 988
 989         typeattribute $1_t unpriv_userdomain;
 990         domain_interactive_fd($1_t)
 991
 992         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 993         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 994
 995         ##############################
 996         #
 997         # Local policy
 998         #
 999
1000         optional_policy(`
1001                 loadkeys_run($1_t,$1_r)
1002         ')
1003 ')
1004
1005 #######################################
1006 ## <summary>
1007 ##      The template for creating a unprivileged xwindows login user.
1008 ## </summary>
1009 ## <desc>
1010 ##      <p>
1011 ##      The template for creating a unprivileged xwindows login user.
1012 ##      </p>
1013 ##      <p>
1014 ##      This template creates a user domain, types, and
1015 ##      rules for the user's tty, pty, home directories,
1016 ##      tmp, and tmpfs files.
1017 ##      </p>
1018 ## </desc>
1019 ## <param name="userdomain_prefix">
1020 ##      <summary>
1021 ##      The prefix of the user domain (e.g., user
1022 ##      is the prefix for user_t).
1023 ##      </summary>
1024 ## </param>
1025 #
1026 template(`userdom_restricted_xwindows_user_template',`
1027
1028         userdom_restricted_user_template($1)
1029
1030         ##############################
1031         #
1032         # Local policy
1033         #
1034
1035         auth_role($1_r, $1_t)
1036         auth_search_pam_console_data($1_usertype)
1037         auth_dontaudit_read_login_records($1_usertype)
1038
1039         dev_read_sound($1_usertype)
1040         dev_write_sound($1_usertype)
1041         # gnome keyring wants to read this.
1042         dev_dontaudit_read_rand($1_usertype)
1043         # temporarily allow since openoffice requires this
1044         dev_read_rand($1_usertype)
1045
1046         dev_read_video_dev($1_usertype)
1047         dev_write_video_dev($1_usertype)
1048         dev_rw_wireless($1_usertype)
1049
1050         libs_dontaudit_setattr_lib_files($1_usertype)
1051
1052         tunable_policy(`user_rw_noexattrfile',`
1053                 dev_rw_usbfs($1_t)
1054                 dev_rw_generic_usb_dev($1_usertype)
1055
1056                 fs_manage_noxattr_fs_files($1_usertype)
1057                 fs_manage_noxattr_fs_dirs($1_usertype)
1058                 fs_manage_dos_dirs($1_usertype)
1059                 fs_manage_dos_files($1_usertype)
1060                 storage_raw_read_removable_device($1_usertype)
1061                 storage_raw_write_removable_device($1_usertype)
1062         ')
1063
1064         logging_send_syslog_msg($1_usertype)
1065         logging_dontaudit_send_audit_msgs($1_t)
1066
1067         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1068         logging_send_audit_msgs($1_t)
1069         selinux_get_enforce_mode($1_t)
1070         seutil_exec_restorecond($1_t)
1071         seutil_read_file_contexts($1_t)
1072         seutil_read_default_contexts($1_t)
1073
1074         xserver_restricted_role($1_r, $1_t)
1075
1076         optional_policy(`
1077                 alsa_read_rw_config($1_usertype)
1078         ')
1079
1080          # cjp: needed by KDE apps
1081          # bug: #682499
1082          optional_policy(`
1083                 gnome_read_usr_config($1_usertype)
1084                 gnome_role_gkeyringd($1, $1_r, $1_t)
1085                 # cjp: telepathy F15 bugs
1086                 telepathy_dbus_session_role($1_r, $1_t, $1)
1087         ')
1088
1089         optional_policy(`
1090                 dbus_role_template($1, $1_r, $1_usertype)
1091                 dbus_system_bus_client($1_usertype)
1092                 allow $1_usertype $1_usertype:dbus send_msg;
1093
1094                 optional_policy(`
1095                         abrt_dbus_chat($1_usertype)
1096                         abrt_run_helper($1_usertype, $1_r)
1097                 ')
1098
1099                 optional_policy(`
1100                         consolekit_dontaudit_read_log($1_usertype)
1101                         consolekit_dbus_chat($1_usertype)
1102                 ')
1103
1104                 optional_policy(`
1105                         cups_dbus_chat($1_usertype)
1106                         cups_dbus_chat_config($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         devicekit_dbus_chat($1_usertype)
1111                         devicekit_dbus_chat_disk($1_usertype)
1112                         devicekit_dbus_chat_power($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         fprintd_dbus_chat($1_t)
1117                 ')
1118         ')
1119
1120         optional_policy(`
1121                 openoffice_role_template($1, $1_r, $1_usertype)
1122         ')
1123
1124         optional_policy(`
1125                 policykit_role($1_r, $1_usertype)
1126         ')
1127
1128         optional_policy(`
1129                 pulseaudio_role($1_r, $1_usertype)
1130         ')
1131
1132         optional_policy(`
1133                 rtkit_scheduled($1_usertype)
1134         ')
1135
1136         optional_policy(`
1137                 setroubleshoot_dontaudit_stream_connect($1_t)
1138         ')
1139
1140         optional_policy(`
1141                 udev_read_db($1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 wm_role_template($1, $1_r, $1_t)
1146         ')
1147 ')
1148
1149 #######################################
1150 ## <summary>
1151 ##      The template for creating a unprivileged user roughly
1152 ##      equivalent to a regular linux user.
1153 ## </summary>
1154 ## <desc>
1155 ##      <p>
1156 ##      The template for creating a unprivileged user roughly
1157 ##      equivalent to a regular linux user.
1158 ##      </p>
1159 ##      <p>
1160 ##      This template creates a user domain, types, and
1161 ##      rules for the user's tty, pty, home directories,
1162 ##      tmp, and tmpfs files.
1163 ##      </p>
1164 ## </desc>
1165 ## <param name="userdomain_prefix">
1166 ##      <summary>
1167 ##      The prefix of the user domain (e.g., user
1168 ##      is the prefix for user_t).
1169 ##      </summary>
1170 ## </param>
1171 #
1172 template(`userdom_unpriv_user_template', `
1173
1174         ##############################
1175         #
1176         # Declarations
1177         #
1178
1179         # Inherit rules for ordinary users.
1180         userdom_restricted_xwindows_user_template($1)
1181         userdom_common_user_template($1)
1182
1183         ##############################
1184         #
1185         # Local policy
1186         #
1187
1188         # port access is audited even if dac would not have allowed it, so dontaudit it here
1189 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1190         # Need the following rule to allow users to run vpnc
1191         corenet_tcp_bind_xserver_port($1_t)
1192         corenet_tcp_bind_generic_node($1_usertype)
1193
1194         storage_rw_fuse($1_t)
1195
1196         miscfiles_read_hwdata($1_usertype)
1197
1198         # Allow users to run TCP servers (bind to ports and accept connection from
1199         # the same domain and outside users) disabling this forces FTP passive mode
1200         # and may change other protocols
1201
1202         tunable_policy(`user_share_music',`
1203                 corenet_tcp_bind_daap_port($1_usertype)
1204         ')
1205
1206         tunable_policy(`user_tcp_server',`
1207                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1208         ')
1209
1210         tunable_policy(`user_setrlimit',`
1211                 allow $1_usertype self:process setrlimit;
1212         ')
1213
1214         optional_policy(`
1215                 cdrecord_role($1_r, $1_t)
1216         ')
1217
1218         optional_policy(`
1219                 cron_role($1_r, $1_t)
1220         ')
1221
1222         optional_policy(`
1223                 games_rw_data($1_usertype)
1224         ')
1225
1226         optional_policy(`
1227                 gpg_role($1_r, $1_usertype)
1228         ')
1229
1230         optional_policy(`
1231                 gnomeclock_dbus_chat($1_t)
1232         ')
1233
1234         optional_policy(`
1235                 gpm_stream_connect($1_usertype)
1236         ')
1237
1238         optional_policy(`
1239                 execmem_role_template($1, $1_r, $1_t)
1240         ')
1241
1242         optional_policy(`
1243                 java_role_template($1, $1_r, $1_t)
1244         ')
1245
1246         optional_policy(`
1247                 mono_role_template($1, $1_r, $1_t)
1248         ')
1249
1250         optional_policy(`
1251                 mount_run_fusermount($1_t, $1_r)
1252                 mount_read_pid_files($1_t)
1253         ')
1254
1255         optional_policy(`
1256                 wine_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 postfix_run_postdrop($1_t, $1_r)
1261         ')
1262
1263         # Run pppd in pppd_t by default for user
1264         optional_policy(`
1265                 ppp_run_cond($1_t, $1_r)
1266         ')
1267 ')
1268
1269 #######################################
1270 ## <summary>
1271 ##      The template for creating an administrative user.
1272 ## </summary>
1273 ## <desc>
1274 ##      <p>
1275 ##      This template creates a user domain, types, and
1276 ##      rules for the user's tty, pty, home directories,
1277 ##      tmp, and tmpfs files.
1278 ##      </p>
1279 ##      <p>
1280 ##      The privileges given to administrative users are:
1281 ##      <ul>
1282 ##              <li>Raw disk access</li>
1283 ##              <li>Set all sysctls</li>
1284 ##              <li>All kernel ring buffer controls</li>
1285 ##              <li>Create, read, write, and delete all files but shadow</li>
1286 ##              <li>Manage source and binary format SELinux policy</li>
1287 ##              <li>Run insmod</li>
1288 ##      </ul>
1289 ##      </p>
1290 ## </desc>
1291 ## <param name="userdomain_prefix">
1292 ##      <summary>
1293 ##      The prefix of the user domain (e.g., sysadm
1294 ##      is the prefix for sysadm_t).
1295 ##      </summary>
1296 ## </param>
1297 #
1298 template(`userdom_admin_user_template',`
1299         gen_require(`
1300                 attribute admindomain;
1301                 class passwd { passwd chfn chsh rootok crontab };
1302         ')
1303
1304         ##############################
1305         #
1306         # Declarations
1307         #
1308
1309         # Inherit rules for ordinary users.
1310         userdom_login_user_template($1)
1311         userdom_common_user_template($1)
1312
1313         domain_obj_id_change_exemption($1_t)
1314         role system_r types $1_t;
1315
1316         typeattribute $1_t admindomain;
1317
1318         ifdef(`direct_sysadm_daemon',`
1319                 domain_system_change_exemption($1_t)
1320         ')
1321
1322         ##############################
1323         #
1324         # $1_t local policy
1325         #
1326
1327         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1328         allow $1_t self:capability2 syslog;
1329         allow $1_t self:process { setexec setfscreate };
1330         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1331         allow $1_t self:tun_socket create;
1332         # Set password information for other users.
1333         allow $1_t self:passwd { passwd chfn chsh };
1334         # Skip authentication when pam_rootok is specified.
1335         allow $1_t self:passwd rootok;
1336
1337         # Manipulate other users crontab.
1338         allow $1_t self:passwd crontab;
1339
1340         kernel_read_software_raid_state($1_t)
1341         kernel_getattr_core_if($1_t)
1342         kernel_getattr_message_if($1_t)
1343         kernel_change_ring_buffer_level($1_t)
1344         kernel_clear_ring_buffer($1_t)
1345         kernel_read_ring_buffer($1_t)
1346         kernel_get_sysvipc_info($1_t)
1347         kernel_rw_all_sysctls($1_t)
1348         # signal unlabeled processes:
1349         kernel_kill_unlabeled($1_t)
1350         kernel_signal_unlabeled($1_t)
1351         kernel_sigstop_unlabeled($1_t)
1352         kernel_signull_unlabeled($1_t)
1353         kernel_sigchld_unlabeled($1_t)
1354         kernel_signal($1_t)
1355
1356         corenet_tcp_bind_generic_port($1_t)
1357         # allow setting up tunnels
1358         corenet_rw_tun_tap_dev($1_t)
1359
1360         dev_getattr_generic_blk_files($1_t)
1361         dev_getattr_generic_chr_files($1_t)
1362         # for lsof
1363         dev_getattr_mtrr_dev($1_t)
1364         # Allow MAKEDEV to work
1365         dev_create_all_blk_files($1_t)
1366         dev_create_all_chr_files($1_t)
1367         dev_delete_all_blk_files($1_t)
1368         dev_delete_all_chr_files($1_t)
1369         dev_rename_all_blk_files($1_t)
1370         dev_rename_all_chr_files($1_t)
1371         dev_create_generic_symlinks($1_t)
1372         dev_rw_generic_usb_dev($1_t)
1373         dev_rw_usbfs($1_t)
1374
1375         domain_setpriority_all_domains($1_t)
1376         domain_read_all_domains_state($1_t)
1377         domain_getattr_all_domains($1_t)
1378         domain_getcap_all_domains($1_t)
1379         domain_dontaudit_ptrace_all_domains($1_t)
1380         # signal all domains:
1381         domain_kill_all_domains($1_t)
1382         domain_signal_all_domains($1_t)
1383         domain_signull_all_domains($1_t)
1384         domain_sigstop_all_domains($1_t)
1385         domain_sigstop_all_domains($1_t)
1386         domain_sigchld_all_domains($1_t)
1387         # for lsof
1388         domain_getattr_all_sockets($1_t)
1389         domain_dontaudit_getattr_all_sockets($1_t)
1390
1391         files_exec_usr_src_files($1_t)
1392
1393         fs_getattr_all_fs($1_t)
1394         fs_getattr_all_files($1_t)
1395         fs_list_all($1_t)
1396         fs_set_all_quotas($1_t)
1397         fs_exec_noxattr($1_t)
1398
1399         storage_raw_read_removable_device($1_t)
1400         storage_raw_write_removable_device($1_t)
1401         storage_dontaudit_read_fixed_disk($1_t)
1402
1403         term_use_all_inherited_terms($1_t)
1404         term_use_unallocated_ttys($1_t)
1405
1406         auth_getattr_shadow($1_t)
1407         # Manage almost all files
1408         auth_manage_all_files_except_shadow($1_t)
1409         # Relabel almost all files
1410         auth_relabel_all_files_except_shadow($1_t)
1411
1412         init_telinit($1_t)
1413
1414         logging_send_syslog_msg($1_t)
1415
1416         optional_policy(`
1417                 modutils_domtrans_insmod($1_t)
1418                 modutils_domtrans_depmod($1_t)
1419         ')
1420
1421         # The following rule is temporary until such time that a complete
1422         # policy management infrastructure is in place so that an administrator
1423         # cannot directly manipulate policy files with arbitrary programs.
1424         seutil_manage_src_policy($1_t)
1425         # Violates the goal of limiting write access to checkpolicy.
1426         # But presently necessary for installing the file_contexts file.
1427         seutil_manage_bin_policy($1_t)
1428
1429         userdom_manage_user_home_content_dirs($1_t)
1430         userdom_manage_user_home_content_files($1_t)
1431         userdom_manage_user_home_content_symlinks($1_t)
1432         userdom_manage_user_home_content_pipes($1_t)
1433         userdom_manage_user_home_content_sockets($1_t)
1434         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1435
1436         tunable_policy(`user_rw_noexattrfile',`
1437                 fs_manage_noxattr_fs_files($1_t)
1438                 fs_manage_noxattr_fs_dirs($1_t)
1439         ',`
1440                 fs_read_noxattr_fs_files($1_t)
1441         ')
1442
1443         optional_policy(`
1444                 postgresql_unconfined($1_t)
1445         ')
1446
1447         optional_policy(`
1448                 userhelper_exec($1_t)
1449         ')
1450 ')
1451
1452 ########################################
1453 ## <summary>
1454 ##      Allow user to run as a secadm
1455 ## </summary>
1456 ## <desc>
1457 ##      <p>
1458 ##      Create objects in a user home directory
1459 ##      with an automatic type transition to
1460 ##      a specified private type.
1461 ##      </p>
1462 ##      <p>
1463 ##      This is a templated interface, and should only
1464 ##      be called from a per-userdomain template.
1465 ##      </p>
1466 ## </desc>
1467 ## <param name="domain">
1468 ##      <summary>
1469 ##      Domain allowed access.
1470 ##      </summary>
1471 ## </param>
1472 ## <param name="role">
1473 ##      <summary>
1474 ##      The role  of the object to create.
1475 ##      </summary>
1476 ## </param>
1477 #
1478 template(`userdom_security_admin_template',`
1479         allow $1 self:capability { dac_read_search dac_override };
1480
1481         corecmd_exec_shell($1)
1482
1483         domain_obj_id_change_exemption($1)
1484
1485         dev_relabel_all_dev_nodes($1)
1486
1487         files_create_boot_flag($1)
1488         files_create_default_dir($1)
1489         files_root_filetrans_default($1, dir)
1490
1491         # Necessary for managing /boot/efi
1492         fs_manage_dos_files($1)
1493
1494         mls_process_read_up($1)
1495         mls_file_read_all_levels($1)
1496         mls_file_upgrade($1)
1497         mls_file_downgrade($1)
1498
1499         selinux_set_enforce_mode($1)
1500         selinux_set_all_booleans($1)
1501         selinux_set_parameters($1)
1502         selinux_read_policy($1)
1503
1504         auth_relabel_all_files_except_shadow($1)
1505         auth_relabel_shadow($1)
1506
1507         init_exec($1)
1508
1509         logging_send_syslog_msg($1)
1510         logging_read_audit_log($1)
1511         logging_read_generic_logs($1)
1512         logging_read_audit_config($1)
1513
1514         seutil_manage_bin_policy($1)
1515         seutil_manage_default_contexts($1)
1516         seutil_manage_file_contexts($1)
1517         seutil_manage_module_store($1)
1518         seutil_manage_config($1)
1519         seutil_run_checkpolicy($1,$2)
1520         seutil_run_loadpolicy($1,$2)
1521         seutil_run_semanage($1,$2)
1522         seutil_run_setsebool($1,$2)
1523         seutil_run_setfiles($1, $2)
1524
1525         seutil_manage_bin_policy($1)
1526     seutil_manage_default_contexts($1)
1527     seutil_manage_file_contexts($1)
1528     seutil_manage_module_store($1)
1529     seutil_manage_config($1)
1530
1531         optional_policy(`
1532                 aide_run($1,$2)
1533         ')
1534
1535         optional_policy(`
1536                 consoletype_exec($1)
1537         ')
1538
1539         optional_policy(`
1540                 dmesg_exec($1)
1541         ')
1542
1543         optional_policy(`
1544                 ipsec_run_setkey($1,$2)
1545         ')
1546
1547         optional_policy(`
1548                 netlabel_run_mgmt($1,$2)
1549         ')
1550
1551         optional_policy(`
1552                 samhain_run($1, $2)
1553         ')
1554 ')
1555
1556 ########################################
1557 ## <summary>
1558 ##      Make the specified type usable in a
1559 ##      user home directory.
1560 ## </summary>
1561 ## <param name="type">
1562 ##      <summary>
1563 ##      Type to be used as a file in the
1564 ##      user home directory.
1565 ##      </summary>
1566 ## </param>
1567 #
1568 interface(`userdom_user_home_content',`
1569         gen_require(`
1570                 type user_home_t;
1571                 attribute user_home_type;
1572         ')
1573
1574         allow $1 user_home_t:filesystem associate;
1575         files_type($1)
1576         ubac_constrained($1)
1577
1578         files_poly_member($1)
1579         typeattribute $1  user_home_type;
1580 ')
1581
1582 ########################################
1583 ## <summary>
1584 ##      Make the specified type usable in a
1585 ##      generic temporary directory.
1586 ## </summary>
1587 ## <param name="type">
1588 ##      <summary>
1589 ##      Type to be used as a file in the
1590 ##      generic temporary directory.
1591 ##      </summary>
1592 ## </param>
1593 #
1594 interface(`userdom_user_tmp_content',`
1595         gen_require(`
1596                 attribute user_tmp_type;
1597         ')
1598
1599         typeattribute $1 user_tmp_type;
1600
1601         files_tmp_file($1)
1602         ubac_constrained($1)
1603 ')
1604
1605 ########################################
1606 ## <summary>
1607 ##      Allow domain to attach to TUN devices created by administrative users.
1608 ## </summary>
1609 ## <param name="domain">
1610 ##      <summary>
1611 ##      Domain allowed access.
1612 ##      </summary>
1613 ## </param>
1614 #
1615 interface(`userdom_attach_admin_tun_iface',`
1616         gen_require(`
1617                 attribute admindomain;
1618         ')
1619
1620         allow $1 admindomain:tun_socket relabelfrom;
1621         allow $1 self:tun_socket relabelto;
1622 ')
1623
1624 ########################################
1625 ## <summary>
1626 ##      Set the attributes of a user pty.
1627 ## </summary>
1628 ## <param name="domain">
1629 ##      <summary>
1630 ##      Domain allowed access.
1631 ##      </summary>
1632 ## </param>
1633 #
1634 interface(`userdom_setattr_user_ptys',`
1635         gen_require(`
1636                 type user_devpts_t;
1637         ')
1638
1639         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1640 ')
1641
1642 ########################################
1643 ## <summary>
1644 ##      Create a user pty.
1645 ## </summary>
1646 ## <param name="domain">
1647 ##      <summary>
1648 ##      Domain allowed access.
1649 ##      </summary>
1650 ## </param>
1651 #
1652 interface(`userdom_create_user_pty',`
1653         gen_require(`
1654                 type user_devpts_t;
1655         ')
1656
1657         term_create_pty($1, user_devpts_t)
1658 ')
1659
1660 ########################################
1661 ## <summary>
1662 ##      Get the attributes of user home directories.
1663 ## </summary>
1664 ## <param name="domain">
1665 ##      <summary>
1666 ##      Domain allowed access.
1667 ##      </summary>
1668 ## </param>
1669 #
1670 interface(`userdom_getattr_user_home_dirs',`
1671         gen_require(`
1672                 type user_home_dir_t;
1673         ')
1674
1675         allow $1 user_home_dir_t:dir getattr_dir_perms;
1676         files_search_home($1)
1677 ')
1678
1679 ########################################
1680 ## <summary>
1681 ##      Do not audit attempts to get the attributes of user home directories.
1682 ## </summary>
1683 ## <param name="domain">
1684 ##      <summary>
1685 ##      Domain to not audit.
1686 ##      </summary>
1687 ## </param>
1688 #
1689 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1690         gen_require(`
1691                 type user_home_dir_t;
1692         ')
1693
1694         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1695 ')
1696
1697 ########################################
1698 ## <summary>
1699 ##      Search user home directories.
1700 ## </summary>
1701 ## <param name="domain">
1702 ##      <summary>
1703 ##      Domain allowed access.
1704 ##      </summary>
1705 ## </param>
1706 #
1707 interface(`userdom_search_user_home_dirs',`
1708         gen_require(`
1709                 type user_home_dir_t;
1710         ')
1711
1712         allow $1 user_home_dir_t:dir search_dir_perms;
1713         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1714         files_search_home($1)
1715 ')
1716
1717 ########################################
1718 ## <summary>
1719 ##      Do not audit attempts to search user home directories.
1720 ## </summary>
1721 ## <desc>
1722 ##      <p>
1723 ##      Do not audit attempts to search user home directories.
1724 ##      This will supress SELinux denial messages when the specified
1725 ##      domain is denied the permission to search these directories.
1726 ##      </p>
1727 ## </desc>
1728 ## <param name="domain">
1729 ##      <summary>
1730 ##      Domain to not audit.
1731 ##      </summary>
1732 ## </param>
1733 ## <infoflow type="none"/>
1734 #
1735 interface(`userdom_dontaudit_search_user_home_dirs',`
1736         gen_require(`
1737                 type user_home_dir_t;
1738         ')
1739
1740         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1741 ')
1742
1743 ########################################
1744 ## <summary>
1745 ##      List user home directories.
1746 ## </summary>
1747 ## <param name="domain">
1748 ##      <summary>
1749 ##      Domain allowed access.
1750 ##      </summary>
1751 ## </param>
1752 #
1753 interface(`userdom_list_user_home_dirs',`
1754         gen_require(`
1755                 type user_home_dir_t;
1756         ')
1757
1758         allow $1 user_home_dir_t:dir list_dir_perms;
1759         files_search_home($1)
1760
1761         tunable_policy(`use_nfs_home_dirs',`
1762                 fs_list_nfs($1)
1763         ')
1764
1765         tunable_policy(`use_samba_home_dirs',`
1766                 fs_list_cifs($1)
1767         ')
1768 ')
1769
1770 ########################################
1771 ## <summary>
1772 ##      Do not audit attempts to list user home subdirectories.
1773 ## </summary>
1774 ## <param name="domain">
1775 ##      <summary>
1776 ##      Domain to not audit.
1777 ##      </summary>
1778 ## </param>
1779 #
1780 interface(`userdom_dontaudit_list_user_home_dirs',`
1781         gen_require(`
1782                 type user_home_dir_t;
1783                 type user_home_t;
1784         ')
1785
1786         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1787         dontaudit $1 user_home_t:dir list_dir_perms;
1788 ')
1789
1790 ########################################
1791 ## <summary>
1792 ##      Create user home directories.
1793 ## </summary>
1794 ## <param name="domain">
1795 ##      <summary>
1796 ##      Domain allowed access.
1797 ##      </summary>
1798 ## </param>
1799 #
1800 interface(`userdom_create_user_home_dirs',`
1801         gen_require(`
1802                 type user_home_dir_t;
1803         ')
1804
1805         allow $1 user_home_dir_t:dir create_dir_perms;
1806 ')
1807
1808 ########################################
1809 ## <summary>
1810 ##      Create user home directories.
1811 ## </summary>
1812 ## <param name="domain">
1813 ##      <summary>
1814 ##      Domain allowed access.
1815 ##      </summary>
1816 ## </param>
1817 #
1818 interface(`userdom_manage_user_home_dirs',`
1819         gen_require(`
1820                 type user_home_dir_t;
1821         ')
1822
1823         allow $1 user_home_dir_t:dir manage_dir_perms;
1824 ')
1825
1826 ########################################
1827 ## <summary>
1828 ##      Relabel to user home directories.
1829 ## </summary>
1830 ## <param name="domain">
1831 ##      <summary>
1832 ##      Domain allowed access.
1833 ##      </summary>
1834 ## </param>
1835 #
1836 interface(`userdom_relabelto_user_home_dirs',`
1837         gen_require(`
1838                 type user_home_dir_t;
1839         ')
1840
1841         allow $1 user_home_dir_t:dir relabelto;
1842 ')
1843
1844
1845 ########################################
1846 ## <summary>
1847 ##      Relabel to user home files.
1848 ## </summary>
1849 ## <param name="domain">
1850 ##      <summary>
1851 ##      Domain allowed access.
1852 ##      </summary>
1853 ## </param>
1854 #
1855 interface(`userdom_relabelto_user_home_files',`
1856         gen_require(`
1857                 type user_home_t;
1858         ')
1859
1860         allow $1 user_home_t:file relabelto;
1861 ')
1862 ########################################
1863 ## <summary>
1864 ##      Relabel user home files.
1865 ## </summary>
1866 ## <param name="domain">
1867 ##      <summary>
1868 ##      Domain allowed access.
1869 ##      </summary>
1870 ## </param>
1871 #
1872 interface(`userdom_relabel_user_home_files',`
1873         gen_require(`
1874                 type user_home_t;
1875         ')
1876
1877         allow $1 user_home_t:file relabel_file_perms;
1878 ')
1879
1880 ########################################
1881 ## <summary>
1882 ##      Create directories in the home dir root with
1883 ##      the user home directory type.
1884 ## </summary>
1885 ## <param name="domain">
1886 ##      <summary>
1887 ##      Domain allowed access.
1888 ##      </summary>
1889 ## </param>
1890 #
1891 interface(`userdom_home_filetrans_user_home_dir',`
1892         gen_require(`
1893                 type user_home_dir_t;
1894         ')
1895
1896         files_home_filetrans($1, user_home_dir_t, dir)
1897 ')
1898
1899 ########################################
1900 ## <summary>
1901 ##      Do a domain transition to the specified
1902 ##      domain when executing a program in the
1903 ##      user home directory.
1904 ## </summary>
1905 ## <desc>
1906 ##      <p>
1907 ##      Do a domain transition to the specified
1908 ##      domain when executing a program in the
1909 ##      user home directory.
1910 ##      </p>
1911 ##      <p>
1912 ##      No interprocess communication (signals, pipes,
1913 ##      etc.) is provided by this interface since
1914 ##      the domains are not owned by this module.
1915 ##      </p>
1916 ## </desc>
1917 ## <param name="source_domain">
1918 ##      <summary>
1919 ##      Domain allowed to transition.
1920 ##      </summary>
1921 ## </param>
1922 ## <param name="target_domain">
1923 ##      <summary>
1924 ##      Domain to transition to.
1925 ##      </summary>
1926 ## </param>
1927 #
1928 interface(`userdom_user_home_domtrans',`
1929         gen_require(`
1930                 type user_home_dir_t, user_home_t;
1931         ')
1932
1933         domain_auto_trans($1, user_home_t, $2)
1934         allow $1 user_home_dir_t:dir search_dir_perms;
1935         files_search_home($1)
1936 ')
1937
1938 ########################################
1939 ## <summary>
1940 ##      Do not audit attempts to search user home content directories.
1941 ## </summary>
1942 ## <param name="domain">
1943 ##      <summary>
1944 ##      Domain to not audit.
1945 ##      </summary>
1946 ## </param>
1947 #
1948 interface(`userdom_dontaudit_search_user_home_content',`
1949         gen_require(`
1950                 type user_home_t;
1951         ')
1952
1953         dontaudit $1 user_home_t:dir search_dir_perms;
1954         fs_dontaudit_list_nfs($1)
1955         fs_dontaudit_list_cifs($1)
1956 ')
1957
1958 ########################################
1959 ## <summary>
1960 ##      List contents of users home directory.
1961 ## </summary>
1962 ## <param name="domain">
1963 ##      <summary>
1964 ##      Domain allowed access.
1965 ##      </summary>
1966 ## </param>
1967 #
1968 interface(`userdom_list_user_home_content',`
1969         gen_require(`
1970                 type user_home_dir_t;
1971                 attribute user_home_type;
1972         ')
1973
1974         files_list_home($1)
1975         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1976 ')
1977
1978 ########################################
1979 ## <summary>
1980 ##      Create, read, write, and delete directories
1981 ##      in a user home subdirectory.
1982 ## </summary>
1983 ## <param name="domain">
1984 ##      <summary>
1985 ##      Domain allowed access.
1986 ##      </summary>
1987 ## </param>
1988 #
1989 interface(`userdom_manage_user_home_content_dirs',`
1990         gen_require(`
1991                 type user_home_dir_t, user_home_t;
1992         ')
1993
1994         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1995         files_search_home($1)
1996 ')
1997
1998 ########################################
1999 ## <summary>
2000 ##      Delete directories in a user home subdirectory.
2001 ## </summary>
2002 ## <param name="domain">
2003 ##      <summary>
2004 ##      Domain allowed access.
2005 ##      </summary>
2006 ## </param>
2007 #
2008 interface(`userdom_delete_user_home_content_dirs',`
2009         gen_require(`
2010                 type user_home_t;
2011         ')
2012
2013         allow $1 user_home_t:dir delete_dir_perms;
2014 ')
2015
2016 ########################################
2017 ## <summary>
2018 ##      Set the attributes of user home files.
2019 ## </summary>
2020 ## <param name="domain">
2021 ##      <summary>
2022 ##      Domain allowed access.
2023 ##      </summary>
2024 ## </param>
2025 ## <rolecap/>
2026 #
2027 interface(`userdom_setattr_user_home_content_files',`
2028         gen_require(`
2029                 type user_home_t;
2030         ')
2031
2032         allow $1 user_home_t:file setattr;
2033 ')
2034
2035 ########################################
2036 ## <summary>
2037 ##      Do not audit attempts to set the
2038 ##      attributes of user home files.
2039 ## </summary>
2040 ## <param name="domain">
2041 ##      <summary>
2042 ##      Domain to not audit.
2043 ##      </summary>
2044 ## </param>
2045 #
2046 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2047         gen_require(`
2048                 type user_home_t;
2049         ')
2050
2051         dontaudit $1 user_home_t:file setattr_file_perms;
2052 ')
2053
2054 ########################################
2055 ## <summary>
2056 ##      Mmap user home files.
2057 ## </summary>
2058 ## <param name="domain">
2059 ##      <summary>
2060 ##      Domain allowed access.
2061 ##      </summary>
2062 ## </param>
2063 #
2064 interface(`userdom_mmap_user_home_content_files',`
2065         gen_require(`
2066                 type user_home_dir_t, user_home_t;
2067         ')
2068
2069         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2070         files_search_home($1)
2071 ')
2072
2073 ########################################
2074 ## <summary>
2075 ##      Read user home files.
2076 ## </summary>
2077 ## <param name="domain">
2078 ##      <summary>
2079 ##      Domain allowed access.
2080 ##      </summary>
2081 ## </param>
2082 #
2083 interface(`userdom_read_user_home_content_files',`
2084         gen_require(`
2085                 type user_home_dir_t, user_home_t;
2086         ')
2087
2088         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2089         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2090         files_search_home($1)
2091 ')
2092
2093 ########################################
2094 ## <summary>
2095 ##      Do not audit attempts to getattr user home files.
2096 ## </summary>
2097 ## <param name="domain">
2098 ##      <summary>
2099 ##      Domain to not audit.
2100 ##      </summary>
2101 ## </param>
2102 #
2103 interface(`userdom_dontaudit_getattr_user_home_content',`
2104         gen_require(`
2105                 attribute user_home_type;
2106         ')
2107
2108         dontaudit $1 user_home_type:dir getattr;
2109         dontaudit $1 user_home_type:file getattr;
2110 ')
2111
2112 ########################################
2113 ## <summary>
2114 ##      Do not audit attempts to read user home files.
2115 ## </summary>
2116 ## <param name="domain">
2117 ##      <summary>
2118 ##      Domain to not audit.
2119 ##      </summary>
2120 ## </param>
2121 #
2122 interface(`userdom_dontaudit_read_user_home_content_files',`
2123         gen_require(`
2124                 attribute user_home_type;
2125                 type user_home_dir_t;
2126         ')
2127
2128         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2129         dontaudit $1 user_home_type:dir list_dir_perms;
2130         dontaudit $1 user_home_type:file read_file_perms;
2131         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2132 ')
2133
2134 ########################################
2135 ## <summary>
2136 ##      Do not audit attempts to append user home files.
2137 ## </summary>
2138 ## <param name="domain">
2139 ##      <summary>
2140 ##      Domain to not audit.
2141 ##      </summary>
2142 ## </param>
2143 #
2144 interface(`userdom_dontaudit_append_user_home_content_files',`
2145         gen_require(`
2146                 type user_home_t;
2147         ')
2148
2149         dontaudit $1 user_home_t:file append_file_perms;
2150 ')
2151
2152 ########################################
2153 ## <summary>
2154 ##      Do not audit attempts to write user home files.
2155 ## </summary>
2156 ## <param name="domain">
2157 ##      <summary>
2158 ##      Domain to not audit.
2159 ##      </summary>
2160 ## </param>
2161 #
2162 interface(`userdom_dontaudit_write_user_home_content_files',`
2163         gen_require(`
2164                 type user_home_t;
2165         ')
2166
2167         dontaudit $1 user_home_t:file write_file_perms;
2168 ')
2169
2170 ########################################
2171 ## <summary>
2172 ##      Delete files in a user home subdirectory.
2173 ## </summary>
2174 ## <param name="domain">
2175 ##      <summary>
2176 ##      Domain allowed access.
2177 ##      </summary>
2178 ## </param>
2179 #
2180 interface(`userdom_delete_user_home_content_files',`
2181         gen_require(`
2182                 type user_home_t;
2183         ')
2184
2185         allow $1 user_home_t:file delete_file_perms;
2186 ')
2187
2188 ########################################
2189 ## <summary>
2190 ##      Delete sock files in a user home subdirectory.
2191 ## </summary>
2192 ## <param name="domain">
2193 ##      <summary>
2194 ##      Domain allowed access.
2195 ##      </summary>
2196 ## </param>
2197 #
2198 interface(`userdom_delete_user_home_content_sock_files',`
2199         gen_require(`
2200                 type user_home_t;
2201         ')
2202
2203         allow $1 user_home_t:sock_file delete_file_perms;
2204 ')
2205
2206 ########################################
2207 ## <summary>
2208 ##      Do not audit attempts to write user home files.
2209 ## </summary>
2210 ## <param name="domain">
2211 ##      <summary>
2212 ##      Domain to not audit.
2213 ##      </summary>
2214 ## </param>
2215 #
2216 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2217         gen_require(`
2218                 type user_home_t;
2219         ')
2220
2221         dontaudit $1 user_home_t:file relabel_file_perms;
2222 ')
2223
2224 ########################################
2225 ## <summary>
2226 ##      Read user home subdirectory symbolic links.
2227 ## </summary>
2228 ## <param name="domain">
2229 ##      <summary>
2230 ##      Domain allowed access.
2231 ##      </summary>
2232 ## </param>
2233 #
2234 interface(`userdom_read_user_home_content_symlinks',`
2235         gen_require(`
2236                 type user_home_dir_t, user_home_t;
2237         ')
2238
2239         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2240 ')
2241
2242 ########################################
2243 ## <summary>
2244 ##      Execute user home files.
2245 ## </summary>
2246 ## <param name="domain">
2247 ##      <summary>
2248 ##      Domain allowed access.
2249 ##      </summary>
2250 ## </param>
2251 ## <rolecap/>
2252 #
2253 interface(`userdom_exec_user_home_content_files',`
2254         gen_require(`
2255                 type user_home_dir_t;
2256                 attribute user_home_type;
2257         ')
2258
2259         files_search_home($1)
2260         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2261         dontaudit $1 user_home_type:sock_file execute;
2262         ')
2263
2264 ########################################
2265 ## <summary>
2266 ##      Do not audit attempts to execute user home files.
2267 ## </summary>
2268 ## <param name="domain">
2269 ##      <summary>
2270 ##      Domain to not audit.
2271 ##      </summary>
2272 ## </param>
2273 #
2274 interface(`userdom_dontaudit_exec_user_home_content_files',`
2275         gen_require(`
2276                 type user_home_t;
2277         ')
2278
2279         dontaudit $1 user_home_t:file exec_file_perms;
2280 ')
2281
2282 ########################################
2283 ## <summary>
2284 ##      Create, read, write, and delete files
2285 ##      in a user home subdirectory.
2286 ## </summary>
2287 ## <param name="domain">
2288 ##      <summary>
2289 ##      Domain allowed access.
2290 ##      </summary>
2291 ## </param>
2292 #
2293 interface(`userdom_manage_user_home_content_files',`
2294         gen_require(`
2295                 type user_home_dir_t, user_home_t;
2296         ')
2297
2298         manage_files_pattern($1, user_home_t, user_home_t)
2299         allow $1 user_home_dir_t:dir search_dir_perms;
2300         files_search_home($1)
2301 ')
2302
2303 ########################################
2304 ## <summary>
2305 ##      Do not audit attempts to create, read, write, and delete directories
2306 ##      in a user home subdirectory.
2307 ## </summary>
2308 ## <param name="domain">
2309 ##      <summary>
2310 ##      Domain to not audit.
2311 ##      </summary>
2312 ## </param>
2313 #
2314 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2315         gen_require(`
2316                 type user_home_dir_t, user_home_t;
2317         ')
2318
2319         dontaudit $1 user_home_t:dir manage_dir_perms;
2320 ')
2321
2322 ########################################
2323 ## <summary>
2324 ##      Create, read, write, and delete symbolic links
2325 ##      in a user home subdirectory.
2326 ## </summary>
2327 ## <param name="domain">
2328 ##      <summary>
2329 ##      Domain allowed access.
2330 ##      </summary>
2331 ## </param>
2332 #
2333 interface(`userdom_manage_user_home_content_symlinks',`
2334         gen_require(`
2335                 type user_home_dir_t, user_home_t;
2336         ')
2337
2338         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2339         allow $1 user_home_dir_t:dir search_dir_perms;
2340         files_search_home($1)
2341 ')
2342
2343 ########################################
2344 ## <summary>
2345 ##      Delete symbolic links in a user home directory.
2346 ## </summary>
2347 ## <param name="domain">
2348 ##      <summary>
2349 ##      Domain allowed access.
2350 ##      </summary>
2351 ## </param>
2352 #
2353 interface(`userdom_delete_user_home_content_symlinks',`
2354         gen_require(`
2355                 type user_home_t;
2356         ')
2357
2358         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2359 ')
2360
2361 ########################################
2362 ## <summary>
2363 ##      Create, read, write, and delete named pipes
2364 ##      in a user home subdirectory.
2365 ## </summary>
2366 ## <param name="domain">
2367 ##      <summary>
2368 ##      Domain allowed access.
2369 ##      </summary>
2370 ## </param>
2371 #
2372 interface(`userdom_manage_user_home_content_pipes',`
2373         gen_require(`
2374                 type user_home_dir_t, user_home_t;
2375         ')
2376
2377         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2378         allow $1 user_home_dir_t:dir search_dir_perms;
2379         files_search_home($1)
2380 ')
2381
2382 ########################################
2383 ## <summary>
2384 ##      Create, read, write, and delete named sockets
2385 ##      in a user home subdirectory.
2386 ## </summary>
2387 ## <param name="domain">
2388 ##      <summary>
2389 ##      Domain allowed access.
2390 ##      </summary>
2391 ## </param>
2392 #
2393 interface(`userdom_manage_user_home_content_sockets',`
2394         gen_require(`
2395                 type user_home_dir_t, user_home_t;
2396         ')
2397
2398         allow $1 user_home_dir_t:dir search_dir_perms;
2399         manage_sock_files_pattern($1, user_home_t, user_home_t)
2400         files_search_home($1)
2401 ')
2402
2403 ########################################
2404 ## <summary>
2405 ##      Create objects in a user home directory
2406 ##      with an automatic type transition to
2407 ##      a specified private type.
2408 ## </summary>
2409 ## <param name="domain">
2410 ##      <summary>
2411 ##      Domain allowed access.
2412 ##      </summary>
2413 ## </param>
2414 ## <param name="private_type">
2415 ##      <summary>
2416 ##      The type of the object to create.
2417 ##      </summary>
2418 ## </param>
2419 ## <param name="object_class">
2420 ##      <summary>
2421 ##      The class of the object to be created.
2422 ##      </summary>
2423 ## </param>
2424 #
2425 interface(`userdom_user_home_dir_filetrans',`
2426         gen_require(`
2427                 type user_home_dir_t;
2428         ')
2429
2430         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2431         files_search_home($1)
2432 ')
2433
2434 ########################################
2435 ## <summary>
2436 ##      Create objects in a user home directory
2437 ##      with an automatic type transition to
2438 ##      a specified private type.
2439 ## </summary>
2440 ## <param name="domain">
2441 ##      <summary>
2442 ##      Domain allowed access.
2443 ##      </summary>
2444 ## </param>
2445 ## <param name="private_type">
2446 ##      <summary>
2447 ##      The type of the object to create.
2448 ##      </summary>
2449 ## </param>
2450 ## <param name="object_class">
2451 ##      <summary>
2452 ##      The class of the object to be created.
2453 ##      </summary>
2454 ## </param>
2455 #
2456 interface(`userdom_user_home_content_filetrans',`
2457         gen_require(`
2458                 type user_home_dir_t, user_home_t;
2459         ')
2460
2461         filetrans_pattern($1, user_home_t, $2, $3)
2462         allow $1 user_home_dir_t:dir search_dir_perms;
2463         files_search_home($1)
2464 ')
2465
2466 ########################################
2467 ## <summary>
2468 ##      Create objects in a user home directory
2469 ##      with an automatic type transition to
2470 ##      the user home file type.
2471 ## </summary>
2472 ## <param name="domain">
2473 ##      <summary>
2474 ##      Domain allowed access.
2475 ##      </summary>
2476 ## </param>
2477 ## <param name="object_class">
2478 ##      <summary>
2479 ##      The class of the object to be created.
2480 ##      </summary>
2481 ## </param>
2482 #
2483 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2484         gen_require(`
2485                 type user_home_dir_t, user_home_t;
2486         ')
2487
2488         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2489         files_search_home($1)
2490 ')
2491
2492 ########################################
2493 ## <summary>
2494 ##      Write to user temporary named sockets.
2495 ## </summary>
2496 ## <param name="domain">
2497 ##      <summary>
2498 ##      Domain allowed access.
2499 ##      </summary>
2500 ## </param>
2501 #
2502 interface(`userdom_write_user_tmp_sockets',`
2503         gen_require(`
2504                 type user_tmp_t;
2505         ')
2506
2507         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2508         files_search_tmp($1)
2509 ')
2510
2511 ########################################
2512 ## <summary>
2513 ##      List user temporary directories.
2514 ## </summary>
2515 ## <param name="domain">
2516 ##      <summary>
2517 ##      Domain allowed access.
2518 ##      </summary>
2519 ## </param>
2520 #
2521 interface(`userdom_list_user_tmp',`
2522         gen_require(`
2523                 type user_tmp_t;
2524         ')
2525
2526         allow $1 user_tmp_t:dir list_dir_perms;
2527         files_search_tmp($1)
2528 ')
2529
2530 ########################################
2531 ## <summary>
2532 ##      Do not audit attempts to list user
2533 ##      temporary directories.
2534 ## </summary>
2535 ## <param name="domain">
2536 ##      <summary>
2537 ##      Domain to not audit.
2538 ##      </summary>
2539 ## </param>
2540 #
2541 interface(`userdom_dontaudit_list_user_tmp',`
2542         gen_require(`
2543                 type user_tmp_t;
2544         ')
2545
2546         dontaudit $1 user_tmp_t:dir list_dir_perms;
2547 ')
2548
2549 ########################################
2550 ## <summary>
2551 ##      Do not audit attempts to manage users
2552 ##      temporary directories.
2553 ## </summary>
2554 ## <param name="domain">
2555 ##      <summary>
2556 ##      Domain to not audit.
2557 ##      </summary>
2558 ## </param>
2559 #
2560 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2561         gen_require(`
2562                 type user_tmp_t;
2563         ')
2564
2565         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2566 ')
2567
2568 ########################################
2569 ## <summary>
2570 ##      Read user temporary files.
2571 ## </summary>
2572 ## <param name="domain">
2573 ##      <summary>
2574 ##      Domain allowed access.
2575 ##      </summary>
2576 ## </param>
2577 #
2578 interface(`userdom_read_user_tmp_files',`
2579         gen_require(`
2580                 type user_tmp_t;
2581         ')
2582
2583         read_files_pattern($1, user_tmp_t, user_tmp_t)
2584         allow $1 user_tmp_t:dir list_dir_perms;
2585         files_search_tmp($1)
2586 ')
2587
2588 ########################################
2589 ## <summary>
2590 ##      Do not audit attempts to read users
2591 ##      temporary files.
2592 ## </summary>
2593 ## <param name="domain">
2594 ##      <summary>
2595 ##      Domain to not audit.
2596 ##      </summary>
2597 ## </param>
2598 #
2599 interface(`userdom_dontaudit_read_user_tmp_files',`
2600         gen_require(`
2601                 type user_tmp_t;
2602         ')
2603
2604         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2605 ')
2606
2607 ########################################
2608 ## <summary>
2609 ##      Do not audit attempts to append users
2610 ##      temporary files.
2611 ## </summary>
2612 ## <param name="domain">
2613 ##      <summary>
2614 ##      Domain to not audit.
2615 ##      </summary>
2616 ## </param>
2617 #
2618 interface(`userdom_dontaudit_append_user_tmp_files',`
2619         gen_require(`
2620                 type user_tmp_t;
2621         ')
2622
2623         dontaudit $1 user_tmp_t:file append_file_perms;
2624 ')
2625
2626 ########################################
2627 ## <summary>
2628 ##      Read and write user temporary files.
2629 ## </summary>
2630 ## <param name="domain">
2631 ##      <summary>
2632 ##      Domain allowed access.
2633 ##      </summary>
2634 ## </param>
2635 #
2636 interface(`userdom_rw_user_tmp_files',`
2637         gen_require(`
2638                 type user_tmp_t;
2639         ')
2640
2641         allow $1 user_tmp_t:dir list_dir_perms;
2642         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2643         files_search_tmp($1)
2644 ')
2645
2646 ########################################
2647 ## <summary>
2648 ##      Do not audit attempts to manage users
2649 ##      temporary files.
2650 ## </summary>
2651 ## <param name="domain">
2652 ##      <summary>
2653 ##      Domain to not audit.
2654 ##      </summary>
2655 ## </param>
2656 #
2657 interface(`userdom_dontaudit_manage_user_tmp_files',`
2658         gen_require(`
2659                 type user_tmp_t;
2660         ')
2661
2662         dontaudit $1 user_tmp_t:file manage_file_perms;
2663 ')
2664
2665 ########################################
2666 ## <summary>
2667 ##      Read user temporary symbolic links.
2668 ## </summary>
2669 ## <param name="domain">
2670 ##      <summary>
2671 ##      Domain allowed access.
2672 ##      </summary>
2673 ## </param>
2674 #
2675 interface(`userdom_read_user_tmp_symlinks',`
2676         gen_require(`
2677                 type user_tmp_t;
2678         ')
2679
2680         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2681         allow $1 user_tmp_t:dir list_dir_perms;
2682         files_search_tmp($1)
2683 ')
2684
2685 ########################################
2686 ## <summary>
2687 ##      Create, read, write, and delete user
2688 ##      temporary directories.
2689 ## </summary>
2690 ## <param name="domain">
2691 ##      <summary>
2692 ##      Domain allowed access.
2693 ##      </summary>
2694 ## </param>
2695 #
2696 interface(`userdom_manage_user_tmp_dirs',`
2697         gen_require(`
2698                 type user_tmp_t;
2699         ')
2700
2701         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2702         files_search_tmp($1)
2703 ')
2704
2705 ########################################
2706 ## <summary>
2707 ##      Create, read, write, and delete user
2708 ##      temporary files.
2709 ## </summary>
2710 ## <param name="domain">
2711 ##      <summary>
2712 ##      Domain allowed access.
2713 ##      </summary>
2714 ## </param>
2715 #
2716 interface(`userdom_manage_user_tmp_files',`
2717         gen_require(`
2718                 type user_tmp_t;
2719         ')
2720
2721         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2722         files_search_tmp($1)
2723 ')
2724
2725 ########################################
2726 ## <summary>
2727 ##      Create, read, write, and delete user
2728 ##      temporary symbolic links.
2729 ## </summary>
2730 ## <param name="domain">
2731 ##      <summary>
2732 ##      Domain allowed access.
2733 ##      </summary>
2734 ## </param>
2735 #
2736 interface(`userdom_manage_user_tmp_symlinks',`
2737         gen_require(`
2738                 type user_tmp_t;
2739         ')
2740
2741         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2742         files_search_tmp($1)
2743 ')
2744
2745 ########################################
2746 ## <summary>
2747 ##      Create, read, write, and delete user
2748 ##      temporary named pipes.
2749 ## </summary>
2750 ## <param name="domain">
2751 ##      <summary>
2752 ##      Domain allowed access.
2753 ##      </summary>
2754 ## </param>
2755 #
2756 interface(`userdom_manage_user_tmp_pipes',`
2757         gen_require(`
2758                 type user_tmp_t;
2759         ')
2760
2761         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2762         files_search_tmp($1)
2763 ')
2764
2765 ########################################
2766 ## <summary>
2767 ##      Create, read, write, and delete user
2768 ##      temporary named sockets.
2769 ## </summary>
2770 ## <param name="domain">
2771 ##      <summary>
2772 ##      Domain allowed access.
2773 ##      </summary>
2774 ## </param>
2775 #
2776 interface(`userdom_manage_user_tmp_sockets',`
2777         gen_require(`
2778                 type user_tmp_t;
2779         ')
2780
2781         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2782         files_search_tmp($1)
2783 ')
2784
2785 ########################################
2786 ## <summary>
2787 ##      Create objects in a user temporary directory
2788 ##      with an automatic type transition to
2789 ##      a specified private type.
2790 ## </summary>
2791 ## <param name="domain">
2792 ##      <summary>
2793 ##      Domain allowed access.
2794 ##      </summary>
2795 ## </param>
2796 ## <param name="private_type">
2797 ##      <summary>
2798 ##      The type of the object to create.
2799 ##      </summary>
2800 ## </param>
2801 ## <param name="object_class">
2802 ##      <summary>
2803 ##      The class of the object to be created.
2804 ##      </summary>
2805 ## </param>
2806 #
2807 interface(`userdom_user_tmp_filetrans',`
2808         gen_require(`
2809                 type user_tmp_t;
2810         ')
2811
2812         filetrans_pattern($1, user_tmp_t, $2, $3)
2813         files_search_tmp($1)
2814 ')
2815
2816 ########################################
2817 ## <summary>
2818 ##      Create objects in the temporary directory
2819 ##      with an automatic type transition to
2820 ##      the user temporary type.
2821 ## </summary>
2822 ## <param name="domain">
2823 ##      <summary>
2824 ##      Domain allowed access.
2825 ##      </summary>
2826 ## </param>
2827 ## <param name="object_class">
2828 ##      <summary>
2829 ##      The class of the object to be created.
2830 ##      </summary>
2831 ## </param>
2832 #
2833 interface(`userdom_tmp_filetrans_user_tmp',`
2834         gen_require(`
2835                 type user_tmp_t;
2836         ')
2837
2838         files_tmp_filetrans($1, user_tmp_t, $2)
2839 ')
2840
2841 ########################################
2842 ## <summary>
2843 ##      Read user tmpfs files.
2844 ## </summary>
2845 ## <param name="domain">
2846 ##      <summary>
2847 ##      Domain allowed access.
2848 ##      </summary>
2849 ## </param>
2850 #
2851 interface(`userdom_read_user_tmpfs_files',`
2852         gen_require(`
2853                 type user_tmpfs_t;
2854         ')
2855
2856         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2857         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2858         allow $1 user_tmpfs_t:dir list_dir_perms;
2859         fs_search_tmpfs($1)
2860 ')
2861
2862 ########################################
2863 ## <summary>
2864 ##      Read/Write user tmpfs files.
2865 ## </summary>
2866 ## <param name="domain">
2867 ##      <summary>
2868 ##      Domain allowed access.
2869 ##      </summary>
2870 ## </param>
2871 #
2872 interface(`userdom_rw_user_tmpfs_files',`
2873         gen_require(`
2874                 type user_tmpfs_t;
2875         ')
2876
2877         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2878         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2879         allow $1 user_tmpfs_t:dir list_dir_perms;
2880         fs_search_tmpfs($1)
2881 ')
2882
2883 ########################################
2884 ## <summary>
2885 ##      Get the attributes of a user domain tty.
2886 ## </summary>
2887 ## <param name="domain">
2888 ##      <summary>
2889 ##      Domain allowed access.
2890 ##      </summary>
2891 ## </param>
2892 #
2893 interface(`userdom_getattr_user_ttys',`
2894         gen_require(`
2895                 type user_tty_device_t;
2896         ')
2897
2898         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2899 ')
2900
2901 ########################################
2902 ## <summary>
2903 ##      Do not audit attempts to get the attributes of a user domain tty.
2904 ## </summary>
2905 ## <param name="domain">
2906 ##      <summary>
2907 ##      Domain to not audit.
2908 ##      </summary>
2909 ## </param>
2910 #
2911 interface(`userdom_dontaudit_getattr_user_ttys',`
2912         gen_require(`
2913                 type user_tty_device_t;
2914         ')
2915
2916         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2917 ')
2918
2919 ########################################
2920 ## <summary>
2921 ##      Set the attributes of a user domain tty.
2922 ## </summary>
2923 ## <param name="domain">
2924 ##      <summary>
2925 ##      Domain allowed access.
2926 ##      </summary>
2927 ## </param>
2928 #
2929 interface(`userdom_setattr_user_ttys',`
2930         gen_require(`
2931                 type user_tty_device_t;
2932         ')
2933
2934         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2935 ')
2936
2937 ########################################
2938 ## <summary>
2939 ##      Do not audit attempts to set the attributes of a user domain tty.
2940 ## </summary>
2941 ## <param name="domain">
2942 ##      <summary>
2943 ##      Domain to not audit.
2944 ##      </summary>
2945 ## </param>
2946 #
2947 interface(`userdom_dontaudit_setattr_user_ttys',`
2948         gen_require(`
2949                 type user_tty_device_t;
2950         ')
2951
2952         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2953 ')
2954
2955 ########################################
2956 ## <summary>
2957 ##      Read and write a user domain tty.
2958 ## </summary>
2959 ## <param name="domain">
2960 ##      <summary>
2961 ##      Domain allowed access.
2962 ##      </summary>
2963 ## </param>
2964 #
2965 interface(`userdom_use_user_ttys',`
2966         gen_require(`
2967                 type user_tty_device_t;
2968         ')
2969
2970         allow $1 user_tty_device_t:chr_file rw_term_perms;
2971 ')
2972
2973 ########################################
2974 ## <summary>
2975 ##      Read and write a inherited user domain tty.
2976 ## </summary>
2977 ## <param name="domain">
2978 ##      <summary>
2979 ##      Domain allowed access.
2980 ##      </summary>
2981 ## </param>
2982 #
2983 interface(`userdom_use_inherited_user_ttys',`
2984         gen_require(`
2985                 type user_tty_device_t;
2986         ')
2987
2988         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2989 ')
2990
2991 ########################################
2992 ## <summary>
2993 ##      Read and write a user domain pty.
2994 ## </summary>
2995 ## <param name="domain">
2996 ##      <summary>
2997 ##      Domain allowed access.
2998 ##      </summary>
2999 ## </param>
3000 #
3001 interface(`userdom_use_user_ptys',`
3002         gen_require(`
3003                 type user_devpts_t;
3004         ')
3005
3006         allow $1 user_devpts_t:chr_file rw_term_perms;
3007 ')
3008
3009 ########################################
3010 ## <summary>
3011 ##      Read and write a inherited user domain pty.
3012 ## </summary>
3013 ## <param name="domain">
3014 ##      <summary>
3015 ##      Domain allowed access.
3016 ##      </summary>
3017 ## </param>
3018 #
3019 interface(`userdom_use_inherited_user_ptys',`
3020         gen_require(`
3021                 type user_devpts_t;
3022         ')
3023
3024         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3025 ')
3026
3027 ########################################
3028 ## <summary>
3029 ##      Read and write a inherited user TTYs and PTYs.
3030 ## </summary>
3031 ## <desc>
3032 ##      <p>
3033 ##      Allow the specified domain to read and write inherited user
3034 ##      TTYs and PTYs. This will allow the domain to
3035 ##      interact with the user via the terminal. Typically
3036 ##      all interactive applications will require this
3037 ##      access.
3038 ##      </p>
3039 ## </desc>
3040 ## <param name="domain">
3041 ##      <summary>
3042 ##      Domain allowed access.
3043 ##      </summary>
3044 ## </param>
3045 ## <infoflow type="both" weight="10"/>
3046 #
3047 interface(`userdom_use_inherited_user_terminals',`
3048         gen_require(`
3049                 type user_tty_device_t, user_devpts_t;
3050         ')
3051
3052         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3053         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3054 ')
3055
3056 #######################################
3057 ## <summary>
3058 ##  Allow attempts to read and write
3059 ##  a user domain tty and pty.
3060 ## </summary>
3061 ## <param name="domain">
3062 ##  <summary>
3063 ##  Domain to not audit.
3064 ##  </summary>
3065 ## </param>
3066 #
3067 interface(`userdom_use_user_terminals',`
3068     gen_require(`
3069         type user_tty_device_t, user_devpts_t;
3070     ')
3071
3072     allow $1 user_tty_device_t:chr_file rw_term_perms;
3073     allow $1 user_devpts_t:chr_file rw_term_perms;
3074 ')
3075
3076 ########################################
3077 ## <summary>
3078 ##      Do not audit attempts to read and write
3079 ##      a user domain tty and pty.
3080 ## </summary>
3081 ## <param name="domain">
3082 ##      <summary>
3083 ##      Domain to not audit.
3084 ##      </summary>
3085 ## </param>
3086 #
3087 interface(`userdom_dontaudit_use_user_terminals',`
3088         gen_require(`
3089                 type user_tty_device_t, user_devpts_t;
3090         ')
3091
3092         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3093         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3094 ')
3095
3096
3097 ########################################
3098 ## <summary>
3099 ##      Get attributes of user domain tty and pty.
3100 ## </summary>
3101 ## <param name="domain">
3102 ##      <summary>
3103 ##      Domain allowed access.
3104 ##      </summary>
3105 ## </param>
3106 #
3107 interface(`userdom_getattr_user_terminals',`
3108         gen_require(`
3109                 type user_tty_device_t, user_devpts_t;
3110         ')
3111
3112         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3113 ')
3114
3115 ########################################
3116 ## <summary>
3117 ##      Execute a shell in all user domains.  This
3118 ##      is an explicit transition, requiring the
3119 ##      caller to use setexeccon().
3120 ## </summary>
3121 ## <param name="domain">
3122 ##      <summary>
3123 ##      Domain allowed to transition.
3124 ##      </summary>
3125 ## </param>
3126 #
3127 interface(`userdom_spec_domtrans_all_users',`
3128         gen_require(`
3129                 attribute userdomain;
3130         ')
3131
3132         corecmd_shell_spec_domtrans($1, userdomain)
3133         allow userdomain $1:fd use;
3134         allow userdomain $1:fifo_file rw_file_perms;
3135         allow userdomain $1:process sigchld;
3136 ')
3137
3138 ########################################
3139 ## <summary>
3140 ##      Execute an Xserver session in all unprivileged user domains.  This
3141 ##      is an explicit transition, requiring the
3142 ##      caller to use setexeccon().
3143 ## </summary>
3144 ## <param name="domain">
3145 ##      <summary>
3146 ##      Domain allowed to transition.
3147 ##      </summary>
3148 ## </param>
3149 #
3150 interface(`userdom_xsession_spec_domtrans_all_users',`
3151         gen_require(`
3152                 attribute userdomain;
3153         ')
3154
3155         xserver_xsession_spec_domtrans($1, userdomain)
3156         allow userdomain $1:fd use;
3157         allow userdomain $1:fifo_file rw_file_perms;
3158         allow userdomain $1:process sigchld;
3159 ')
3160
3161 ########################################
3162 ## <summary>
3163 ##      Execute a shell in all unprivileged user domains.  This
3164 ##      is an explicit transition, requiring the
3165 ##      caller to use setexeccon().
3166 ## </summary>
3167 ## <param name="domain">
3168 ##      <summary>
3169 ##      Domain allowed to transition.
3170 ##      </summary>
3171 ## </param>
3172 #
3173 interface(`userdom_spec_domtrans_unpriv_users',`
3174         gen_require(`
3175                 attribute unpriv_userdomain;
3176         ')
3177
3178         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3179         allow unpriv_userdomain $1:fd use;
3180         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3181         allow unpriv_userdomain $1:process sigchld;
3182 ')
3183
3184 ########################################
3185 ## <summary>
3186 ##      Execute an Xserver session in all unprivileged user domains.  This
3187 ##      is an explicit transition, requiring the
3188 ##      caller to use setexeccon().
3189 ## </summary>
3190 ## <param name="domain">
3191 ##      <summary>
3192 ##      Domain allowed to transition.
3193 ##      </summary>
3194 ## </param>
3195 #
3196 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3197         gen_require(`
3198                 attribute unpriv_userdomain;
3199         ')
3200
3201         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3202         allow unpriv_userdomain $1:fd use;
3203         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3204         allow unpriv_userdomain $1:process sigchld;
3205 ')
3206
3207 ########################################
3208 ## <summary>
3209 ##      Manage unpriviledged user SysV sempaphores.
3210 ## </summary>
3211 ## <param name="domain">
3212 ##      <summary>
3213 ##      Domain allowed access.
3214 ##      </summary>
3215 ## </param>
3216 #
3217 interface(`userdom_manage_unpriv_user_semaphores',`
3218         gen_require(`
3219                 attribute unpriv_userdomain;
3220         ')
3221
3222         allow $1 unpriv_userdomain:sem create_sem_perms;
3223 ')
3224
3225 ########################################
3226 ## <summary>
3227 ##      Manage unpriviledged user SysV shared
3228 ##      memory segments.
3229 ## </summary>
3230 ## <param name="domain">
3231 ##      <summary>
3232 ##      Domain allowed access.
3233 ##      </summary>
3234 ## </param>
3235 #
3236 interface(`userdom_manage_unpriv_user_shared_mem',`
3237         gen_require(`
3238                 attribute unpriv_userdomain;
3239         ')
3240
3241         allow $1 unpriv_userdomain:shm create_shm_perms;
3242 ')
3243
3244 ########################################
3245 ## <summary>
3246 ##      Execute bin_t in the unprivileged user domains. This
3247 ##      is an explicit transition, requiring the
3248 ##      caller to use setexeccon().
3249 ## </summary>
3250 ## <param name="domain">
3251 ##      <summary>
3252 ##      Domain allowed to transition.
3253 ##      </summary>
3254 ## </param>
3255 #
3256 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3257         gen_require(`
3258                 attribute unpriv_userdomain;
3259         ')
3260
3261         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3262         allow unpriv_userdomain $1:fd use;
3263         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3264         allow unpriv_userdomain $1:process sigchld;
3265 ')
3266
3267 ########################################
3268 ## <summary>
3269 ##      Execute all entrypoint files in unprivileged user
3270 ##      domains. This is an explicit transition, requiring the
3271 ##      caller to use setexeccon().
3272 ## </summary>
3273 ## <param name="domain">
3274 ##      <summary>
3275 ##      Domain allowed access.
3276 ##      </summary>
3277 ## </param>
3278 #
3279 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3280         gen_require(`
3281                 attribute unpriv_userdomain;
3282         ')
3283
3284         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3285         allow unpriv_userdomain $1:fd use;
3286         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3287         allow unpriv_userdomain $1:process sigchld;
3288 ')
3289
3290 ########################################
3291 ## <summary>
3292 ##      Search users home directories.
3293 ## </summary>
3294 ## <param name="domain">
3295 ##      <summary>
3296 ##      Domain allowed access.
3297 ##      </summary>
3298 ## </param>
3299 #
3300 interface(`userdom_search_user_home_content',`
3301         gen_require(`
3302                 type user_home_dir_t;
3303                 attribute user_home_type;
3304         ')
3305
3306         files_list_home($1)
3307         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3308         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3309 ')
3310
3311 ########################################
3312 ## <summary>
3313 ##      Send general signals to unprivileged user domains.
3314 ## </summary>
3315 ## <param name="domain">
3316 ##      <summary>
3317 ##      Domain allowed access.
3318 ##      </summary>
3319 ## </param>
3320 #
3321 interface(`userdom_signal_unpriv_users',`
3322         gen_require(`
3323                 attribute unpriv_userdomain;
3324         ')
3325
3326         allow $1 unpriv_userdomain:process signal;
3327 ')
3328
3329 ########################################
3330 ## <summary>
3331 ##      Inherit the file descriptors from unprivileged user domains.
3332 ## </summary>
3333 ## <param name="domain">
3334 ##      <summary>
3335 ##      Domain allowed access.
3336 ##      </summary>
3337 ## </param>
3338 #
3339 interface(`userdom_use_unpriv_users_fds',`
3340         gen_require(`
3341                 attribute unpriv_userdomain;
3342         ')
3343
3344         allow $1 unpriv_userdomain:fd use;
3345 ')
3346
3347 ########################################
3348 ## <summary>
3349 ##      Do not audit attempts to inherit the file descriptors
3350 ##      from unprivileged user domains.
3351 ## </summary>
3352 ## <desc>
3353 ##      <p>
3354 ##      Do not audit attempts to inherit the file descriptors
3355 ##      from unprivileged user domains. This will supress
3356 ##      SELinux denial messages when the specified domain is denied
3357 ##      the permission to inherit these file descriptors.
3358 ##      </p>
3359 ## </desc>
3360 ## <param name="domain">
3361 ##      <summary>
3362 ##      Domain to not audit.
3363 ##      </summary>
3364 ## </param>
3365 ## <infoflow type="none"/>
3366 #
3367 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3368         gen_require(`
3369                 attribute unpriv_userdomain;
3370         ')
3371
3372         dontaudit $1 unpriv_userdomain:fd use;
3373 ')
3374
3375 ########################################
3376 ## <summary>
3377 ##      Do not audit attempts to use user ptys.
3378 ## </summary>
3379 ## <param name="domain">
3380 ##      <summary>
3381 ##      Domain to not audit.
3382 ##      </summary>
3383 ## </param>
3384 #
3385 interface(`userdom_dontaudit_use_user_ptys',`
3386         gen_require(`
3387                 type user_devpts_t;
3388         ')
3389
3390         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3391 ')
3392
3393 ########################################
3394 ## <summary>
3395 ##      Relabel files to unprivileged user pty types.
3396 ## </summary>
3397 ## <param name="domain">
3398 ##      <summary>
3399 ##      Domain allowed access.
3400 ##      </summary>
3401 ## </param>
3402 #
3403 interface(`userdom_relabelto_user_ptys',`
3404         gen_require(`
3405                 type user_devpts_t;
3406         ')
3407
3408         allow $1 user_devpts_t:chr_file relabelto;
3409 ')
3410
3411 ########################################
3412 ## <summary>
3413 ##      Do not audit attempts to relabel files from
3414 ##      user pty types.
3415 ## </summary>
3416 ## <param name="domain">
3417 ##      <summary>
3418 ##      Domain to not audit.
3419 ##      </summary>
3420 ## </param>
3421 #
3422 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3423         gen_require(`
3424                 type user_devpts_t;
3425         ')
3426
3427         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3428 ')
3429
3430 ########################################
3431 ## <summary>
3432 ##      Write all users files in /tmp
3433 ## </summary>
3434 ## <param name="domain">
3435 ##      <summary>
3436 ##      Domain allowed access.
3437 ##      </summary>
3438 ## </param>
3439 #
3440 interface(`userdom_write_user_tmp_files',`
3441         gen_require(`
3442                 type user_tmp_t;
3443         ')
3444
3445         write_files_pattern($1, user_tmp_t, user_tmp_t)
3446 ')
3447
3448 ########################################
3449 ## <summary>
3450 ##      Do not audit attempts to write users
3451 ##      temporary files.
3452 ## </summary>
3453 ## <param name="domain">
3454 ##      <summary>
3455 ##      Domain to not audit.
3456 ##      </summary>
3457 ## </param>
3458 #
3459 interface(`userdom_dontaudit_write_user_tmp_files',`
3460         gen_require(`
3461                 type user_tmp_t;
3462         ')
3463
3464         dontaudit $1 user_tmp_t:file write;
3465 ')
3466
3467 ########################################
3468 ## <summary>
3469 ##      Do not audit attempts to read/write users
3470 ##      temporary fifo files.
3471 ## </summary>
3472 ## <param name="domain">
3473 ##      <summary>
3474 ##      Domain to not audit.
3475 ##      </summary>
3476 ## </param>
3477 #
3478 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3479         gen_require(`
3480                 type user_tmp_t;
3481         ')
3482
3483         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3484 ')
3485
3486 ########################################
3487 ## <summary>
3488 ##      Do not audit attempts to use user ttys.
3489 ## </summary>
3490 ## <param name="domain">
3491 ##      <summary>
3492 ##      Domain to not audit.
3493 ##      </summary>
3494 ## </param>
3495 #
3496 interface(`userdom_dontaudit_use_user_ttys',`
3497         gen_require(`
3498                 type user_tty_device_t;
3499         ')
3500
3501         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3502 ')
3503
3504 ########################################
3505 ## <summary>
3506 ##      Read the process state of all user domains.
3507 ## </summary>
3508 ## <param name="domain">
3509 ##      <summary>
3510 ##      Domain allowed access.
3511 ##      </summary>
3512 ## </param>
3513 #
3514 interface(`userdom_read_all_users_state',`
3515         gen_require(`
3516                 attribute userdomain;
3517         ')
3518
3519         read_files_pattern($1, userdomain, userdomain)
3520         read_lnk_files_pattern($1,userdomain,userdomain)
3521         kernel_search_proc($1)
3522 ')
3523
3524 ########################################
3525 ## <summary>
3526 ##      Get the attributes of all user domains.
3527 ## </summary>
3528 ## <param name="domain">
3529 ##      <summary>
3530 ##      Domain allowed access.
3531 ##      </summary>
3532 ## </param>
3533 #
3534 interface(`userdom_getattr_all_users',`
3535         gen_require(`
3536                 attribute userdomain;
3537         ')
3538
3539         allow $1 userdomain:process getattr;
3540 ')
3541
3542 ########################################
3543 ## <summary>
3544 ##      Inherit the file descriptors from all user domains
3545 ## </summary>
3546 ## <param name="domain">
3547 ##      <summary>
3548 ##      Domain allowed access.
3549 ##      </summary>
3550 ## </param>
3551 #
3552 interface(`userdom_use_all_users_fds',`
3553         gen_require(`
3554                 attribute userdomain;
3555         ')
3556
3557         allow $1 userdomain:fd use;
3558 ')
3559
3560 ########################################
3561 ## <summary>
3562 ##      Do not audit attempts to inherit the file
3563 ##      descriptors from any user domains.
3564 ## </summary>
3565 ## <param name="domain">
3566 ##      <summary>
3567 ##      Domain to not audit.
3568 ##      </summary>
3569 ## </param>
3570 #
3571 interface(`userdom_dontaudit_use_all_users_fds',`
3572         gen_require(`
3573                 attribute userdomain;
3574         ')
3575
3576         dontaudit $1 userdomain:fd use;
3577 ')
3578
3579 ########################################
3580 ## <summary>
3581 ##      Send general signals to all user domains.
3582 ## </summary>
3583 ## <param name="domain">
3584 ##      <summary>
3585 ##      Domain allowed access.
3586 ##      </summary>
3587 ## </param>
3588 #
3589 interface(`userdom_signal_all_users',`
3590         gen_require(`
3591                 attribute userdomain;
3592         ')
3593
3594         allow $1 userdomain:process signal;
3595 ')
3596
3597 ########################################
3598 ## <summary>
3599 ##      Send kill signals to all user domains.
3600 ## </summary>
3601 ## <param name="domain">
3602 ##      <summary>
3603 ##      Domain allowed access.
3604 ##      </summary>
3605 ## </param>
3606 #
3607 interface(`userdom_kill_all_users',`
3608         gen_require(`
3609                 attribute userdomain;
3610         ')
3611
3612         allow $1 userdomain:process sigkill;
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Send a SIGCHLD signal to all user domains.
3618 ## </summary>
3619 ## <param name="domain">
3620 ##      <summary>
3621 ##      Domain allowed access.
3622 ##      </summary>
3623 ## </param>
3624 #
3625 interface(`userdom_sigchld_all_users',`
3626         gen_require(`
3627                 attribute userdomain;
3628         ')
3629
3630         allow $1 userdomain:process sigchld;
3631 ')
3632
3633 ########################################
3634 ## <summary>
3635 ##      Create keys for all user domains.
3636 ## </summary>
3637 ## <param name="domain">
3638 ##      <summary>
3639 ##      Domain allowed access.
3640 ##      </summary>
3641 ## </param>
3642 #
3643 interface(`userdom_create_all_users_keys',`
3644         gen_require(`
3645                 attribute userdomain;
3646         ')
3647
3648         allow $1 userdomain:key create;
3649 ')
3650
3651 ########################################
3652 ## <summary>
3653 ##      Send a dbus message to all user domains.
3654 ## </summary>
3655 ## <param name="domain">
3656 ##      <summary>
3657 ##      Domain allowed access.
3658 ##      </summary>
3659 ## </param>
3660 #
3661 interface(`userdom_dbus_send_all_users',`
3662         gen_require(`
3663                 attribute userdomain;
3664                 class dbus send_msg;
3665         ')
3666
3667         allow $1 userdomain:dbus send_msg;
3668 ')
3669
3670 ########################################
3671 ## <summary>
3672 ##      Allow apps to set rlimits on userdomain
3673 ## </summary>
3674 ## <param name="domain">
3675 ##      <summary>
3676 ##      Domain allowed access.
3677 ##      </summary>
3678 ## </param>
3679 #
3680 interface(`userdom_set_rlimitnh',`
3681         gen_require(`
3682                 attribute userdomain;
3683         ')
3684
3685         allow $1 userdomain:process rlimitinh;
3686 ')
3687
3688 ########################################
3689 ## <summary>
3690 ##      Define this type as a Allow apps to set rlimits on userdomain
3691 ## </summary>
3692 ## <param name="domain">
3693 ##      <summary>
3694 ##      Domain allowed access.
3695 ##      </summary>
3696 ## </param>
3697 ## <param name="userdomain_prefix">
3698 ##      <summary>
3699 ##      The prefix of the user domain (e.g., user
3700 ##      is the prefix for user_t).
3701 ## </summary>
3702 ## </param>
3703 ## <param name="domain">
3704 ##      <summary>
3705 ##      Domain allowed access.
3706 ##      </summary>
3707 ## </param>
3708 #
3709 template(`userdom_unpriv_usertype',`
3710         gen_require(`
3711                 attribute unpriv_userdomain, userdomain;
3712                 attribute $1_usertype;
3713         ')
3714         typeattribute $2  $1_usertype;
3715         typeattribute $2  unpriv_userdomain;
3716         typeattribute $2  userdomain;
3717
3718         ubac_constrained($2)
3719 ')
3720
3721 ########################################
3722 ## <summary>
3723 ##      Connect to users over an unix stream socket.
3724 ## </summary>
3725 ## <param name="domain">
3726 ##      <summary>
3727 ##      Domain allowed access.
3728 ##      </summary>
3729 ## </param>
3730 #
3731 interface(`userdom_stream_connect',`
3732         gen_require(`
3733                 type user_tmp_t;
3734                 attribute userdomain;
3735         ')
3736
3737         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3738 ')
3739
3740 ########################################
3741 ## <summary>
3742 ##      Ptrace user domains.
3743 ## </summary>
3744 ## <param name="domain">
3745 ##      <summary>
3746 ##      Domain allowed access.
3747 ##      </summary>
3748 ## </param>
3749 #
3750 interface(`userdom_ptrace_all_users',`
3751         gen_require(`
3752                 attribute userdomain;
3753         ')
3754
3755         allow $1 userdomain:process ptrace;
3756 ')
3757
3758 ########################################
3759 ## <summary>
3760 ##      dontaudit Search /root
3761 ## </summary>
3762 ## <param name="domain">
3763 ##      <summary>
3764 ##      Domain to not audit.
3765 ##      </summary>
3766 ## </param>
3767 #
3768 interface(`userdom_dontaudit_search_admin_dir',`
3769         gen_require(`
3770                 type admin_home_t;
3771         ')
3772
3773         dontaudit $1 admin_home_t:dir search_dir_perms;
3774 ')
3775
3776 ########################################
3777 ## <summary>
3778 ##      dontaudit list /root
3779 ## </summary>
3780 ## <param name="domain">
3781 ##      <summary>
3782 ##      Domain to not audit.
3783 ##      </summary>
3784 ## </param>
3785 #
3786 interface(`userdom_dontaudit_list_admin_dir',`
3787         gen_require(`
3788                 type admin_home_t;
3789         ')
3790
3791         dontaudit $1 admin_home_t:dir list_dir_perms;
3792 ')
3793
3794 ########################################
3795 ## <summary>
3796 ##      Allow domain to  list /root
3797 ## </summary>
3798 ## <param name="domain">
3799 ##      <summary>
3800 ##      Domain allowed access.
3801 ##      </summary>
3802 ## </param>
3803 #
3804 interface(`userdom_list_admin_dir',`
3805         gen_require(`
3806                 type admin_home_t;
3807         ')
3808
3809         allow $1 admin_home_t:dir list_dir_perms;
3810 ')
3811
3812 ########################################
3813 ## <summary>
3814 ##      Allow Search /root
3815 ## </summary>
3816 ## <param name="domain">
3817 ##      <summary>
3818 ##      Domain allowed access.
3819 ##      </summary>
3820 ## </param>
3821 #
3822 interface(`userdom_search_admin_dir',`
3823         gen_require(`
3824                 type admin_home_t;
3825         ')
3826
3827         allow $1 admin_home_t:dir search_dir_perms;
3828 ')
3829
3830 ########################################
3831 ## <summary>
3832 ##      RW unpriviledged user SysV sempaphores.
3833 ## </summary>
3834 ## <param name="domain">
3835 ##      <summary>
3836 ##      Domain allowed access.
3837 ##      </summary>
3838 ## </param>
3839 #
3840 interface(`userdom_rw_semaphores',`
3841         gen_require(`
3842                 attribute unpriv_userdomain;
3843         ')
3844
3845         allow $1 unpriv_userdomain:sem rw_sem_perms;
3846 ')
3847
3848 ########################################
3849 ## <summary>
3850 ##      Send a message to unpriv users over a unix domain
3851 ##      datagram socket.
3852 ## </summary>
3853 ## <param name="domain">
3854 ##      <summary>
3855 ##      Domain allowed access.
3856 ##      </summary>
3857 ## </param>
3858 #
3859 interface(`userdom_dgram_send',`
3860         gen_require(`
3861                 attribute unpriv_userdomain;
3862         ')
3863
3864         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3865 ')
3866
3867 ######################################
3868 ## <summary>
3869 ##      Send a message to users over a unix domain
3870 ##      datagram socket.
3871 ## </summary>
3872 ## <param name="domain">
3873 ##      <summary>
3874 ##      Domain allowed access.
3875 ##      </summary>
3876 ## </param>
3877 #
3878 interface(`userdom_users_dgram_send',`
3879         gen_require(`
3880                  attribute userdomain;
3881       ')
3882
3883        allow $1 userdomain:unix_dgram_socket sendto;
3884 ')
3885
3886 #######################################
3887 ## <summary>
3888 ##      Allow execmod on files in homedirectory
3889 ## </summary>
3890 ## <param name="domain">
3891 ##      <summary>
3892 ##      Domain allowed access.
3893 ##      </summary>
3894 ## </param>
3895 ## <rolebase/>
3896 #
3897 interface(`userdom_execmod_user_home_files',`
3898         gen_require(`
3899                 type user_home_type;
3900         ')
3901
3902         allow $1 user_home_type:file execmod;
3903 ')
3904
3905 ########################################
3906 ## <summary>
3907 ##      Read admin home files.
3908 ## </summary>
3909 ## <param name="domain">
3910 ##      <summary>
3911 ##      Domain allowed access.
3912 ##      </summary>
3913 ## </param>
3914 ## <rolecap/>
3915 #
3916 interface(`userdom_read_admin_home_files',`
3917         gen_require(`
3918                 type admin_home_t;
3919         ')
3920
3921         read_files_pattern($1, admin_home_t, admin_home_t)
3922 ')
3923
3924 ########################################
3925 ## <summary>
3926 ##      Execute admin home files.
3927 ## </summary>
3928 ## <param name="domain">
3929 ##      <summary>
3930 ##      Domain allowed access.
3931 ##      </summary>
3932 ## </param>
3933 ## <rolecap/>
3934 #
3935 interface(`userdom_exec_admin_home_files',`
3936         gen_require(`
3937                 type admin_home_t;
3938         ')
3939
3940         exec_files_pattern($1, admin_home_t, admin_home_t)
3941 ')
3942
3943 ########################################
3944 ## <summary>
3945 ##      Append files inherited
3946 ##      in the /root directory.
3947 ## </summary>
3948 ## <param name="domain">
3949 ##      <summary>
3950 ##      Domain allowed access.
3951 ##      </summary>
3952 ## </param>
3953 #
3954 interface(`userdom_inherit_append_admin_home_files',`
3955         gen_require(`
3956                 type admin_home_t;
3957         ')
3958
3959         allow $1 admin_home_t:file { getattr append };
3960 ')
3961
3962
3963 #######################################
3964 ## <summary>
3965 ##      Manage all files/directories in the homedir
3966 ## </summary>
3967 ## <param name="userdomain">
3968 ##      <summary>
3969 ##      The user domain
3970 ##      </summary>
3971 ## </param>
3972 ## <rolebase/>
3973 #
3974 interface(`userdom_manage_user_home_content',`
3975         gen_require(`
3976                 type user_home_dir_t, user_home_t;
3977                 attribute user_home_type;
3978         ')
3979
3980         files_list_home($1)
3981         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3982         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3983         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3984         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3985         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3986         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3987
3988 ')
3989
3990
3991 ########################################
3992 ## <summary>
3993 ##      Create objects in a user home directory
3994 ##      with an automatic type transition to
3995 ##      the user home file type.
3996 ## </summary>
3997 ## <param name="domain">
3998 ##      <summary>
3999 ##      Domain allowed access.
4000 ##      </summary>
4001 ## </param>
4002 ## <param name="object_class">
4003 ##      <summary>
4004 ##      The class of the object to be created.
4005 ##      </summary>
4006 ## </param>
4007 #
4008 interface(`userdom_user_home_dir_filetrans_pattern',`
4009         gen_require(`
4010                 type user_home_dir_t, user_home_t;
4011         ')
4012
4013         type_transition $1 user_home_dir_t:$2 user_home_t;
4014 ')
4015
4016 ########################################
4017 ## <summary>
4018 ##      Create objects in the /root directory
4019 ##      with an automatic type transition to
4020 ##      a specified private type.
4021 ## </summary>
4022 ## <param name="domain">
4023 ##      <summary>
4024 ##      Domain allowed access.
4025 ##      </summary>
4026 ## </param>
4027 ## <param name="private_type">
4028 ##      <summary>
4029 ##      The type of the object to create.
4030 ##      </summary>
4031 ## </param>
4032 ## <param name="object_class">
4033 ##      <summary>
4034 ##      The class of the object to be created.
4035 ##      </summary>
4036 ## </param>
4037 #
4038 interface(`userdom_admin_home_dir_filetrans',`
4039         gen_require(`
4040                 type admin_home_t;
4041         ')
4042
4043         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4044 ')
4045
4046 ########################################
4047 ## <summary>
4048 ##      Send signull to unprivileged user domains.
4049 ## </summary>
4050 ## <param name="domain">
4051 ##      <summary>
4052 ##      Domain allowed access.
4053 ##      </summary>
4054 ## </param>
4055 #
4056 interface(`userdom_signull_unpriv_users',`
4057         gen_require(`
4058                 attribute unpriv_userdomain;
4059         ')
4060
4061         allow $1 unpriv_userdomain:process signull;
4062 ')
4063
4064 ########################################
4065 ## <summary>
4066 ##      Write all users files in /tmp
4067 ## </summary>
4068 ## <param name="domain">
4069 ##      <summary>
4070 ##      Domain allowed access.
4071 ##      </summary>
4072 ## </param>
4073 #
4074 interface(`userdom_write_user_tmp_dirs',`
4075         gen_require(`
4076                 type user_tmp_t;
4077         ')
4078
4079         write_files_pattern($1, user_tmp_t, user_tmp_t)
4080 ')
4081
4082 ########################################
4083 ## <summary>
4084 ##      Manage keys for all user domains.
4085 ## </summary>
4086 ## <param name="domain">
4087 ##      <summary>
4088 ##      Domain allowed access.
4089 ##      </summary>
4090 ## </param>
4091 #
4092 interface(`userdom_manage_all_users_keys',`
4093         gen_require(`
4094                 attribute userdomain;
4095         ')
4096
4097         allow $1 userdomain:key manage_key_perms;
4098 ')
4099
4100
4101 ########################################
4102 ## <summary>
4103 ##      Do not audit attempts to read and write
4104 ##      unserdomain stream.
4105 ## </summary>
4106 ## <param name="domain">
4107 ##      <summary>
4108 ##      Domain to not audit.
4109 ##      </summary>
4110 ## </param>
4111 #
4112 interface(`userdom_dontaudit_rw_stream',`
4113         gen_require(`
4114                 attribute userdomain;
4115         ')
4116
4117         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4118 ')
4119
4120 ########################################
4121 ## <summary>
4122 ##      Do not audit attempts to read and write
4123 ##      unserdomain datagram socket.
4124 ## </summary>
4125 ## <param name="domain">
4126 ##      <summary>
4127 ##      Domain to not audit.
4128 ##      </summary>
4129 ## </param>
4130 #
4131 interface(`userdom_dontaudit_rw_dgram_socket',`
4132         gen_require(`
4133                 attribute userdomain;
4134         ')
4135
4136         dontaudit $1 userdomain:unix_dgram_socket { read write };
4137 ')
4138
4139 ########################################
4140 ## <summary>
4141 ##      Append files
4142 ##      in a user home subdirectory.
4143 ## </summary>
4144 ## <param name="domain">
4145 ##      <summary>
4146 ##      Domain allowed access.
4147 ##      </summary>
4148 ## </param>
4149 #
4150 interface(`userdom_append_user_home_content_files',`
4151         gen_require(`
4152                 type user_home_dir_t, user_home_t;
4153         ')
4154
4155         append_files_pattern($1, user_home_t, user_home_t)
4156         allow $1 user_home_dir_t:dir search_dir_perms;
4157         files_search_home($1)
4158 ')
4159
4160 ########################################
4161 ## <summary>
4162 ##      Read files inherited
4163 ##      in a user home subdirectory.
4164 ## </summary>
4165 ## <param name="domain">
4166 ##      <summary>
4167 ##      Domain allowed access.
4168 ##      </summary>
4169 ## </param>
4170 #
4171 interface(`userdom_read_inherited_user_home_content_files',`
4172         gen_require(`
4173                 attribute user_home_type;
4174         ')
4175
4176         allow $1 user_home_type:file { getattr read };
4177 ')
4178
4179 ########################################
4180 ## <summary>
4181 ##      Append files inherited
4182 ##      in a user home subdirectory.
4183 ## </summary>
4184 ## <param name="domain">
4185 ##      <summary>
4186 ##      Domain allowed access.
4187 ##      </summary>
4188 ## </param>
4189 #
4190 interface(`userdom_inherit_append_user_home_content_files',`
4191         gen_require(`
4192                 type user_home_t;
4193         ')
4194
4195         allow $1 user_home_t:file { getattr append };
4196 ')
4197
4198 ########################################
4199 ## <summary>
4200 ##      Append files inherited
4201 ##      in a user tmp files.
4202 ## </summary>
4203 ## <param name="domain">
4204 ##      <summary>
4205 ##      Domain allowed access.
4206 ##      </summary>
4207 ## </param>
4208 #
4209 interface(`userdom_inherit_append_user_tmp_files',`
4210         gen_require(`
4211                 type user_tmp_t;
4212         ')
4213
4214         allow $1 user_tmp_t:file { getattr append };
4215 ')
4216
4217 ######################################
4218 ## <summary>
4219 ##      Read audio files in the users homedir.
4220 ## </summary>
4221 ## <param name="domain">
4222 ##      <summary>
4223 ##      Domain allowed access.
4224 ##      </summary>
4225 ## </param>
4226 ## <rolecap/>
4227 #
4228 interface(`userdom_read_home_audio_files',`
4229         gen_require(`
4230                 type audio_home_t;
4231         ')
4232
4233         userdom_search_user_home_dirs($1)
4234         allow $1 audio_home_t:dir list_dir_perms;
4235         read_files_pattern($1, audio_home_t, audio_home_t)
4236         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4237 ')
4238
4239 ########################################
4240 ## <summary>
4241 ##      Do not audit attempts to write all user home content files.
4242 ## </summary>
4243 ## <param name="domain">
4244 ##      <summary>
4245 ##      Domain to not audit.
4246 ##      </summary>
4247 ## </param>
4248 #
4249 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4250         gen_require(`
4251                 attribute user_home_type;
4252         ')
4253
4254         dontaudit $1 user_home_type:file write_file_perms;
4255 ')
4256
4257 ########################################
4258 ## <summary>
4259 ##      Do not audit attempts to write all user tmp content files.
4260 ## </summary>
4261 ## <param name="domain">
4262 ##      <summary>
4263 ##      Domain to not audit.
4264 ##      </summary>
4265 ## </param>
4266 #
4267 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4268         gen_require(`
4269                 attribute user_tmp_type;
4270         ')
4271
4272         dontaudit $1 user_tmp_type:file write_file_perms;
4273 ')
4274
4275 ########################################
4276 ## <summary>
4277 ##      Manage all user temporary content.
4278 ## </summary>
4279 ## <param name="domain">
4280 ##      <summary>
4281 ##      Domain allowed access.
4282 ##      </summary>
4283 ## </param>
4284 #
4285 interface(`userdom_manage_all_user_tmp_content',`
4286         gen_require(`
4287                 attribute user_tmp_type;
4288         ')
4289
4290         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4291         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4292         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4293         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4294         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4295         files_search_tmp($1)
4296 ')
4297
4298 ########################################
4299 ## <summary>
4300 ##      List all user temporary content.
4301 ## </summary>
4302 ## <param name="domain">
4303 ##      <summary>
4304 ##      Domain allowed access.
4305 ##      </summary>
4306 ## </param>
4307 #
4308 interface(`userdom_list_all_user_tmp_content',`
4309         gen_require(`
4310                 attribute user_tmp_type;
4311         ')
4312
4313         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4314         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4315         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4316         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4317         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4318         files_search_var($1)
4319         files_search_tmp($1)
4320 ')
4321
4322 ########################################
4323 ## <summary>
4324 ##      Manage all user tmpfs content.
4325 ## </summary>
4326 ## <param name="domain">
4327 ##      <summary>
4328 ##      Domain allowed access.
4329 ##      </summary>
4330 ## </param>
4331 #
4332 interface(`userdom_manage_all_user_tmpfs_content',`
4333         gen_require(`
4334                 attribute user_tmpfs_type;
4335         ')
4336
4337         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4338         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4339         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4340         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4341         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4342         fs_search_tmpfs($1)
4343 ')
4344
4345 ########################################
4346 ## <summary>
4347 ##      Delete all user temporary content.
4348 ## </summary>
4349 ## <param name="domain">
4350 ##      <summary>
4351 ##      Domain allowed access.
4352 ##      </summary>
4353 ## </param>
4354 #
4355 interface(`userdom_delete_all_user_tmp_content',`
4356         gen_require(`
4357                 attribute user_tmp_type;
4358         ')
4359
4360         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4361         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4362         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4363         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4364         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4365         # /var/tmp
4366         files_search_var($1)
4367         files_delete_tmp_dir_entry($1)
4368 ')
4369
4370 ########################################
4371 ## <summary>
4372 ##      Read system SSL certificates in the users homedir.
4373 ## </summary>
4374 ## <param name="domain">
4375 ##      <summary>
4376 ##      Domain allowed access.
4377 ##      </summary>
4378 ## </param>
4379 #
4380 interface(`userdom_read_home_certs',`
4381         gen_require(`
4382                 type home_cert_t;
4383         ')
4384
4385         userdom_search_user_home_content($1)
4386         allow $1 home_cert_t:dir list_dir_perms;
4387         read_files_pattern($1, home_cert_t, home_cert_t)
4388         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4389 ')
4390
4391 #######################################
4392 ## <summary>
4393 ##  Dontaudit Write system SSL certificates in the users homedir.
4394 ## </summary>
4395 ## <param name="domain">
4396 ##  <summary>
4397 ##      Domain to not audit.
4398 ##  </summary>
4399 ## </param>
4400 #
4401 interface(`userdom_dontaudit_write_home_certs',`
4402     gen_require(`
4403         type home_cert_t;
4404     ')
4405
4406     dontaudit $1 home_cert_t:file write;
4407 ')
4408
4409 ########################################
4410 ## <summary>
4411 ##      dontaudit Search getatrr /root files
4412 ## </summary>
4413 ## <param name="domain">
4414 ##      <summary>
4415 ##      Domain to not audit.
4416 ##      </summary>
4417 ## </param>
4418 #
4419 interface(`userdom_dontaudit_getattr_admin_home_files',`
4420         gen_require(`
4421                 type admin_home_t;
4422         ')
4423
4424         dontaudit $1 admin_home_t:file getattr;
4425 ')
4426
4427 ########################################
4428 ## <summary>
4429 ##      dontaudit read /root lnk files
4430 ## </summary>
4431 ## <param name="domain">
4432 ##      <summary>
4433 ##      Domain to not audit.
4434 ##      </summary>
4435 ## </param>
4436 #
4437 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4438         gen_require(`
4439                 type admin_home_t;
4440         ')
4441
4442         dontaudit $1 admin_home_t:lnk_file read;
4443 ')
4444
4445 ########################################
4446 ## <summary>
4447 ##      dontaudit read /root files
4448 ## </summary>
4449 ## <param name="domain">
4450 ##      <summary>
4451 ##      Domain to not audit.
4452 ##      </summary>
4453 ## </param>
4454 #
4455 interface(`userdom_dontaudit_read_admin_home_files',`
4456         gen_require(`
4457                 type admin_home_t;
4458         ')
4459
4460         dontaudit $1 admin_home_t:file read_file_perms;
4461 ')
4462
4463 ########################################
4464 ## <summary>
4465 ##      Create, read, write, and delete user
4466 ##      temporary chr files.
4467 ## </summary>
4468 ## <param name="domain">
4469 ##      <summary>
4470 ##      Domain allowed access.
4471 ##      </summary>
4472 ## </param>
4473 #
4474 interface(`userdom_manage_user_tmp_chr_files',`
4475         gen_require(`
4476                 type user_tmp_t;
4477         ')
4478
4479         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4480         files_search_tmp($1)
4481 ')
4482
4483 ########################################
4484 ## <summary>
4485 ##      Create, read, write, and delete user
4486 ##      temporary blk files.
4487 ## </summary>
4488 ## <param name="domain">
4489 ##      <summary>
4490 ##      Domain allowed access.
4491 ##      </summary>
4492 ## </param>
4493 #
4494 interface(`userdom_manage_user_tmp_blk_files',`
4495         gen_require(`
4496                 type user_tmp_t;
4497         ')
4498
4499         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4500         files_search_tmp($1)
4501 ')
4502
4503 ########################################
4504 ## <summary>
4505 ##      Dontaudit attempt to set attributes on  user temporary directories.
4506 ## </summary>
4507 ## <param name="domain">
4508 ##      <summary>
4509 ##      Domain to not audit.
4510 ##      </summary>
4511 ## </param>
4512 #
4513 interface(`userdom_dontaudit_setattr_user_tmp',`
4514         gen_require(`
4515                 type user_tmp_t;
4516         ')
4517
4518         dontaudit $1 user_tmp_t:dir setattr;
4519 ')
4520
4521 ########################################
4522 ## <summary>
4523 ##      Write all inherited users files in /tmp
4524 ## </summary>
4525 ## <param name="domain">
4526 ##      <summary>
4527 ##      Domain allowed access.
4528 ##      </summary>
4529 ## </param>
4530 #
4531 interface(`userdom_write_inherited_user_tmp_files',`
4532         gen_require(`
4533                 type user_tmp_t;
4534         ')
4535
4536         allow $1 user_tmp_t:file write;
4537 ')
4538
4539 ########################################
4540 ## <summary>
4541 ##      Delete all users files in /tmp
4542 ## </summary>
4543 ## <param name="domain">
4544 ##      <summary>
4545 ##      Domain allowed access.
4546 ##      </summary>
4547 ## </param>
4548 #
4549 interface(`userdom_delete_user_tmp_files',`
4550         gen_require(`
4551                 type user_tmp_t;
4552         ')
4553
4554         allow $1 user_tmp_t:file delete_file_perms;
4555 ')
4556
4557 ########################################
4558 ## <summary>
4559 ##      Delete user tmpfs files.
4560 ## </summary>
4561 ## <param name="domain">
4562 ##      <summary>
4563 ##      Domain allowed access.
4564 ##      </summary>
4565 ## </param>
4566 #
4567 interface(`userdom_delete_user_tmpfs_files',`
4568         gen_require(`
4569                 type user_tmpfs_t;
4570         ')
4571
4572         allow $1 user_tmpfs_t:file delete_file_perms;
4573 ')
4574
4575 ########################################
4576 ## <summary>
4577 ##      Read/Write unpriviledged user SysV shared
4578 ##      memory segments.
4579 ## </summary>
4580 ## <param name="domain">
4581 ##      <summary>
4582 ##      Domain allowed access.
4583 ##      </summary>
4584 ## </param>
4585 #
4586 interface(`userdom_rw_unpriv_user_shared_mem',`
4587         gen_require(`
4588                 attribute unpriv_userdomain;
4589         ')
4590
4591         allow $1 unpriv_userdomain:shm rw_shm_perms;
4592 ')
4593
4594 ########################################
4595 ## <summary>
4596 ##      Do not audit attempts to search user
4597 ##      temporary directories.
4598 ## </summary>
4599 ## <param name="domain">
4600 ##      <summary>
4601 ##      Domain to not audit.
4602 ##      </summary>
4603 ## </param>
4604 #
4605 interface(`userdom_dontaudit_search_user_tmp',`
4606         gen_require(`
4607                 type user_tmp_t;
4608         ')
4609
4610         dontaudit $1 user_tmp_t:dir search_dir_perms;
4611 ')
4612
4613 ########################################
4614 ## <summary>
4615 ##      Execute a file in a user home directory
4616 ##      in the specified domain.
4617 ## </summary>
4618 ## <desc>
4619 ##      <p>
4620 ##      Execute a file in a user home directory
4621 ##      in the specified domain.
4622 ##      </p>
4623 ##      <p>
4624 ##      No interprocess communication (signals, pipes,
4625 ##      etc.) is provided by this interface since
4626 ##      the domains are not owned by this module.
4627 ##      </p>
4628 ## </desc>
4629 ## <param name="domain">
4630 ##      <summary>
4631 ##      Domain allowed access.
4632 ##      </summary>
4633 ## </param>
4634 ## <param name="target_domain">
4635 ##      <summary>
4636 ##      The type of the new process.
4637 ##      </summary>
4638 ## </param>
4639 #
4640 interface(`userdom_domtrans_user_home',`
4641         gen_require(`
4642                 type user_home_t;
4643         ')
4644
4645         read_lnk_files_pattern($1, user_home_t, user_home_t)
4646         domain_transition_pattern($1, user_home_t, $2)
4647         type_transition $1 user_home_t:process $2;
4648 ')
4649
4650 ########################################
4651 ## <summary>
4652 ##      Execute a file in a user tmp directory
4653 ##      in the specified domain.
4654 ## </summary>
4655 ## <desc>
4656 ##      <p>
4657 ##      Execute a file in a user tmp directory
4658 ##      in the specified domain.
4659 ##      </p>
4660 ##      <p>
4661 ##      No interprocess communication (signals, pipes,
4662 ##      etc.) is provided by this interface since
4663 ##      the domains are not owned by this module.
4664 ##      </p>
4665 ## </desc>
4666 ## <param name="domain">
4667 ##      <summary>
4668 ##      Domain allowed access.
4669 ##      </summary>
4670 ## </param>
4671 ## <param name="target_domain">
4672 ##      <summary>
4673 ##      The type of the new process.
4674 ##      </summary>
4675 ## </param>
4676 #
4677 interface(`userdom_domtrans_user_tmp',`
4678         gen_require(`
4679                 type user_tmp_t;
4680         ')
4681
4682         files_search_tmp($1)
4683         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4684         domain_transition_pattern($1, user_tmp_t, $2)
4685         type_transition $1 user_tmp_t:process $2;
4686 ')
4687
4688 ########################################
4689 ## <summary>
4690 ##      Do not audit attempts to read all user home content files.
4691 ## </summary>
4692 ## <param name="domain">
4693 ##      <summary>
4694 ##      Domain to not audit.
4695 ##      </summary>
4696 ## </param>
4697 #
4698 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4699         gen_require(`
4700                 attribute user_home_type;
4701         ')
4702
4703         dontaudit $1 user_home_type:file read_file_perms;
4704 ')
4705
4706 ########################################
4707 ## <summary>
4708 ##      Do not audit attempts to read all user tmp content files.
4709 ## </summary>
4710 ## <param name="domain">
4711 ##      <summary>
4712 ##      Domain to not audit.
4713 ##      </summary>
4714 ## </param>
4715 #
4716 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4717         gen_require(`
4718                 attribute user_tmp_type;
4719         ')
4720
4721         dontaudit $1 user_tmp_type:file read_file_perms;
4722 ')
4723