policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 fs_list_cgroup_dirs($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 ssh_rw_stream_sockets($1_usertype)
 161                 ssh_delete_tmp($1_t)
 162                 ssh_signal($1_t)
 163         ')
 164 ')
 165
 166 #######################################
 167 ## <summary>
 168 ##      Allow a home directory for which the
 169 ##      role has read-only access.
 170 ## </summary>
 171 ## <desc>
 172 ##      <p>
 173 ##      Allow a home directory for which the
 174 ##      role has read-only access.
 175 ##      </p>
 176 ##      <p>
 177 ##      This does not allow execute access.
 178 ##      </p>
 179 ## </desc>
 180 ## <param name="role">
 181 ##      <summary>
 182 ##      The user role
 183 ##      </summary>
 184 ## </param>
 185 ## <param name="userdomain">
 186 ##      <summary>
 187 ##      The user domain
 188 ##      </summary>
 189 ## </param>
 190 ## <rolebase/>
 191 #
 192 interface(`userdom_ro_home_role',`
 193         gen_require(`
 194                 type user_home_t, user_home_dir_t;
 195         ')
 196
 197         role $1 types { user_home_t user_home_dir_t };
 198
 199         ##############################
 200         #
 201         # Domain access to home dir
 202         #
 203
 204         type_member $2 user_home_dir_t:dir user_home_dir_t;
 205
 206         # read-only home directory
 207         allow $2 user_home_dir_t:dir list_dir_perms;
 208         allow $2 user_home_t:dir list_dir_perms;
 209         allow $2 user_home_t:file entrypoint;
 210         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 214         files_list_home($2)
 215
 216 ')
 217
 218 #######################################
 219 ## <summary>
 220 ##      Allow a home directory for which the
 221 ##      role has full access.
 222 ## </summary>
 223 ## <desc>
 224 ##      <p>
 225 ##      Allow a home directory for which the
 226 ##      role has full access.
 227 ##      </p>
 228 ##      <p>
 229 ##      This does not allow execute access.
 230 ##      </p>
 231 ## </desc>
 232 ## <param name="role">
 233 ##      <summary>
 234 ##      The user role
 235 ##      </summary>
 236 ## </param>
 237 ## <param name="userdomain">
 238 ##      <summary>
 239 ##      The user domain
 240 ##      </summary>
 241 ## </param>
 242 ## <rolebase/>
 243 #
 244 interface(`userdom_manage_home_role',`
 245         gen_require(`
 246                 type user_home_t, user_home_dir_t;
 247                 attribute user_home_type;
 248         ')
 249
 250         role $1 types { user_home_type user_home_dir_t };
 251
 252         ##############################
 253         #
 254         # Domain access to home dir
 255         #
 256
 257         type_member $2 user_home_dir_t:dir user_home_dir_t;
 258
 259         # full control of the home directory
 260         allow $2 user_home_t:dir mounton;
 261         allow $2 user_home_t:file entrypoint;
 262
 263         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 264         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 265         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 276         files_list_home($2)
 277
 278         # cjp: this should probably be removed:
 279         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 280
 281         tunable_policy(`use_nfs_home_dirs',`
 282                 fs_mount_nfs($2)
 283                 fs_mounton_nfs($2)
 284                 fs_manage_nfs_dirs($2)
 285                 fs_manage_nfs_files($2)
 286                 fs_manage_nfs_symlinks($2)
 287                 fs_manage_nfs_named_sockets($2)
 288                 fs_manage_nfs_named_pipes($2)
 289         ')
 290
 291         tunable_policy(`use_samba_home_dirs',`
 292                 fs_mount_cifs($2)
 293                 fs_mounton_cifs($2)
 294                 fs_manage_cifs_dirs($2)
 295                 fs_manage_cifs_files($2)
 296                 fs_manage_cifs_symlinks($2)
 297                 fs_manage_cifs_named_sockets($2)
 298                 fs_manage_cifs_named_pipes($2)
 299         ')
 300 ')
 301
 302 #######################################
 303 ## <summary>
 304 ##      Manage user temporary files
 305 ## </summary>
 306 ## <param name="role">
 307 ##      <summary>
 308 ##      Role allowed access.
 309 ##      </summary>
 310 ## </param>
 311 ## <param name="domain">
 312 ##      <summary>
 313 ##      Domain allowed access.
 314 ##      </summary>
 315 ## </param>
 316 ## <rolebase/>
 317 #
 318 interface(`userdom_manage_tmp_role',`
 319         gen_require(`
 320                 type user_tmp_t;
 321         ')
 322
 323         role $1 types user_tmp_t;
 324
 325         files_poly_member_tmp($2, user_tmp_t)
 326
 327         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 330         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 331         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 332         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 333         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 334 ')
 335
 336 #######################################
 337 ## <summary>
 338 ##      Dontaudit search of user bin dirs.
 339 ## </summary>
 340 ## <param name="domain">
 341 ##      <summary>
 342 ##      Domain to not audit.
 343 ##      </summary>
 344 ## </param>
 345 #
 346 interface(`userdom_dontaudit_search_user_bin_dirs',`
 347         gen_require(`
 348                 type home_bin_t;
 349         ')
 350
 351         dontaudit $1 home_bin_t:dir search_dir_perms;
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Execute user bin files.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain allowed access.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_exec_user_bin_files',`
 365         gen_require(`
 366                 attribute user_home_type;
 367                 type home_bin_t, user_home_dir_t;
 368         ')
 369
 370         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 371         files_search_home($1)
 372 ')
 373
 374 #######################################
 375 ## <summary>
 376 ##      The execute access user temporary files.
 377 ## </summary>
 378 ## <param name="domain">
 379 ##      <summary>
 380 ##      Domain allowed access.
 381 ##      </summary>
 382 ## </param>
 383 ## <rolebase/>
 384 #
 385 interface(`userdom_exec_user_tmp_files',`
 386         gen_require(`
 387                 type user_tmp_t;
 388         ')
 389
 390         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 391         dontaudit $1 user_tmp_t:sock_file execute;
 392         files_search_tmp($1)
 393 ')
 394
 395 #######################################
 396 ## <summary>
 397 ##      Role access for the user tmpfs type
 398 ##      that the user has full access.
 399 ## </summary>
 400 ## <desc>
 401 ##      <p>
 402 ##      Role access for the user tmpfs type
 403 ##      that the user has full access.
 404 ##      </p>
 405 ##      <p>
 406 ##      This does not allow execute access.
 407 ##      </p>
 408 ## </desc>
 409 ## <param name="role">
 410 ##      <summary>
 411 ##      Role allowed access.
 412 ##      </summary>
 413 ## </param>
 414 ## <param name="domain">
 415 ##      <summary>
 416 ##      Domain allowed access.
 417 ##      </summary>
 418 ## </param>
 419 ## <rolecap/>
 420 #
 421 interface(`userdom_manage_tmpfs_role',`
 422         gen_require(`
 423                 type user_tmpfs_t;
 424         ')
 425
 426         role $1 types user_tmpfs_t;
 427
 428         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 432         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 433         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 434 ')
 435
 436 #######################################
 437 ## <summary>
 438 ##      The interface allowing the user basic
 439 ##      network permissions
 440 ## </summary>
 441 ## <param name="userdomain">
 442 ##      <summary>
 443 ##      The user domain
 444 ##      </summary>
 445 ## </param>
 446 ## <rolebase/>
 447 #
 448 interface(`userdom_basic_networking',`
 449
 450         allow $1 self:tcp_socket create_stream_socket_perms;
 451         allow $1 self:udp_socket create_socket_perms;
 452
 453         corenet_all_recvfrom_unlabeled($1)
 454         corenet_all_recvfrom_netlabel($1)
 455         corenet_tcp_sendrecv_generic_if($1)
 456         corenet_udp_sendrecv_generic_if($1)
 457         corenet_tcp_sendrecv_generic_node($1)
 458         corenet_udp_sendrecv_generic_node($1)
 459         corenet_tcp_sendrecv_all_ports($1)
 460         corenet_udp_sendrecv_all_ports($1)
 461         corenet_tcp_connect_all_ports($1)
 462         corenet_sendrecv_all_client_packets($1)
 463
 464         optional_policy(`
 465                 init_tcp_recvfrom_all_daemons($1)
 466                 init_udp_recvfrom_all_daemons($1)
 467         ')
 468
 469         optional_policy(`
 470                 ipsec_match_default_spd($1)
 471         ')
 472
 473 ')
 474
 475 #######################################
 476 ## <summary>
 477 ##      The template for creating a user xwindows client.  (Deprecated)
 478 ## </summary>
 479 ## <param name="userdomain_prefix">
 480 ##      <summary>
 481 ##      The prefix of the user domain (e.g., user
 482 ##      is the prefix for user_t).
 483 ##      </summary>
 484 ## </param>
 485 ## <rolebase/>
 486 #
 487 template(`userdom_xwindows_client_template',`
 488         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 489         gen_require(`
 490                 type $1_t, user_tmpfs_t;
 491         ')
 492
 493         dev_rw_xserver_misc($1_t)
 494         dev_rw_power_management($1_t)
 495         dev_read_input($1_t)
 496         dev_read_misc($1_t)
 497         dev_write_misc($1_t)
 498         # open office is looking for the following
 499         dev_getattr_agp_dev($1_t)
 500         dev_dontaudit_rw_dri($1_t)
 501         # GNOME checks for usb and other devices:
 502         dev_rw_usbfs($1_t)
 503         dev_rw_generic_usb_dev($1_t)
 504
 505         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 506         xserver_xsession_entry_type($1_t)
 507         xserver_dontaudit_write_log($1_t)
 508         xserver_stream_connect_xdm($1_t)
 509         # certain apps want to read xdm.pid file
 510         xserver_read_xdm_pid($1_t)
 511         # gnome-session creates socket under /tmp/.ICE-unix/
 512         xserver_create_xdm_tmp_sockets($1_t)
 513         # Needed for escd, remove if we get escd policy
 514         xserver_manage_xdm_tmp_files($1_t)
 515 ')
 516
 517 #######################################
 518 ## <summary>
 519 ##      The template for allowing the user to change passwords.
 520 ## </summary>
 521 ## <param name="userdomain_prefix">
 522 ##      <summary>
 523 ##      The prefix of the user domain (e.g., user
 524 ##      is the prefix for user_t).
 525 ##      </summary>
 526 ## </param>
 527 ## <rolebase/>
 528 #
 529 template(`userdom_change_password_template',`
 530         gen_require(`
 531                 type $1_t;
 532                 role $1_r;
 533         ')
 534
 535         optional_policy(`
 536                 usermanage_run_chfn($1_t,$1_r)
 537                 usermanage_run_passwd($1_t,$1_r)
 538         ')
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template containing rules common to unprivileged
 544 ##      users and administrative users.
 545 ## </summary>
 546 ## <desc>
 547 ##      <p>
 548 ##      This template creates a user domain, types, and
 549 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 550 ##      </p>
 551 ## </desc>
 552 ## <param name="userdomain_prefix">
 553 ##      <summary>
 554 ##      The prefix of the user domain (e.g., user
 555 ##      is the prefix for user_t).
 556 ##      </summary>
 557 ## </param>
 558 #
 559 template(`userdom_common_user_template',`
 560         gen_require(`
 561                 attribute unpriv_userdomain;
 562         ')
 563
 564         userdom_basic_networking($1_usertype)
 565
 566         ##############################
 567         #
 568         # User domain Local policy
 569         #
 570
 571         # evolution and gnome-session try to create a netlink socket
 572         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 573         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 574         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 575         allow $1_t self:socket create_socket_perms;
 576
 577         allow $1_usertype unpriv_userdomain:fd use;
 578
 579         kernel_read_system_state($1_usertype)
 580         kernel_read_network_state($1_usertype)
 581         kernel_read_software_raid_state($1_usertype)
 582         kernel_read_net_sysctls($1_usertype)
 583         # Very permissive allowing every domain to see every type:
 584         kernel_get_sysvipc_info($1_usertype)
 585         # Find CDROM devices:
 586         kernel_read_device_sysctls($1_usertype)
 587         kernel_request_load_module($1_usertype)
 588
 589         corenet_udp_bind_generic_node($1_usertype)
 590         corenet_udp_bind_generic_port($1_usertype)
 591
 592         dev_read_rand($1_usertype)
 593         dev_write_sound($1_usertype)
 594         dev_read_sound($1_usertype)
 595         dev_read_sound_mixer($1_usertype)
 596         dev_write_sound_mixer($1_usertype)
 597
 598         files_exec_etc_files($1_usertype)
 599         files_search_locks($1_usertype)
 600         # Check to see if cdrom is mounted
 601         files_search_mnt($1_usertype)
 602         # cjp: perhaps should cut back on file reads:
 603         files_read_var_files($1_usertype)
 604         files_read_var_symlinks($1_usertype)
 605         files_read_generic_spool($1_usertype)
 606         files_read_var_lib_files($1_usertype)
 607         # Stat lost+found.
 608         files_getattr_lost_found_dirs($1_usertype)
 609         files_read_config_files($1_usertype)
 610         fs_read_noxattr_fs_files($1_usertype)
 611         fs_read_noxattr_fs_symlinks($1_usertype)
 612         fs_rw_cgroup_files($1_usertype)
 613
 614         application_getattr_socket($1_usertype)
 615
 616         logging_send_syslog_msg($1_usertype)
 617         logging_send_audit_msgs($1_usertype)
 618         selinux_get_enforce_mode($1_usertype)
 619
 620         # cjp: some of this probably can be removed
 621         selinux_get_fs_mount($1_usertype)
 622         selinux_validate_context($1_usertype)
 623         selinux_compute_access_vector($1_usertype)
 624         selinux_compute_create_context($1_usertype)
 625         selinux_compute_relabel_context($1_usertype)
 626         selinux_compute_user_contexts($1_usertype)
 627
 628         # for eject
 629         storage_getattr_fixed_disk_dev($1_usertype)
 630
 631         auth_read_login_records($1_usertype)
 632         auth_run_pam($1_t,$1_r)
 633         auth_run_utempter($1_t,$1_r)
 634
 635         init_read_utmp($1_usertype)
 636
 637         seutil_read_file_contexts($1_usertype)
 638         seutil_read_default_contexts($1_usertype)
 639         seutil_run_newrole($1_t,$1_r)
 640         seutil_exec_checkpolicy($1_t)
 641         seutil_exec_setfiles($1_usertype)
 642         # for when the network connection is killed
 643         # this is needed when a login role can change
 644         # to this one.
 645         seutil_dontaudit_signal_newrole($1_t)
 646
 647         tunable_policy(`user_direct_mouse',`
 648                 dev_read_mouse($1_usertype)
 649         ')
 650
 651         tunable_policy(`user_ttyfile_stat',`
 652                 term_getattr_all_ttys($1_t)
 653         ')
 654
 655         optional_policy(`
 656                 alsa_read_rw_config($1_usertype)
 657                 alsa_manage_home_files($1_t)
 658                 alsa_relabel_home_files($1_t)
 659         ')
 660
 661         optional_policy(`
 662                 # Allow graphical boot to check battery lifespan
 663                 apm_stream_connect($1_usertype)
 664         ')
 665
 666         optional_policy(`
 667                 canna_stream_connect($1_usertype)
 668         ')
 669
 670         optional_policy(`
 671                 chrome_role($1_r, $1_usertype)
 672         ')
 673
 674         optional_policy(`
 675                 colord_read_lib_files($1_usertype)
 676         ')
 677
 678         optional_policy(`
 679                 dbus_system_bus_client($1_usertype)
 680
 681                 allow $1_usertype $1_usertype:dbus  send_msg;
 682
 683                 optional_policy(`
 684                         avahi_dbus_chat($1_usertype)
 685                 ')
 686
 687                 optional_policy(`
 688                         policykit_dbus_chat($1_usertype)
 689                 ')
 690
 691                 optional_policy(`
 692                         bluetooth_dbus_chat($1_usertype)
 693                 ')
 694
 695                 optional_policy(`
 696                         consolekit_dbus_chat($1_usertype)
 697                         consolekit_read_log($1_usertype)
 698                 ')
 699
 700                 optional_policy(`
 701                         devicekit_dbus_chat($1_usertype)
 702                         devicekit_dbus_chat_power($1_usertype)
 703                         devicekit_dbus_chat_disk($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         evolution_dbus_chat($1_usertype)
 708                         evolution_alarm_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         gnome_dbus_chat_gconfdefault($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         hal_dbus_chat($1_usertype)
 717                 ')
 718
 719                 optional_policy(`
 720                         kde_dbus_chat_backlighthelper($1_usertype)
 721                 ')
 722
 723                 optional_policy(`
 724                         modemmanager_dbus_chat($1_usertype)
 725                 ')
 726
 727                 optional_policy(`
 728                         networkmanager_dbus_chat($1_usertype)
 729                         networkmanager_read_lib_files($1_usertype)
 730                 ')
 731
 732                 optional_policy(`
 733                         vpn_dbus_chat($1_usertype)
 734                 ')
 735         ')
 736
 737         optional_policy(`
 738                 git_session_role($1_r, $1_usertype)
 739         ')
 740
 741         optional_policy(`
 742                 inetd_use_fds($1_usertype)
 743                 inetd_rw_tcp_sockets($1_usertype)
 744         ')
 745
 746         optional_policy(`
 747                 inn_read_config($1_usertype)
 748                 inn_read_news_lib($1_usertype)
 749                 inn_read_news_spool($1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 lircd_stream_connect($1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 locate_read_lib_files($1_usertype)
 758         ')
 759
 760         # for running depmod as part of the kernel packaging process
 761         optional_policy(`
 762                 modutils_read_module_config($1_usertype)
 763         ')
 764
 765         optional_policy(`
 766                 mta_rw_spool($1_usertype)
 767                 mta_manage_queue($1_usertype)
 768                 mta_filetrans_home_content($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 nsplugin_role($1_r, $1_usertype)
 773         ')
 774
 775         optional_policy(`
 776                 tunable_policy(`allow_user_mysql_connect',`
 777                         mysql_stream_connect($1_t)
 778                 ')
 779         ')
 780
 781         optional_policy(`
 782                 oident_manage_user_content($1_t)
 783                 oident_relabel_user_content($1_t)
 784         ')
 785
 786         optional_policy(`
 787                 # to allow monitoring of pcmcia status
 788                 pcmcia_read_pid($1_usertype)
 789         ')
 790
 791         optional_policy(`
 792                 pcscd_read_pub_files($1_usertype)
 793                 pcscd_stream_connect($1_usertype)
 794         ')
 795
 796         optional_policy(`
 797                 tunable_policy(`allow_user_postgresql_connect',`
 798                         postgresql_stream_connect($1_usertype)
 799                         postgresql_tcp_connect($1_usertype)
 800                 ')
 801         ')
 802
 803         optional_policy(`
 804                 resmgr_stream_connect($1_usertype)
 805         ')
 806
 807         optional_policy(`
 808                 rpc_dontaudit_getattr_exports($1_usertype)
 809                 rpc_manage_nfs_rw_content($1_usertype)
 810         ')
 811
 812         optional_policy(`
 813                 rpcbind_stream_connect($1_usertype)
 814         ')
 815
 816         optional_policy(`
 817                 samba_stream_connect_winbind($1_usertype)
 818         ')
 819
 820         optional_policy(`
 821                 sandbox_transition($1_usertype, $1_r)
 822         ')
 823
 824         optional_policy(`
 825                 seunshare_role_template($1, $1_r, $1_t)
 826         ')
 827
 828         optional_policy(`
 829                 slrnpull_search_spool($1_usertype)
 830         ')
 831
 832 ')
 833
 834 #######################################
 835 ## <summary>
 836 ##      The template for creating a login user.
 837 ## </summary>
 838 ## <desc>
 839 ##      <p>
 840 ##      This template creates a user domain, types, and
 841 ##      rules for the user's tty, pty, home directories,
 842 ##      tmp, and tmpfs files.
 843 ##      </p>
 844 ## </desc>
 845 ## <param name="userdomain_prefix">
 846 ##      <summary>
 847 ##      The prefix of the user domain (e.g., user
 848 ##      is the prefix for user_t).
 849 ##      </summary>
 850 ## </param>
 851 #
 852 template(`userdom_login_user_template', `
 853         gen_require(`
 854                 class context contains;
 855         ')
 856
 857         userdom_base_user_template($1)
 858
 859         userdom_manage_home_role($1_r, $1_usertype)
 860
 861         userdom_manage_tmp_role($1_r, $1_usertype)
 862         userdom_manage_tmpfs_role($1_r, $1_usertype)
 863
 864         ifelse(`$1',`unconfined',`',`
 865                 gen_tunable(allow_$1_exec_content, true)
 866
 867                 tunable_policy(`allow_$1_exec_content',`
 868                         userdom_exec_user_tmp_files($1_usertype)
 869                         userdom_exec_user_home_content_files($1_usertype)
 870                 ')
 871                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 872                         fs_exec_nfs_files($1_usertype)
 873                 ')
 874
 875                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 876                         fs_exec_cifs_files($1_usertype)
 877                 ')
 878         ')
 879
 880         userdom_change_password_template($1)
 881
 882         ##############################
 883         #
 884         # User domain Local policy
 885         #
 886
 887         allow $1_t self:capability { setgid chown fowner };
 888         dontaudit $1_t self:capability { sys_nice fsetid };
 889
 890         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 891         dontaudit $1_t self:process setrlimit;
 892         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 893
 894         allow $1_t self:context contains;
 895
 896         kernel_dontaudit_read_system_state($1_usertype)
 897         kernel_dontaudit_list_all_proc($1_usertype)
 898
 899         dev_read_sysfs($1_usertype)
 900         dev_read_urand($1_usertype)
 901
 902         domain_use_interactive_fds($1_usertype)
 903         # Command completion can fire hundreds of denials
 904         domain_dontaudit_exec_all_entry_files($1_usertype)
 905
 906         files_dontaudit_list_default($1_usertype)
 907         files_dontaudit_read_default_files($1_usertype)
 908         # Stat lost+found.
 909         files_getattr_lost_found_dirs($1_usertype)
 910
 911         fs_get_all_fs_quotas($1_usertype)
 912         fs_getattr_all_fs($1_usertype)
 913         fs_search_all($1_usertype)
 914         fs_list_inotifyfs($1_usertype)
 915         fs_rw_anon_inodefs_files($1_usertype)
 916
 917         auth_dontaudit_write_login_records($1_t)
 918         auth_rw_cache($1_t)
 919
 920         # Stop warnings about access to /dev/console
 921         init_dontaudit_use_fds($1_usertype)
 922         init_dontaudit_use_script_fds($1_usertype)
 923
 924         libs_exec_lib_files($1_usertype)
 925
 926         logging_dontaudit_getattr_all_logs($1_usertype)
 927
 928         # for running TeX programs
 929         miscfiles_read_tetex_data($1_usertype)
 930         miscfiles_exec_tetex_data($1_usertype)
 931
 932         seutil_read_config($1_usertype)
 933
 934         optional_policy(`
 935                 cups_read_config($1_usertype)
 936                 cups_stream_connect($1_usertype)
 937                 cups_stream_connect_ptal($1_usertype)
 938         ')
 939
 940         optional_policy(`
 941                 kerberos_use($1_usertype)
 942                 kerberos_filetrans_home_content($1_usertype)
 943         ')
 944
 945         optional_policy(`
 946                 mta_dontaudit_read_spool_symlinks($1_usertype)
 947         ')
 948
 949         optional_policy(`
 950                 quota_dontaudit_getattr_db($1_usertype)
 951         ')
 952
 953         optional_policy(`
 954                 rpm_read_db($1_usertype)
 955                 rpm_dontaudit_manage_db($1_usertype)
 956                 rpm_read_cache($1_usertype)
 957         ')
 958
 959         optional_policy(`
 960                 oddjob_run_mkhomedir($1_t, $1_r)
 961         ')
 962 ')
 963
 964 #######################################
 965 ## <summary>
 966 ##      The template for creating a unprivileged login user.
 967 ## </summary>
 968 ## <desc>
 969 ##      <p>
 970 ##      This template creates a user domain, types, and
 971 ##      rules for the user's tty, pty, home directories,
 972 ##      tmp, and tmpfs files.
 973 ##      </p>
 974 ## </desc>
 975 ## <param name="userdomain_prefix">
 976 ##      <summary>
 977 ##      The prefix of the user domain (e.g., user
 978 ##      is the prefix for user_t).
 979 ##      </summary>
 980 ## </param>
 981 #
 982 template(`userdom_restricted_user_template',`
 983         gen_require(`
 984                 attribute unpriv_userdomain;
 985         ')
 986
 987         userdom_login_user_template($1)
 988
 989         typeattribute $1_t unpriv_userdomain;
 990         domain_interactive_fd($1_t)
 991
 992         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 993         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 994
 995         ##############################
 996         #
 997         # Local policy
 998         #
 999
1000         optional_policy(`
1001                 loadkeys_run($1_t,$1_r)
1002         ')
1003 ')
1004
1005 #######################################
1006 ## <summary>
1007 ##      The template for creating a unprivileged xwindows login user.
1008 ## </summary>
1009 ## <desc>
1010 ##      <p>
1011 ##      The template for creating a unprivileged xwindows login user.
1012 ##      </p>
1013 ##      <p>
1014 ##      This template creates a user domain, types, and
1015 ##      rules for the user's tty, pty, home directories,
1016 ##      tmp, and tmpfs files.
1017 ##      </p>
1018 ## </desc>
1019 ## <param name="userdomain_prefix">
1020 ##      <summary>
1021 ##      The prefix of the user domain (e.g., user
1022 ##      is the prefix for user_t).
1023 ##      </summary>
1024 ## </param>
1025 #
1026 template(`userdom_restricted_xwindows_user_template',`
1027
1028         userdom_restricted_user_template($1)
1029
1030         ##############################
1031         #
1032         # Local policy
1033         #
1034
1035         auth_role($1_r, $1_t)
1036         auth_search_pam_console_data($1_usertype)
1037         auth_dontaudit_read_login_records($1_usertype)
1038
1039         dev_read_sound($1_usertype)
1040         dev_write_sound($1_usertype)
1041         # gnome keyring wants to read this.
1042         dev_dontaudit_read_rand($1_usertype)
1043         # temporarily allow since openoffice requires this
1044         dev_read_rand($1_usertype)
1045
1046         dev_read_video_dev($1_usertype)
1047         dev_write_video_dev($1_usertype)
1048         dev_rw_wireless($1_usertype)
1049
1050         libs_dontaudit_setattr_lib_files($1_usertype)
1051
1052         tunable_policy(`user_rw_noexattrfile',`
1053                 dev_rw_usbfs($1_t)
1054                 dev_rw_generic_usb_dev($1_usertype)
1055
1056                 fs_manage_noxattr_fs_files($1_usertype)
1057                 fs_manage_noxattr_fs_dirs($1_usertype)
1058                 fs_manage_dos_dirs($1_usertype)
1059                 fs_manage_dos_files($1_usertype)
1060                 storage_raw_read_removable_device($1_usertype)
1061                 storage_raw_write_removable_device($1_usertype)
1062         ')
1063
1064         logging_send_syslog_msg($1_usertype)
1065         logging_dontaudit_send_audit_msgs($1_t)
1066
1067         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1068         logging_send_audit_msgs($1_t)
1069         selinux_get_enforce_mode($1_t)
1070         seutil_exec_restorecond($1_t)
1071         seutil_read_file_contexts($1_t)
1072         seutil_read_default_contexts($1_t)
1073
1074         xserver_restricted_role($1_r, $1_t)
1075
1076         optional_policy(`
1077                 alsa_read_rw_config($1_usertype)
1078         ')
1079
1080          # cjp: needed by KDE apps
1081          # bug: #682499
1082          optional_policy(`
1083                 gnome_read_usr_config($1_usertype)
1084                 gnome_role_gkeyringd($1, $1_r, $1_t)
1085                 # cjp: telepathy F15 bugs
1086                 telepathy_dbus_session_role($1_r, $1_t, $1)
1087         ')
1088
1089         optional_policy(`
1090                 dbus_role_template($1, $1_r, $1_usertype)
1091                 dbus_system_bus_client($1_usertype)
1092                 allow $1_usertype $1_usertype:dbus send_msg;
1093
1094                 optional_policy(`
1095                         abrt_dbus_chat($1_usertype)
1096                         abrt_run_helper($1_usertype, $1_r)
1097                 ')
1098
1099                 optional_policy(`
1100                         consolekit_dontaudit_read_log($1_usertype)
1101                         consolekit_dbus_chat($1_usertype)
1102                 ')
1103
1104                 optional_policy(`
1105                         cups_dbus_chat($1_usertype)
1106                         cups_dbus_chat_config($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         devicekit_dbus_chat($1_usertype)
1111                         devicekit_dbus_chat_disk($1_usertype)
1112                         devicekit_dbus_chat_power($1_usertype)
1113                 ')
1114
1115                 optional_policy(`
1116                         fprintd_dbus_chat($1_t)
1117                 ')
1118         ')
1119
1120         optional_policy(`
1121                 openoffice_role_template($1, $1_r, $1_usertype)
1122         ')
1123
1124         optional_policy(`
1125                 policykit_role($1_r, $1_usertype)
1126         ')
1127
1128         optional_policy(`
1129                 pulseaudio_role($1_r, $1_usertype)
1130         ')
1131
1132         optional_policy(`
1133                 rtkit_scheduled($1_usertype)
1134         ')
1135
1136         optional_policy(`
1137                 setroubleshoot_dontaudit_stream_connect($1_t)
1138         ')
1139
1140         optional_policy(`
1141                 udev_read_db($1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 wm_role_template($1, $1_r, $1_t)
1146         ')
1147 ')
1148
1149 #######################################
1150 ## <summary>
1151 ##      The template for creating a unprivileged user roughly
1152 ##      equivalent to a regular linux user.
1153 ## </summary>
1154 ## <desc>
1155 ##      <p>
1156 ##      The template for creating a unprivileged user roughly
1157 ##      equivalent to a regular linux user.
1158 ##      </p>
1159 ##      <p>
1160 ##      This template creates a user domain, types, and
1161 ##      rules for the user's tty, pty, home directories,
1162 ##      tmp, and tmpfs files.
1163 ##      </p>
1164 ## </desc>
1165 ## <param name="userdomain_prefix">
1166 ##      <summary>
1167 ##      The prefix of the user domain (e.g., user
1168 ##      is the prefix for user_t).
1169 ##      </summary>
1170 ## </param>
1171 #
1172 template(`userdom_unpriv_user_template', `
1173
1174         ##############################
1175         #
1176         # Declarations
1177         #
1178
1179         # Inherit rules for ordinary users.
1180         userdom_restricted_xwindows_user_template($1)
1181         userdom_common_user_template($1)
1182
1183         ##############################
1184         #
1185         # Local policy
1186         #
1187
1188         # port access is audited even if dac would not have allowed it, so dontaudit it here
1189 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1190         # Need the following rule to allow users to run vpnc
1191         corenet_tcp_bind_xserver_port($1_t)
1192         corenet_tcp_bind_generic_node($1_usertype)
1193
1194         storage_rw_fuse($1_t)
1195
1196         miscfiles_read_hwdata($1_usertype)
1197
1198         # Allow users to run TCP servers (bind to ports and accept connection from
1199         # the same domain and outside users) disabling this forces FTP passive mode
1200         # and may change other protocols
1201
1202         tunable_policy(`user_share_music',`
1203                 corenet_tcp_bind_daap_port($1_usertype)
1204         ')
1205
1206         tunable_policy(`user_tcp_server',`
1207                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1208         ')
1209
1210         tunable_policy(`user_setrlimit',`
1211                 allow $1_usertype self:process setrlimit;
1212         ')
1213
1214         optional_policy(`
1215                 cdrecord_role($1_r, $1_t)
1216         ')
1217
1218         optional_policy(`
1219                 cron_role($1_r, $1_t)
1220         ')
1221
1222         optional_policy(`
1223                 games_rw_data($1_usertype)
1224         ')
1225
1226         optional_policy(`
1227                 gpg_role($1_r, $1_usertype)
1228         ')
1229
1230         optional_policy(`
1231                 gnomeclock_dbus_chat($1_t)
1232         ')
1233
1234         optional_policy(`
1235                 gpm_stream_connect($1_usertype)
1236         ')
1237
1238         optional_policy(`
1239                 execmem_role_template($1, $1_r, $1_t)
1240         ')
1241
1242         optional_policy(`
1243                 java_role_template($1, $1_r, $1_t)
1244         ')
1245
1246         optional_policy(`
1247                 mono_role_template($1, $1_r, $1_t)
1248         ')
1249
1250         optional_policy(`
1251                 mount_run_fusermount($1_t, $1_r)
1252                 mount_read_pid_files($1_t)
1253         ')
1254
1255         optional_policy(`
1256                 wine_role_template($1, $1_r, $1_t)
1257         ')
1258
1259         optional_policy(`
1260                 postfix_run_postdrop($1_t, $1_r)
1261         ')
1262
1263         # Run pppd in pppd_t by default for user
1264         optional_policy(`
1265                 ppp_run_cond($1_t, $1_r)
1266         ')
1267 ')
1268
1269 #######################################
1270 ## <summary>
1271 ##      The template for creating an administrative user.
1272 ## </summary>
1273 ## <desc>
1274 ##      <p>
1275 ##      This template creates a user domain, types, and
1276 ##      rules for the user's tty, pty, home directories,
1277 ##      tmp, and tmpfs files.
1278 ##      </p>
1279 ##      <p>
1280 ##      The privileges given to administrative users are:
1281 ##      <ul>
1282 ##              <li>Raw disk access</li>
1283 ##              <li>Set all sysctls</li>
1284 ##              <li>All kernel ring buffer controls</li>
1285 ##              <li>Create, read, write, and delete all files but shadow</li>
1286 ##              <li>Manage source and binary format SELinux policy</li>
1287 ##              <li>Run insmod</li>
1288 ##      </ul>
1289 ##      </p>
1290 ## </desc>
1291 ## <param name="userdomain_prefix">
1292 ##      <summary>
1293 ##      The prefix of the user domain (e.g., sysadm
1294 ##      is the prefix for sysadm_t).
1295 ##      </summary>
1296 ## </param>
1297 #
1298 template(`userdom_admin_user_template',`
1299         gen_require(`
1300                 attribute admindomain;
1301                 class passwd { passwd chfn chsh rootok crontab };
1302         ')
1303
1304         ##############################
1305         #
1306         # Declarations
1307         #
1308
1309         # Inherit rules for ordinary users.
1310         userdom_login_user_template($1)
1311         userdom_common_user_template($1)
1312
1313         domain_obj_id_change_exemption($1_t)
1314         role system_r types $1_t;
1315
1316         typeattribute $1_t admindomain;
1317
1318         ifdef(`direct_sysadm_daemon',`
1319                 domain_system_change_exemption($1_t)
1320         ')
1321
1322         ##############################
1323         #
1324         # $1_t local policy
1325         #
1326
1327         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1328         allow $1_t self:capability2 syslog;
1329         allow $1_t self:process { setexec setfscreate };
1330         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1331         allow $1_t self:tun_socket create;
1332         # Set password information for other users.
1333         allow $1_t self:passwd { passwd chfn chsh };
1334         # Skip authentication when pam_rootok is specified.
1335         allow $1_t self:passwd rootok;
1336
1337         # Manipulate other users crontab.
1338         allow $1_t self:passwd crontab;
1339
1340         kernel_read_software_raid_state($1_t)
1341         kernel_getattr_core_if($1_t)
1342         kernel_getattr_message_if($1_t)
1343         kernel_change_ring_buffer_level($1_t)
1344         kernel_clear_ring_buffer($1_t)
1345         kernel_read_ring_buffer($1_t)
1346         kernel_get_sysvipc_info($1_t)
1347         kernel_rw_all_sysctls($1_t)
1348         # signal unlabeled processes:
1349         kernel_kill_unlabeled($1_t)
1350         kernel_signal_unlabeled($1_t)
1351         kernel_sigstop_unlabeled($1_t)
1352         kernel_signull_unlabeled($1_t)
1353         kernel_sigchld_unlabeled($1_t)
1354         kernel_signal($1_t)
1355
1356         corenet_tcp_bind_generic_port($1_t)
1357         # allow setting up tunnels
1358         corenet_rw_tun_tap_dev($1_t)
1359
1360         dev_getattr_generic_blk_files($1_t)
1361         dev_getattr_generic_chr_files($1_t)
1362         # for lsof
1363         dev_getattr_mtrr_dev($1_t)
1364         # Allow MAKEDEV to work
1365         dev_create_all_blk_files($1_t)
1366         dev_create_all_chr_files($1_t)
1367         dev_delete_all_blk_files($1_t)
1368         dev_delete_all_chr_files($1_t)
1369         dev_rename_all_blk_files($1_t)
1370         dev_rename_all_chr_files($1_t)
1371         dev_create_generic_symlinks($1_t)
1372         dev_rw_generic_usb_dev($1_t)
1373         dev_rw_usbfs($1_t)
1374
1375         domain_setpriority_all_domains($1_t)
1376         domain_read_all_domains_state($1_t)
1377         domain_getattr_all_domains($1_t)
1378         domain_getcap_all_domains($1_t)
1379         domain_dontaudit_ptrace_all_domains($1_t)
1380         # signal all domains:
1381         domain_kill_all_domains($1_t)
1382         domain_signal_all_domains($1_t)
1383         domain_signull_all_domains($1_t)
1384         domain_sigstop_all_domains($1_t)
1385         domain_sigstop_all_domains($1_t)
1386         domain_sigchld_all_domains($1_t)
1387         # for lsof
1388         domain_getattr_all_sockets($1_t)
1389         domain_dontaudit_getattr_all_sockets($1_t)
1390
1391         files_exec_usr_src_files($1_t)
1392
1393         fs_getattr_all_fs($1_t)
1394         fs_getattr_all_files($1_t)
1395         fs_list_all($1_t)
1396         fs_set_all_quotas($1_t)
1397         fs_exec_noxattr($1_t)
1398
1399         storage_raw_read_removable_device($1_t)
1400         storage_raw_write_removable_device($1_t)
1401         storage_dontaudit_read_fixed_disk($1_t)
1402
1403         term_use_all_inherited_terms($1_t)
1404
1405         auth_getattr_shadow($1_t)
1406         # Manage almost all files
1407         auth_manage_all_files_except_shadow($1_t)
1408         # Relabel almost all files
1409         auth_relabel_all_files_except_shadow($1_t)
1410
1411         init_telinit($1_t)
1412
1413         logging_send_syslog_msg($1_t)
1414
1415         optional_policy(`
1416                 modutils_domtrans_insmod($1_t)
1417                 modutils_domtrans_depmod($1_t)
1418         ')
1419
1420         # The following rule is temporary until such time that a complete
1421         # policy management infrastructure is in place so that an administrator
1422         # cannot directly manipulate policy files with arbitrary programs.
1423         seutil_manage_src_policy($1_t)
1424         # Violates the goal of limiting write access to checkpolicy.
1425         # But presently necessary for installing the file_contexts file.
1426         seutil_manage_bin_policy($1_t)
1427
1428         userdom_manage_user_home_content_dirs($1_t)
1429         userdom_manage_user_home_content_files($1_t)
1430         userdom_manage_user_home_content_symlinks($1_t)
1431         userdom_manage_user_home_content_pipes($1_t)
1432         userdom_manage_user_home_content_sockets($1_t)
1433         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1434
1435         tunable_policy(`user_rw_noexattrfile',`
1436                 fs_manage_noxattr_fs_files($1_t)
1437                 fs_manage_noxattr_fs_dirs($1_t)
1438         ',`
1439                 fs_read_noxattr_fs_files($1_t)
1440         ')
1441
1442         optional_policy(`
1443                 postgresql_unconfined($1_t)
1444         ')
1445
1446         optional_policy(`
1447                 userhelper_exec($1_t)
1448         ')
1449 ')
1450
1451 ########################################
1452 ## <summary>
1453 ##      Allow user to run as a secadm
1454 ## </summary>
1455 ## <desc>
1456 ##      <p>
1457 ##      Create objects in a user home directory
1458 ##      with an automatic type transition to
1459 ##      a specified private type.
1460 ##      </p>
1461 ##      <p>
1462 ##      This is a templated interface, and should only
1463 ##      be called from a per-userdomain template.
1464 ##      </p>
1465 ## </desc>
1466 ## <param name="domain">
1467 ##      <summary>
1468 ##      Domain allowed access.
1469 ##      </summary>
1470 ## </param>
1471 ## <param name="role">
1472 ##      <summary>
1473 ##      The role  of the object to create.
1474 ##      </summary>
1475 ## </param>
1476 #
1477 template(`userdom_security_admin_template',`
1478         allow $1 self:capability { dac_read_search dac_override };
1479
1480         corecmd_exec_shell($1)
1481
1482         domain_obj_id_change_exemption($1)
1483
1484         dev_relabel_all_dev_nodes($1)
1485
1486         files_create_boot_flag($1)
1487         files_create_default_dir($1)
1488         files_root_filetrans_default($1, dir)
1489
1490         # Necessary for managing /boot/efi
1491         fs_manage_dos_files($1)
1492
1493         mls_process_read_up($1)
1494         mls_file_read_all_levels($1)
1495         mls_file_upgrade($1)
1496         mls_file_downgrade($1)
1497
1498         selinux_set_enforce_mode($1)
1499         selinux_set_all_booleans($1)
1500         selinux_set_parameters($1)
1501         selinux_read_policy($1)
1502
1503         auth_relabel_all_files_except_shadow($1)
1504         auth_relabel_shadow($1)
1505
1506         init_exec($1)
1507
1508         logging_send_syslog_msg($1)
1509         logging_read_audit_log($1)
1510         logging_read_generic_logs($1)
1511         logging_read_audit_config($1)
1512
1513         seutil_manage_bin_policy($1)
1514         seutil_run_checkpolicy($1,$2)
1515         seutil_run_loadpolicy($1,$2)
1516         seutil_run_semanage($1,$2)
1517         seutil_run_setsebool($1,$2)
1518         seutil_run_setfiles($1, $2)
1519
1520         optional_policy(`
1521                 aide_run($1,$2)
1522         ')
1523
1524         optional_policy(`
1525                 consoletype_exec($1)
1526         ')
1527
1528         optional_policy(`
1529                 dmesg_exec($1)
1530         ')
1531
1532         optional_policy(`
1533                 ipsec_run_setkey($1,$2)
1534         ')
1535
1536         optional_policy(`
1537                 netlabel_run_mgmt($1,$2)
1538         ')
1539
1540         optional_policy(`
1541                 samhain_run($1, $2)
1542         ')
1543 ')
1544
1545 ########################################
1546 ## <summary>
1547 ##      Make the specified type usable in a
1548 ##      user home directory.
1549 ## </summary>
1550 ## <param name="type">
1551 ##      <summary>
1552 ##      Type to be used as a file in the
1553 ##      user home directory.
1554 ##      </summary>
1555 ## </param>
1556 #
1557 interface(`userdom_user_home_content',`
1558         gen_require(`
1559                 type user_home_t;
1560                 attribute user_home_type;
1561         ')
1562
1563         allow $1 user_home_t:filesystem associate;
1564         files_type($1)
1565         ubac_constrained($1)
1566
1567         files_poly_member($1)
1568         typeattribute $1  user_home_type;
1569 ')
1570
1571 ########################################
1572 ## <summary>
1573 ##      Make the specified type usable in a
1574 ##      generic temporary directory.
1575 ## </summary>
1576 ## <param name="type">
1577 ##      <summary>
1578 ##      Type to be used as a file in the
1579 ##      generic temporary directory.
1580 ##      </summary>
1581 ## </param>
1582 #
1583 interface(`userdom_user_tmp_content',`
1584         gen_require(`
1585                 attribute user_tmp_type;
1586         ')
1587
1588         typeattribute $1 user_tmp_type;
1589
1590         files_tmp_file($1)
1591         ubac_constrained($1)
1592 ')
1593
1594 ########################################
1595 ## <summary>
1596 ##      Allow domain to attach to TUN devices created by administrative users.
1597 ## </summary>
1598 ## <param name="domain">
1599 ##      <summary>
1600 ##      Domain allowed access.
1601 ##      </summary>
1602 ## </param>
1603 #
1604 interface(`userdom_attach_admin_tun_iface',`
1605         gen_require(`
1606                 attribute admindomain;
1607         ')
1608
1609         allow $1 admindomain:tun_socket relabelfrom;
1610         allow $1 self:tun_socket relabelto;
1611 ')
1612
1613 ########################################
1614 ## <summary>
1615 ##      Set the attributes of a user pty.
1616 ## </summary>
1617 ## <param name="domain">
1618 ##      <summary>
1619 ##      Domain allowed access.
1620 ##      </summary>
1621 ## </param>
1622 #
1623 interface(`userdom_setattr_user_ptys',`
1624         gen_require(`
1625                 type user_devpts_t;
1626         ')
1627
1628         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1629 ')
1630
1631 ########################################
1632 ## <summary>
1633 ##      Create a user pty.
1634 ## </summary>
1635 ## <param name="domain">
1636 ##      <summary>
1637 ##      Domain allowed access.
1638 ##      </summary>
1639 ## </param>
1640 #
1641 interface(`userdom_create_user_pty',`
1642         gen_require(`
1643                 type user_devpts_t;
1644         ')
1645
1646         term_create_pty($1, user_devpts_t)
1647 ')
1648
1649 ########################################
1650 ## <summary>
1651 ##      Get the attributes of user home directories.
1652 ## </summary>
1653 ## <param name="domain">
1654 ##      <summary>
1655 ##      Domain allowed access.
1656 ##      </summary>
1657 ## </param>
1658 #
1659 interface(`userdom_getattr_user_home_dirs',`
1660         gen_require(`
1661                 type user_home_dir_t;
1662         ')
1663
1664         allow $1 user_home_dir_t:dir getattr_dir_perms;
1665         files_search_home($1)
1666 ')
1667
1668 ########################################
1669 ## <summary>
1670 ##      Do not audit attempts to get the attributes of user home directories.
1671 ## </summary>
1672 ## <param name="domain">
1673 ##      <summary>
1674 ##      Domain to not audit.
1675 ##      </summary>
1676 ## </param>
1677 #
1678 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1679         gen_require(`
1680                 type user_home_dir_t;
1681         ')
1682
1683         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1684 ')
1685
1686 ########################################
1687 ## <summary>
1688 ##      Search user home directories.
1689 ## </summary>
1690 ## <param name="domain">
1691 ##      <summary>
1692 ##      Domain allowed access.
1693 ##      </summary>
1694 ## </param>
1695 #
1696 interface(`userdom_search_user_home_dirs',`
1697         gen_require(`
1698                 type user_home_dir_t;
1699         ')
1700
1701         allow $1 user_home_dir_t:dir search_dir_perms;
1702         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1703         files_search_home($1)
1704 ')
1705
1706 ########################################
1707 ## <summary>
1708 ##      Do not audit attempts to search user home directories.
1709 ## </summary>
1710 ## <desc>
1711 ##      <p>
1712 ##      Do not audit attempts to search user home directories.
1713 ##      This will supress SELinux denial messages when the specified
1714 ##      domain is denied the permission to search these directories.
1715 ##      </p>
1716 ## </desc>
1717 ## <param name="domain">
1718 ##      <summary>
1719 ##      Domain to not audit.
1720 ##      </summary>
1721 ## </param>
1722 ## <infoflow type="none"/>
1723 #
1724 interface(`userdom_dontaudit_search_user_home_dirs',`
1725         gen_require(`
1726                 type user_home_dir_t;
1727         ')
1728
1729         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1730 ')
1731
1732 ########################################
1733 ## <summary>
1734 ##      List user home directories.
1735 ## </summary>
1736 ## <param name="domain">
1737 ##      <summary>
1738 ##      Domain allowed access.
1739 ##      </summary>
1740 ## </param>
1741 #
1742 interface(`userdom_list_user_home_dirs',`
1743         gen_require(`
1744                 type user_home_dir_t;
1745         ')
1746
1747         allow $1 user_home_dir_t:dir list_dir_perms;
1748         files_search_home($1)
1749
1750         tunable_policy(`use_nfs_home_dirs',`
1751                 fs_list_nfs($1)
1752         ')
1753
1754         tunable_policy(`use_samba_home_dirs',`
1755                 fs_list_cifs($1)
1756         ')
1757 ')
1758
1759 ########################################
1760 ## <summary>
1761 ##      Do not audit attempts to list user home subdirectories.
1762 ## </summary>
1763 ## <param name="domain">
1764 ##      <summary>
1765 ##      Domain to not audit.
1766 ##      </summary>
1767 ## </param>
1768 #
1769 interface(`userdom_dontaudit_list_user_home_dirs',`
1770         gen_require(`
1771                 type user_home_dir_t;
1772                 type user_home_t;
1773         ')
1774
1775         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1776         dontaudit $1 user_home_t:dir list_dir_perms;
1777 ')
1778
1779 ########################################
1780 ## <summary>
1781 ##      Create user home directories.
1782 ## </summary>
1783 ## <param name="domain">
1784 ##      <summary>
1785 ##      Domain allowed access.
1786 ##      </summary>
1787 ## </param>
1788 #
1789 interface(`userdom_create_user_home_dirs',`
1790         gen_require(`
1791                 type user_home_dir_t;
1792         ')
1793
1794         allow $1 user_home_dir_t:dir create_dir_perms;
1795 ')
1796
1797 ########################################
1798 ## <summary>
1799 ##      Create user home directories.
1800 ## </summary>
1801 ## <param name="domain">
1802 ##      <summary>
1803 ##      Domain allowed access.
1804 ##      </summary>
1805 ## </param>
1806 #
1807 interface(`userdom_manage_user_home_dirs',`
1808         gen_require(`
1809                 type user_home_dir_t;
1810         ')
1811
1812         allow $1 user_home_dir_t:dir manage_dir_perms;
1813 ')
1814
1815 ########################################
1816 ## <summary>
1817 ##      Relabel to user home directories.
1818 ## </summary>
1819 ## <param name="domain">
1820 ##      <summary>
1821 ##      Domain allowed access.
1822 ##      </summary>
1823 ## </param>
1824 #
1825 interface(`userdom_relabelto_user_home_dirs',`
1826         gen_require(`
1827                 type user_home_dir_t;
1828         ')
1829
1830         allow $1 user_home_dir_t:dir relabelto;
1831 ')
1832
1833
1834 ########################################
1835 ## <summary>
1836 ##      Relabel to user home files.
1837 ## </summary>
1838 ## <param name="domain">
1839 ##      <summary>
1840 ##      Domain allowed access.
1841 ##      </summary>
1842 ## </param>
1843 #
1844 interface(`userdom_relabelto_user_home_files',`
1845         gen_require(`
1846                 type user_home_t;
1847         ')
1848
1849         allow $1 user_home_t:file relabelto;
1850 ')
1851 ########################################
1852 ## <summary>
1853 ##      Relabel user home files.
1854 ## </summary>
1855 ## <param name="domain">
1856 ##      <summary>
1857 ##      Domain allowed access.
1858 ##      </summary>
1859 ## </param>
1860 #
1861 interface(`userdom_relabel_user_home_files',`
1862         gen_require(`
1863                 type user_home_t;
1864         ')
1865
1866         allow $1 user_home_t:file relabel_file_perms;
1867 ')
1868
1869 ########################################
1870 ## <summary>
1871 ##      Create directories in the home dir root with
1872 ##      the user home directory type.
1873 ## </summary>
1874 ## <param name="domain">
1875 ##      <summary>
1876 ##      Domain allowed access.
1877 ##      </summary>
1878 ## </param>
1879 #
1880 interface(`userdom_home_filetrans_user_home_dir',`
1881         gen_require(`
1882                 type user_home_dir_t;
1883         ')
1884
1885         files_home_filetrans($1, user_home_dir_t, dir)
1886 ')
1887
1888 ########################################
1889 ## <summary>
1890 ##      Do a domain transition to the specified
1891 ##      domain when executing a program in the
1892 ##      user home directory.
1893 ## </summary>
1894 ## <desc>
1895 ##      <p>
1896 ##      Do a domain transition to the specified
1897 ##      domain when executing a program in the
1898 ##      user home directory.
1899 ##      </p>
1900 ##      <p>
1901 ##      No interprocess communication (signals, pipes,
1902 ##      etc.) is provided by this interface since
1903 ##      the domains are not owned by this module.
1904 ##      </p>
1905 ## </desc>
1906 ## <param name="source_domain">
1907 ##      <summary>
1908 ##      Domain allowed to transition.
1909 ##      </summary>
1910 ## </param>
1911 ## <param name="target_domain">
1912 ##      <summary>
1913 ##      Domain to transition to.
1914 ##      </summary>
1915 ## </param>
1916 #
1917 interface(`userdom_user_home_domtrans',`
1918         gen_require(`
1919                 type user_home_dir_t, user_home_t;
1920         ')
1921
1922         domain_auto_trans($1, user_home_t, $2)
1923         allow $1 user_home_dir_t:dir search_dir_perms;
1924         files_search_home($1)
1925 ')
1926
1927 ########################################
1928 ## <summary>
1929 ##      Do not audit attempts to search user home content directories.
1930 ## </summary>
1931 ## <param name="domain">
1932 ##      <summary>
1933 ##      Domain to not audit.
1934 ##      </summary>
1935 ## </param>
1936 #
1937 interface(`userdom_dontaudit_search_user_home_content',`
1938         gen_require(`
1939                 type user_home_t;
1940         ')
1941
1942         dontaudit $1 user_home_t:dir search_dir_perms;
1943         fs_dontaudit_list_nfs($1)
1944         fs_dontaudit_list_cifs($1)
1945 ')
1946
1947 ########################################
1948 ## <summary>
1949 ##      List contents of users home directory.
1950 ## </summary>
1951 ## <param name="domain">
1952 ##      <summary>
1953 ##      Domain allowed access.
1954 ##      </summary>
1955 ## </param>
1956 #
1957 interface(`userdom_list_user_home_content',`
1958         gen_require(`
1959                 type user_home_dir_t;
1960                 attribute user_home_type;
1961         ')
1962
1963         files_list_home($1)
1964         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1965 ')
1966
1967 ########################################
1968 ## <summary>
1969 ##      Create, read, write, and delete directories
1970 ##      in a user home subdirectory.
1971 ## </summary>
1972 ## <param name="domain">
1973 ##      <summary>
1974 ##      Domain allowed access.
1975 ##      </summary>
1976 ## </param>
1977 #
1978 interface(`userdom_manage_user_home_content_dirs',`
1979         gen_require(`
1980                 type user_home_dir_t, user_home_t;
1981         ')
1982
1983         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1984         files_search_home($1)
1985 ')
1986
1987 ########################################
1988 ## <summary>
1989 ##      Delete directories in a user home subdirectory.
1990 ## </summary>
1991 ## <param name="domain">
1992 ##      <summary>
1993 ##      Domain allowed access.
1994 ##      </summary>
1995 ## </param>
1996 #
1997 interface(`userdom_delete_user_home_content_dirs',`
1998         gen_require(`
1999                 type user_home_t;
2000         ')
2001
2002         allow $1 user_home_t:dir delete_dir_perms;
2003 ')
2004
2005 ########################################
2006 ## <summary>
2007 ##      Set the attributes of user home files.
2008 ## </summary>
2009 ## <param name="domain">
2010 ##      <summary>
2011 ##      Domain allowed access.
2012 ##      </summary>
2013 ## </param>
2014 ## <rolecap/>
2015 #
2016 interface(`userdom_setattr_user_home_content_files',`
2017         gen_require(`
2018                 type user_home_t;
2019         ')
2020
2021         allow $1 user_home_t:file setattr;
2022 ')
2023
2024 ########################################
2025 ## <summary>
2026 ##      Do not audit attempts to set the
2027 ##      attributes of user home files.
2028 ## </summary>
2029 ## <param name="domain">
2030 ##      <summary>
2031 ##      Domain to not audit.
2032 ##      </summary>
2033 ## </param>
2034 #
2035 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2036         gen_require(`
2037                 type user_home_t;
2038         ')
2039
2040         dontaudit $1 user_home_t:file setattr_file_perms;
2041 ')
2042
2043 ########################################
2044 ## <summary>
2045 ##      Mmap user home files.
2046 ## </summary>
2047 ## <param name="domain">
2048 ##      <summary>
2049 ##      Domain allowed access.
2050 ##      </summary>
2051 ## </param>
2052 #
2053 interface(`userdom_mmap_user_home_content_files',`
2054         gen_require(`
2055                 type user_home_dir_t, user_home_t;
2056         ')
2057
2058         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2059         files_search_home($1)
2060 ')
2061
2062 ########################################
2063 ## <summary>
2064 ##      Read user home files.
2065 ## </summary>
2066 ## <param name="domain">
2067 ##      <summary>
2068 ##      Domain allowed access.
2069 ##      </summary>
2070 ## </param>
2071 #
2072 interface(`userdom_read_user_home_content_files',`
2073         gen_require(`
2074                 type user_home_dir_t, user_home_t;
2075         ')
2076
2077         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2078         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2079         files_search_home($1)
2080 ')
2081
2082 ########################################
2083 ## <summary>
2084 ##      Do not audit attempts to getattr user home files.
2085 ## </summary>
2086 ## <param name="domain">
2087 ##      <summary>
2088 ##      Domain to not audit.
2089 ##      </summary>
2090 ## </param>
2091 #
2092 interface(`userdom_dontaudit_getattr_user_home_content',`
2093         gen_require(`
2094                 attribute user_home_type;
2095         ')
2096
2097         dontaudit $1 user_home_type:dir getattr;
2098         dontaudit $1 user_home_type:file getattr;
2099 ')
2100
2101 ########################################
2102 ## <summary>
2103 ##      Do not audit attempts to read user home files.
2104 ## </summary>
2105 ## <param name="domain">
2106 ##      <summary>
2107 ##      Domain to not audit.
2108 ##      </summary>
2109 ## </param>
2110 #
2111 interface(`userdom_dontaudit_read_user_home_content_files',`
2112         gen_require(`
2113                 attribute user_home_type;
2114                 type user_home_dir_t;
2115         ')
2116
2117         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2118         dontaudit $1 user_home_type:dir list_dir_perms;
2119         dontaudit $1 user_home_type:file read_file_perms;
2120         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2121 ')
2122
2123 ########################################
2124 ## <summary>
2125 ##      Do not audit attempts to append user home files.
2126 ## </summary>
2127 ## <param name="domain">
2128 ##      <summary>
2129 ##      Domain to not audit.
2130 ##      </summary>
2131 ## </param>
2132 #
2133 interface(`userdom_dontaudit_append_user_home_content_files',`
2134         gen_require(`
2135                 type user_home_t;
2136         ')
2137
2138         dontaudit $1 user_home_t:file append_file_perms;
2139 ')
2140
2141 ########################################
2142 ## <summary>
2143 ##      Do not audit attempts to write user home files.
2144 ## </summary>
2145 ## <param name="domain">
2146 ##      <summary>
2147 ##      Domain to not audit.
2148 ##      </summary>
2149 ## </param>
2150 #
2151 interface(`userdom_dontaudit_write_user_home_content_files',`
2152         gen_require(`
2153                 type user_home_t;
2154         ')
2155
2156         dontaudit $1 user_home_t:file write_file_perms;
2157 ')
2158
2159 ########################################
2160 ## <summary>
2161 ##      Delete files in a user home subdirectory.
2162 ## </summary>
2163 ## <param name="domain">
2164 ##      <summary>
2165 ##      Domain allowed access.
2166 ##      </summary>
2167 ## </param>
2168 #
2169 interface(`userdom_delete_user_home_content_files',`
2170         gen_require(`
2171                 type user_home_t;
2172         ')
2173
2174         allow $1 user_home_t:file delete_file_perms;
2175 ')
2176
2177 ########################################
2178 ## <summary>
2179 ##      Delete sock files in a user home subdirectory.
2180 ## </summary>
2181 ## <param name="domain">
2182 ##      <summary>
2183 ##      Domain allowed access.
2184 ##      </summary>
2185 ## </param>
2186 #
2187 interface(`userdom_delete_user_home_content_sock_files',`
2188         gen_require(`
2189                 type user_home_t;
2190         ')
2191
2192         allow $1 user_home_t:sock_file delete_file_perms;
2193 ')
2194
2195 ########################################
2196 ## <summary>
2197 ##      Do not audit attempts to write user home files.
2198 ## </summary>
2199 ## <param name="domain">
2200 ##      <summary>
2201 ##      Domain to not audit.
2202 ##      </summary>
2203 ## </param>
2204 #
2205 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2206         gen_require(`
2207                 type user_home_t;
2208         ')
2209
2210         dontaudit $1 user_home_t:file relabel_file_perms;
2211 ')
2212
2213 ########################################
2214 ## <summary>
2215 ##      Read user home subdirectory symbolic links.
2216 ## </summary>
2217 ## <param name="domain">
2218 ##      <summary>
2219 ##      Domain allowed access.
2220 ##      </summary>
2221 ## </param>
2222 #
2223 interface(`userdom_read_user_home_content_symlinks',`
2224         gen_require(`
2225                 type user_home_dir_t, user_home_t;
2226         ')
2227
2228         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2229 ')
2230
2231 ########################################
2232 ## <summary>
2233 ##      Execute user home files.
2234 ## </summary>
2235 ## <param name="domain">
2236 ##      <summary>
2237 ##      Domain allowed access.
2238 ##      </summary>
2239 ## </param>
2240 ## <rolecap/>
2241 #
2242 interface(`userdom_exec_user_home_content_files',`
2243         gen_require(`
2244                 type user_home_dir_t;
2245                 attribute user_home_type;
2246         ')
2247
2248         files_search_home($1)
2249         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2250         dontaudit $1 user_home_type:sock_file execute;
2251         ')
2252
2253 ########################################
2254 ## <summary>
2255 ##      Do not audit attempts to execute user home files.
2256 ## </summary>
2257 ## <param name="domain">
2258 ##      <summary>
2259 ##      Domain to not audit.
2260 ##      </summary>
2261 ## </param>
2262 #
2263 interface(`userdom_dontaudit_exec_user_home_content_files',`
2264         gen_require(`
2265                 type user_home_t;
2266         ')
2267
2268         dontaudit $1 user_home_t:file exec_file_perms;
2269 ')
2270
2271 ########################################
2272 ## <summary>
2273 ##      Create, read, write, and delete files
2274 ##      in a user home subdirectory.
2275 ## </summary>
2276 ## <param name="domain">
2277 ##      <summary>
2278 ##      Domain allowed access.
2279 ##      </summary>
2280 ## </param>
2281 #
2282 interface(`userdom_manage_user_home_content_files',`
2283         gen_require(`
2284                 type user_home_dir_t, user_home_t;
2285         ')
2286
2287         manage_files_pattern($1, user_home_t, user_home_t)
2288         allow $1 user_home_dir_t:dir search_dir_perms;
2289         files_search_home($1)
2290 ')
2291
2292 ########################################
2293 ## <summary>
2294 ##      Do not audit attempts to create, read, write, and delete directories
2295 ##      in a user home subdirectory.
2296 ## </summary>
2297 ## <param name="domain">
2298 ##      <summary>
2299 ##      Domain to not audit.
2300 ##      </summary>
2301 ## </param>
2302 #
2303 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2304         gen_require(`
2305                 type user_home_dir_t, user_home_t;
2306         ')
2307
2308         dontaudit $1 user_home_t:dir manage_dir_perms;
2309 ')
2310
2311 ########################################
2312 ## <summary>
2313 ##      Create, read, write, and delete symbolic links
2314 ##      in a user home subdirectory.
2315 ## </summary>
2316 ## <param name="domain">
2317 ##      <summary>
2318 ##      Domain allowed access.
2319 ##      </summary>
2320 ## </param>
2321 #
2322 interface(`userdom_manage_user_home_content_symlinks',`
2323         gen_require(`
2324                 type user_home_dir_t, user_home_t;
2325         ')
2326
2327         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2328         allow $1 user_home_dir_t:dir search_dir_perms;
2329         files_search_home($1)
2330 ')
2331
2332 ########################################
2333 ## <summary>
2334 ##      Delete symbolic links in a user home directory.
2335 ## </summary>
2336 ## <param name="domain">
2337 ##      <summary>
2338 ##      Domain allowed access.
2339 ##      </summary>
2340 ## </param>
2341 #
2342 interface(`userdom_delete_user_home_content_symlinks',`
2343         gen_require(`
2344                 type user_home_t;
2345         ')
2346
2347         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2348 ')
2349
2350 ########################################
2351 ## <summary>
2352 ##      Create, read, write, and delete named pipes
2353 ##      in a user home subdirectory.
2354 ## </summary>
2355 ## <param name="domain">
2356 ##      <summary>
2357 ##      Domain allowed access.
2358 ##      </summary>
2359 ## </param>
2360 #
2361 interface(`userdom_manage_user_home_content_pipes',`
2362         gen_require(`
2363                 type user_home_dir_t, user_home_t;
2364         ')
2365
2366         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2367         allow $1 user_home_dir_t:dir search_dir_perms;
2368         files_search_home($1)
2369 ')
2370
2371 ########################################
2372 ## <summary>
2373 ##      Create, read, write, and delete named sockets
2374 ##      in a user home subdirectory.
2375 ## </summary>
2376 ## <param name="domain">
2377 ##      <summary>
2378 ##      Domain allowed access.
2379 ##      </summary>
2380 ## </param>
2381 #
2382 interface(`userdom_manage_user_home_content_sockets',`
2383         gen_require(`
2384                 type user_home_dir_t, user_home_t;
2385         ')
2386
2387         allow $1 user_home_dir_t:dir search_dir_perms;
2388         manage_sock_files_pattern($1, user_home_t, user_home_t)
2389         files_search_home($1)
2390 ')
2391
2392 ########################################
2393 ## <summary>
2394 ##      Create objects in a user home directory
2395 ##      with an automatic type transition to
2396 ##      a specified private type.
2397 ## </summary>
2398 ## <param name="domain">
2399 ##      <summary>
2400 ##      Domain allowed access.
2401 ##      </summary>
2402 ## </param>
2403 ## <param name="private_type">
2404 ##      <summary>
2405 ##      The type of the object to create.
2406 ##      </summary>
2407 ## </param>
2408 ## <param name="object_class">
2409 ##      <summary>
2410 ##      The class of the object to be created.
2411 ##      </summary>
2412 ## </param>
2413 #
2414 interface(`userdom_user_home_dir_filetrans',`
2415         gen_require(`
2416                 type user_home_dir_t;
2417         ')
2418
2419         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2420         files_search_home($1)
2421 ')
2422
2423 ########################################
2424 ## <summary>
2425 ##      Create objects in a user home directory
2426 ##      with an automatic type transition to
2427 ##      a specified private type.
2428 ## </summary>
2429 ## <param name="domain">
2430 ##      <summary>
2431 ##      Domain allowed access.
2432 ##      </summary>
2433 ## </param>
2434 ## <param name="private_type">
2435 ##      <summary>
2436 ##      The type of the object to create.
2437 ##      </summary>
2438 ## </param>
2439 ## <param name="object_class">
2440 ##      <summary>
2441 ##      The class of the object to be created.
2442 ##      </summary>
2443 ## </param>
2444 #
2445 interface(`userdom_user_home_content_filetrans',`
2446         gen_require(`
2447                 type user_home_dir_t, user_home_t;
2448         ')
2449
2450         filetrans_pattern($1, user_home_t, $2, $3)
2451         allow $1 user_home_dir_t:dir search_dir_perms;
2452         files_search_home($1)
2453 ')
2454
2455 ########################################
2456 ## <summary>
2457 ##      Create objects in a user home directory
2458 ##      with an automatic type transition to
2459 ##      the user home file type.
2460 ## </summary>
2461 ## <param name="domain">
2462 ##      <summary>
2463 ##      Domain allowed access.
2464 ##      </summary>
2465 ## </param>
2466 ## <param name="object_class">
2467 ##      <summary>
2468 ##      The class of the object to be created.
2469 ##      </summary>
2470 ## </param>
2471 #
2472 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2473         gen_require(`
2474                 type user_home_dir_t, user_home_t;
2475         ')
2476
2477         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2478         files_search_home($1)
2479 ')
2480
2481 ########################################
2482 ## <summary>
2483 ##      Write to user temporary named sockets.
2484 ## </summary>
2485 ## <param name="domain">
2486 ##      <summary>
2487 ##      Domain allowed access.
2488 ##      </summary>
2489 ## </param>
2490 #
2491 interface(`userdom_write_user_tmp_sockets',`
2492         gen_require(`
2493                 type user_tmp_t;
2494         ')
2495
2496         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2497         files_search_tmp($1)
2498 ')
2499
2500 ########################################
2501 ## <summary>
2502 ##      List user temporary directories.
2503 ## </summary>
2504 ## <param name="domain">
2505 ##      <summary>
2506 ##      Domain allowed access.
2507 ##      </summary>
2508 ## </param>
2509 #
2510 interface(`userdom_list_user_tmp',`
2511         gen_require(`
2512                 type user_tmp_t;
2513         ')
2514
2515         allow $1 user_tmp_t:dir list_dir_perms;
2516         files_search_tmp($1)
2517 ')
2518
2519 ########################################
2520 ## <summary>
2521 ##      Do not audit attempts to list user
2522 ##      temporary directories.
2523 ## </summary>
2524 ## <param name="domain">
2525 ##      <summary>
2526 ##      Domain to not audit.
2527 ##      </summary>
2528 ## </param>
2529 #
2530 interface(`userdom_dontaudit_list_user_tmp',`
2531         gen_require(`
2532                 type user_tmp_t;
2533         ')
2534
2535         dontaudit $1 user_tmp_t:dir list_dir_perms;
2536 ')
2537
2538 ########################################
2539 ## <summary>
2540 ##      Do not audit attempts to manage users
2541 ##      temporary directories.
2542 ## </summary>
2543 ## <param name="domain">
2544 ##      <summary>
2545 ##      Domain to not audit.
2546 ##      </summary>
2547 ## </param>
2548 #
2549 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2550         gen_require(`
2551                 type user_tmp_t;
2552         ')
2553
2554         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2555 ')
2556
2557 ########################################
2558 ## <summary>
2559 ##      Read user temporary files.
2560 ## </summary>
2561 ## <param name="domain">
2562 ##      <summary>
2563 ##      Domain allowed access.
2564 ##      </summary>
2565 ## </param>
2566 #
2567 interface(`userdom_read_user_tmp_files',`
2568         gen_require(`
2569                 type user_tmp_t;
2570         ')
2571
2572         read_files_pattern($1, user_tmp_t, user_tmp_t)
2573         allow $1 user_tmp_t:dir list_dir_perms;
2574         files_search_tmp($1)
2575 ')
2576
2577 ########################################
2578 ## <summary>
2579 ##      Do not audit attempts to read users
2580 ##      temporary files.
2581 ## </summary>
2582 ## <param name="domain">
2583 ##      <summary>
2584 ##      Domain to not audit.
2585 ##      </summary>
2586 ## </param>
2587 #
2588 interface(`userdom_dontaudit_read_user_tmp_files',`
2589         gen_require(`
2590                 type user_tmp_t;
2591         ')
2592
2593         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2594 ')
2595
2596 ########################################
2597 ## <summary>
2598 ##      Do not audit attempts to append users
2599 ##      temporary files.
2600 ## </summary>
2601 ## <param name="domain">
2602 ##      <summary>
2603 ##      Domain to not audit.
2604 ##      </summary>
2605 ## </param>
2606 #
2607 interface(`userdom_dontaudit_append_user_tmp_files',`
2608         gen_require(`
2609                 type user_tmp_t;
2610         ')
2611
2612         dontaudit $1 user_tmp_t:file append_file_perms;
2613 ')
2614
2615 ########################################
2616 ## <summary>
2617 ##      Read and write user temporary files.
2618 ## </summary>
2619 ## <param name="domain">
2620 ##      <summary>
2621 ##      Domain allowed access.
2622 ##      </summary>
2623 ## </param>
2624 #
2625 interface(`userdom_rw_user_tmp_files',`
2626         gen_require(`
2627                 type user_tmp_t;
2628         ')
2629
2630         allow $1 user_tmp_t:dir list_dir_perms;
2631         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2632         files_search_tmp($1)
2633 ')
2634
2635 ########################################
2636 ## <summary>
2637 ##      Do not audit attempts to manage users
2638 ##      temporary files.
2639 ## </summary>
2640 ## <param name="domain">
2641 ##      <summary>
2642 ##      Domain to not audit.
2643 ##      </summary>
2644 ## </param>
2645 #
2646 interface(`userdom_dontaudit_manage_user_tmp_files',`
2647         gen_require(`
2648                 type user_tmp_t;
2649         ')
2650
2651         dontaudit $1 user_tmp_t:file manage_file_perms;
2652 ')
2653
2654 ########################################
2655 ## <summary>
2656 ##      Read user temporary symbolic links.
2657 ## </summary>
2658 ## <param name="domain">
2659 ##      <summary>
2660 ##      Domain allowed access.
2661 ##      </summary>
2662 ## </param>
2663 #
2664 interface(`userdom_read_user_tmp_symlinks',`
2665         gen_require(`
2666                 type user_tmp_t;
2667         ')
2668
2669         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2670         allow $1 user_tmp_t:dir list_dir_perms;
2671         files_search_tmp($1)
2672 ')
2673
2674 ########################################
2675 ## <summary>
2676 ##      Create, read, write, and delete user
2677 ##      temporary directories.
2678 ## </summary>
2679 ## <param name="domain">
2680 ##      <summary>
2681 ##      Domain allowed access.
2682 ##      </summary>
2683 ## </param>
2684 #
2685 interface(`userdom_manage_user_tmp_dirs',`
2686         gen_require(`
2687                 type user_tmp_t;
2688         ')
2689
2690         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2691         files_search_tmp($1)
2692 ')
2693
2694 ########################################
2695 ## <summary>
2696 ##      Create, read, write, and delete user
2697 ##      temporary files.
2698 ## </summary>
2699 ## <param name="domain">
2700 ##      <summary>
2701 ##      Domain allowed access.
2702 ##      </summary>
2703 ## </param>
2704 #
2705 interface(`userdom_manage_user_tmp_files',`
2706         gen_require(`
2707                 type user_tmp_t;
2708         ')
2709
2710         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2711         files_search_tmp($1)
2712 ')
2713
2714 ########################################
2715 ## <summary>
2716 ##      Create, read, write, and delete user
2717 ##      temporary symbolic links.
2718 ## </summary>
2719 ## <param name="domain">
2720 ##      <summary>
2721 ##      Domain allowed access.
2722 ##      </summary>
2723 ## </param>
2724 #
2725 interface(`userdom_manage_user_tmp_symlinks',`
2726         gen_require(`
2727                 type user_tmp_t;
2728         ')
2729
2730         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2731         files_search_tmp($1)
2732 ')
2733
2734 ########################################
2735 ## <summary>
2736 ##      Create, read, write, and delete user
2737 ##      temporary named pipes.
2738 ## </summary>
2739 ## <param name="domain">
2740 ##      <summary>
2741 ##      Domain allowed access.
2742 ##      </summary>
2743 ## </param>
2744 #
2745 interface(`userdom_manage_user_tmp_pipes',`
2746         gen_require(`
2747                 type user_tmp_t;
2748         ')
2749
2750         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2751         files_search_tmp($1)
2752 ')
2753
2754 ########################################
2755 ## <summary>
2756 ##      Create, read, write, and delete user
2757 ##      temporary named sockets.
2758 ## </summary>
2759 ## <param name="domain">
2760 ##      <summary>
2761 ##      Domain allowed access.
2762 ##      </summary>
2763 ## </param>
2764 #
2765 interface(`userdom_manage_user_tmp_sockets',`
2766         gen_require(`
2767                 type user_tmp_t;
2768         ')
2769
2770         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2771         files_search_tmp($1)
2772 ')
2773
2774 ########################################
2775 ## <summary>
2776 ##      Create objects in a user temporary directory
2777 ##      with an automatic type transition to
2778 ##      a specified private type.
2779 ## </summary>
2780 ## <param name="domain">
2781 ##      <summary>
2782 ##      Domain allowed access.
2783 ##      </summary>
2784 ## </param>
2785 ## <param name="private_type">
2786 ##      <summary>
2787 ##      The type of the object to create.
2788 ##      </summary>
2789 ## </param>
2790 ## <param name="object_class">
2791 ##      <summary>
2792 ##      The class of the object to be created.
2793 ##      </summary>
2794 ## </param>
2795 #
2796 interface(`userdom_user_tmp_filetrans',`
2797         gen_require(`
2798                 type user_tmp_t;
2799         ')
2800
2801         filetrans_pattern($1, user_tmp_t, $2, $3)
2802         files_search_tmp($1)
2803 ')
2804
2805 ########################################
2806 ## <summary>
2807 ##      Create objects in the temporary directory
2808 ##      with an automatic type transition to
2809 ##      the user temporary type.
2810 ## </summary>
2811 ## <param name="domain">
2812 ##      <summary>
2813 ##      Domain allowed access.
2814 ##      </summary>
2815 ## </param>
2816 ## <param name="object_class">
2817 ##      <summary>
2818 ##      The class of the object to be created.
2819 ##      </summary>
2820 ## </param>
2821 #
2822 interface(`userdom_tmp_filetrans_user_tmp',`
2823         gen_require(`
2824                 type user_tmp_t;
2825         ')
2826
2827         files_tmp_filetrans($1, user_tmp_t, $2)
2828 ')
2829
2830 ########################################
2831 ## <summary>
2832 ##      Read user tmpfs files.
2833 ## </summary>
2834 ## <param name="domain">
2835 ##      <summary>
2836 ##      Domain allowed access.
2837 ##      </summary>
2838 ## </param>
2839 #
2840 interface(`userdom_read_user_tmpfs_files',`
2841         gen_require(`
2842                 type user_tmpfs_t;
2843         ')
2844
2845         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2846         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2847         allow $1 user_tmpfs_t:dir list_dir_perms;
2848         fs_search_tmpfs($1)
2849 ')
2850
2851 ########################################
2852 ## <summary>
2853 ##      Read/Write user tmpfs files.
2854 ## </summary>
2855 ## <param name="domain">
2856 ##      <summary>
2857 ##      Domain allowed access.
2858 ##      </summary>
2859 ## </param>
2860 #
2861 interface(`userdom_rw_user_tmpfs_files',`
2862         gen_require(`
2863                 type user_tmpfs_t;
2864         ')
2865
2866         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2867         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2868         allow $1 user_tmpfs_t:dir list_dir_perms;
2869         fs_search_tmpfs($1)
2870 ')
2871
2872 ########################################
2873 ## <summary>
2874 ##      Get the attributes of a user domain tty.
2875 ## </summary>
2876 ## <param name="domain">
2877 ##      <summary>
2878 ##      Domain allowed access.
2879 ##      </summary>
2880 ## </param>
2881 #
2882 interface(`userdom_getattr_user_ttys',`
2883         gen_require(`
2884                 type user_tty_device_t;
2885         ')
2886
2887         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2888 ')
2889
2890 ########################################
2891 ## <summary>
2892 ##      Do not audit attempts to get the attributes of a user domain tty.
2893 ## </summary>
2894 ## <param name="domain">
2895 ##      <summary>
2896 ##      Domain to not audit.
2897 ##      </summary>
2898 ## </param>
2899 #
2900 interface(`userdom_dontaudit_getattr_user_ttys',`
2901         gen_require(`
2902                 type user_tty_device_t;
2903         ')
2904
2905         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2906 ')
2907
2908 ########################################
2909 ## <summary>
2910 ##      Set the attributes of a user domain tty.
2911 ## </summary>
2912 ## <param name="domain">
2913 ##      <summary>
2914 ##      Domain allowed access.
2915 ##      </summary>
2916 ## </param>
2917 #
2918 interface(`userdom_setattr_user_ttys',`
2919         gen_require(`
2920                 type user_tty_device_t;
2921         ')
2922
2923         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2924 ')
2925
2926 ########################################
2927 ## <summary>
2928 ##      Do not audit attempts to set the attributes of a user domain tty.
2929 ## </summary>
2930 ## <param name="domain">
2931 ##      <summary>
2932 ##      Domain to not audit.
2933 ##      </summary>
2934 ## </param>
2935 #
2936 interface(`userdom_dontaudit_setattr_user_ttys',`
2937         gen_require(`
2938                 type user_tty_device_t;
2939         ')
2940
2941         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2942 ')
2943
2944 ########################################
2945 ## <summary>
2946 ##      Read and write a user domain tty.
2947 ## </summary>
2948 ## <param name="domain">
2949 ##      <summary>
2950 ##      Domain allowed access.
2951 ##      </summary>
2952 ## </param>
2953 #
2954 interface(`userdom_use_user_ttys',`
2955         gen_require(`
2956                 type user_tty_device_t;
2957         ')
2958
2959         allow $1 user_tty_device_t:chr_file rw_term_perms;
2960 ')
2961
2962 ########################################
2963 ## <summary>
2964 ##      Read and write a inherited user domain tty.
2965 ## </summary>
2966 ## <param name="domain">
2967 ##      <summary>
2968 ##      Domain allowed access.
2969 ##      </summary>
2970 ## </param>
2971 #
2972 interface(`userdom_use_inherited_user_ttys',`
2973         gen_require(`
2974                 type user_tty_device_t;
2975         ')
2976
2977         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2978 ')
2979
2980 ########################################
2981 ## <summary>
2982 ##      Read and write a user domain pty.
2983 ## </summary>
2984 ## <param name="domain">
2985 ##      <summary>
2986 ##      Domain allowed access.
2987 ##      </summary>
2988 ## </param>
2989 #
2990 interface(`userdom_use_user_ptys',`
2991         gen_require(`
2992                 type user_devpts_t;
2993         ')
2994
2995         allow $1 user_devpts_t:chr_file rw_term_perms;
2996 ')
2997
2998 ########################################
2999 ## <summary>
3000 ##      Read and write a inherited user domain pty.
3001 ## </summary>
3002 ## <param name="domain">
3003 ##      <summary>
3004 ##      Domain allowed access.
3005 ##      </summary>
3006 ## </param>
3007 #
3008 interface(`userdom_use_inherited_user_ptys',`
3009         gen_require(`
3010                 type user_devpts_t;
3011         ')
3012
3013         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3014 ')
3015
3016 ########################################
3017 ## <summary>
3018 ##      Read and write a inherited user TTYs and PTYs.
3019 ## </summary>
3020 ## <desc>
3021 ##      <p>
3022 ##      Allow the specified domain to read and write inherited user
3023 ##      TTYs and PTYs. This will allow the domain to
3024 ##      interact with the user via the terminal. Typically
3025 ##      all interactive applications will require this
3026 ##      access.
3027 ##      </p>
3028 ## </desc>
3029 ## <param name="domain">
3030 ##      <summary>
3031 ##      Domain allowed access.
3032 ##      </summary>
3033 ## </param>
3034 ## <infoflow type="both" weight="10"/>
3035 #
3036 interface(`userdom_use_inherited_user_terminals',`
3037         gen_require(`
3038                 type user_tty_device_t, user_devpts_t;
3039         ')
3040
3041         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3042         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3043 ')
3044
3045 #######################################
3046 ## <summary>
3047 ##  Allow attempts to read and write
3048 ##  a user domain tty and pty.
3049 ## </summary>
3050 ## <param name="domain">
3051 ##  <summary>
3052 ##  Domain to not audit.
3053 ##  </summary>
3054 ## </param>
3055 #
3056 interface(`userdom_use_user_terminals',`
3057     gen_require(`
3058         type user_tty_device_t, user_devpts_t;
3059     ')
3060
3061     allow $1 user_tty_device_t:chr_file rw_term_perms;
3062     allow $1 user_devpts_t:chr_file rw_term_perms;
3063 ')
3064
3065 ########################################
3066 ## <summary>
3067 ##      Do not audit attempts to read and write
3068 ##      a user domain tty and pty.
3069 ## </summary>
3070 ## <param name="domain">
3071 ##      <summary>
3072 ##      Domain to not audit.
3073 ##      </summary>
3074 ## </param>
3075 #
3076 interface(`userdom_dontaudit_use_user_terminals',`
3077         gen_require(`
3078                 type user_tty_device_t, user_devpts_t;
3079         ')
3080
3081         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3082         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3083 ')
3084
3085 ########################################
3086 ## <summary>
3087 ##      Execute a shell in all user domains.  This
3088 ##      is an explicit transition, requiring the
3089 ##      caller to use setexeccon().
3090 ## </summary>
3091 ## <param name="domain">
3092 ##      <summary>
3093 ##      Domain allowed to transition.
3094 ##      </summary>
3095 ## </param>
3096 #
3097 interface(`userdom_spec_domtrans_all_users',`
3098         gen_require(`
3099                 attribute userdomain;
3100         ')
3101
3102         corecmd_shell_spec_domtrans($1, userdomain)
3103         allow userdomain $1:fd use;
3104         allow userdomain $1:fifo_file rw_file_perms;
3105         allow userdomain $1:process sigchld;
3106 ')
3107
3108 ########################################
3109 ## <summary>
3110 ##      Execute an Xserver session in all unprivileged user domains.  This
3111 ##      is an explicit transition, requiring the
3112 ##      caller to use setexeccon().
3113 ## </summary>
3114 ## <param name="domain">
3115 ##      <summary>
3116 ##      Domain allowed to transition.
3117 ##      </summary>
3118 ## </param>
3119 #
3120 interface(`userdom_xsession_spec_domtrans_all_users',`
3121         gen_require(`
3122                 attribute userdomain;
3123         ')
3124
3125         xserver_xsession_spec_domtrans($1, userdomain)
3126         allow userdomain $1:fd use;
3127         allow userdomain $1:fifo_file rw_file_perms;
3128         allow userdomain $1:process sigchld;
3129 ')
3130
3131 ########################################
3132 ## <summary>
3133 ##      Execute a shell in all unprivileged user domains.  This
3134 ##      is an explicit transition, requiring the
3135 ##      caller to use setexeccon().
3136 ## </summary>
3137 ## <param name="domain">
3138 ##      <summary>
3139 ##      Domain allowed to transition.
3140 ##      </summary>
3141 ## </param>
3142 #
3143 interface(`userdom_spec_domtrans_unpriv_users',`
3144         gen_require(`
3145                 attribute unpriv_userdomain;
3146         ')
3147
3148         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3149         allow unpriv_userdomain $1:fd use;
3150         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3151         allow unpriv_userdomain $1:process sigchld;
3152 ')
3153
3154 ########################################
3155 ## <summary>
3156 ##      Execute an Xserver session in all unprivileged user domains.  This
3157 ##      is an explicit transition, requiring the
3158 ##      caller to use setexeccon().
3159 ## </summary>
3160 ## <param name="domain">
3161 ##      <summary>
3162 ##      Domain allowed to transition.
3163 ##      </summary>
3164 ## </param>
3165 #
3166 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3167         gen_require(`
3168                 attribute unpriv_userdomain;
3169         ')
3170
3171         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3172         allow unpriv_userdomain $1:fd use;
3173         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3174         allow unpriv_userdomain $1:process sigchld;
3175 ')
3176
3177 ########################################
3178 ## <summary>
3179 ##      Manage unpriviledged user SysV sempaphores.
3180 ## </summary>
3181 ## <param name="domain">
3182 ##      <summary>
3183 ##      Domain allowed access.
3184 ##      </summary>
3185 ## </param>
3186 #
3187 interface(`userdom_manage_unpriv_user_semaphores',`
3188         gen_require(`
3189                 attribute unpriv_userdomain;
3190         ')
3191
3192         allow $1 unpriv_userdomain:sem create_sem_perms;
3193 ')
3194
3195 ########################################
3196 ## <summary>
3197 ##      Manage unpriviledged user SysV shared
3198 ##      memory segments.
3199 ## </summary>
3200 ## <param name="domain">
3201 ##      <summary>
3202 ##      Domain allowed access.
3203 ##      </summary>
3204 ## </param>
3205 #
3206 interface(`userdom_manage_unpriv_user_shared_mem',`
3207         gen_require(`
3208                 attribute unpriv_userdomain;
3209         ')
3210
3211         allow $1 unpriv_userdomain:shm create_shm_perms;
3212 ')
3213
3214 ########################################
3215 ## <summary>
3216 ##      Execute bin_t in the unprivileged user domains. This
3217 ##      is an explicit transition, requiring the
3218 ##      caller to use setexeccon().
3219 ## </summary>
3220 ## <param name="domain">
3221 ##      <summary>
3222 ##      Domain allowed to transition.
3223 ##      </summary>
3224 ## </param>
3225 #
3226 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3227         gen_require(`
3228                 attribute unpriv_userdomain;
3229         ')
3230
3231         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3232         allow unpriv_userdomain $1:fd use;
3233         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3234         allow unpriv_userdomain $1:process sigchld;
3235 ')
3236
3237 ########################################
3238 ## <summary>
3239 ##      Execute all entrypoint files in unprivileged user
3240 ##      domains. This is an explicit transition, requiring the
3241 ##      caller to use setexeccon().
3242 ## </summary>
3243 ## <param name="domain">
3244 ##      <summary>
3245 ##      Domain allowed access.
3246 ##      </summary>
3247 ## </param>
3248 #
3249 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3250         gen_require(`
3251                 attribute unpriv_userdomain;
3252         ')
3253
3254         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3255         allow unpriv_userdomain $1:fd use;
3256         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3257         allow unpriv_userdomain $1:process sigchld;
3258 ')
3259
3260 ########################################
3261 ## <summary>
3262 ##      Search users home directories.
3263 ## </summary>
3264 ## <param name="domain">
3265 ##      <summary>
3266 ##      Domain allowed access.
3267 ##      </summary>
3268 ## </param>
3269 #
3270 interface(`userdom_search_user_home_content',`
3271         gen_require(`
3272                 type user_home_dir_t;
3273                 attribute user_home_type;
3274         ')
3275
3276         files_list_home($1)
3277         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3278         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3279 ')
3280
3281 ########################################
3282 ## <summary>
3283 ##      Send general signals to unprivileged user domains.
3284 ## </summary>
3285 ## <param name="domain">
3286 ##      <summary>
3287 ##      Domain allowed access.
3288 ##      </summary>
3289 ## </param>
3290 #
3291 interface(`userdom_signal_unpriv_users',`
3292         gen_require(`
3293                 attribute unpriv_userdomain;
3294         ')
3295
3296         allow $1 unpriv_userdomain:process signal;
3297 ')
3298
3299 ########################################
3300 ## <summary>
3301 ##      Inherit the file descriptors from unprivileged user domains.
3302 ## </summary>
3303 ## <param name="domain">
3304 ##      <summary>
3305 ##      Domain allowed access.
3306 ##      </summary>
3307 ## </param>
3308 #
3309 interface(`userdom_use_unpriv_users_fds',`
3310         gen_require(`
3311                 attribute unpriv_userdomain;
3312         ')
3313
3314         allow $1 unpriv_userdomain:fd use;
3315 ')
3316
3317 ########################################
3318 ## <summary>
3319 ##      Do not audit attempts to inherit the file descriptors
3320 ##      from unprivileged user domains.
3321 ## </summary>
3322 ## <desc>
3323 ##      <p>
3324 ##      Do not audit attempts to inherit the file descriptors
3325 ##      from unprivileged user domains. This will supress
3326 ##      SELinux denial messages when the specified domain is denied
3327 ##      the permission to inherit these file descriptors.
3328 ##      </p>
3329 ## </desc>
3330 ## <param name="domain">
3331 ##      <summary>
3332 ##      Domain to not audit.
3333 ##      </summary>
3334 ## </param>
3335 ## <infoflow type="none"/>
3336 #
3337 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3338         gen_require(`
3339                 attribute unpriv_userdomain;
3340         ')
3341
3342         dontaudit $1 unpriv_userdomain:fd use;
3343 ')
3344
3345 ########################################
3346 ## <summary>
3347 ##      Do not audit attempts to use user ptys.
3348 ## </summary>
3349 ## <param name="domain">
3350 ##      <summary>
3351 ##      Domain to not audit.
3352 ##      </summary>
3353 ## </param>
3354 #
3355 interface(`userdom_dontaudit_use_user_ptys',`
3356         gen_require(`
3357                 type user_devpts_t;
3358         ')
3359
3360         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3361 ')
3362
3363 ########################################
3364 ## <summary>
3365 ##      Relabel files to unprivileged user pty types.
3366 ## </summary>
3367 ## <param name="domain">
3368 ##      <summary>
3369 ##      Domain allowed access.
3370 ##      </summary>
3371 ## </param>
3372 #
3373 interface(`userdom_relabelto_user_ptys',`
3374         gen_require(`
3375                 type user_devpts_t;
3376         ')
3377
3378         allow $1 user_devpts_t:chr_file relabelto;
3379 ')
3380
3381 ########################################
3382 ## <summary>
3383 ##      Do not audit attempts to relabel files from
3384 ##      user pty types.
3385 ## </summary>
3386 ## <param name="domain">
3387 ##      <summary>
3388 ##      Domain to not audit.
3389 ##      </summary>
3390 ## </param>
3391 #
3392 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3393         gen_require(`
3394                 type user_devpts_t;
3395         ')
3396
3397         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3398 ')
3399
3400 ########################################
3401 ## <summary>
3402 ##      Write all users files in /tmp
3403 ## </summary>
3404 ## <param name="domain">
3405 ##      <summary>
3406 ##      Domain allowed access.
3407 ##      </summary>
3408 ## </param>
3409 #
3410 interface(`userdom_write_user_tmp_files',`
3411         gen_require(`
3412                 type user_tmp_t;
3413         ')
3414
3415         write_files_pattern($1, user_tmp_t, user_tmp_t)
3416 ')
3417
3418 ########################################
3419 ## <summary>
3420 ##      Do not audit attempts to write users
3421 ##      temporary files.
3422 ## </summary>
3423 ## <param name="domain">
3424 ##      <summary>
3425 ##      Domain to not audit.
3426 ##      </summary>
3427 ## </param>
3428 #
3429 interface(`userdom_dontaudit_write_user_tmp_files',`
3430         gen_require(`
3431                 type user_tmp_t;
3432         ')
3433
3434         dontaudit $1 user_tmp_t:file write;
3435 ')
3436
3437 ########################################
3438 ## <summary>
3439 ##      Do not audit attempts to read/write users
3440 ##      temporary fifo files.
3441 ## </summary>
3442 ## <param name="domain">
3443 ##      <summary>
3444 ##      Domain to not audit.
3445 ##      </summary>
3446 ## </param>
3447 #
3448 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3449         gen_require(`
3450                 type user_tmp_t;
3451         ')
3452
3453         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3454 ')
3455
3456 ########################################
3457 ## <summary>
3458 ##      Do not audit attempts to use user ttys.
3459 ## </summary>
3460 ## <param name="domain">
3461 ##      <summary>
3462 ##      Domain to not audit.
3463 ##      </summary>
3464 ## </param>
3465 #
3466 interface(`userdom_dontaudit_use_user_ttys',`
3467         gen_require(`
3468                 type user_tty_device_t;
3469         ')
3470
3471         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3472 ')
3473
3474 ########################################
3475 ## <summary>
3476 ##      Read the process state of all user domains.
3477 ## </summary>
3478 ## <param name="domain">
3479 ##      <summary>
3480 ##      Domain allowed access.
3481 ##      </summary>
3482 ## </param>
3483 #
3484 interface(`userdom_read_all_users_state',`
3485         gen_require(`
3486                 attribute userdomain;
3487         ')
3488
3489         read_files_pattern($1, userdomain, userdomain)
3490         read_lnk_files_pattern($1,userdomain,userdomain)
3491         kernel_search_proc($1)
3492 ')
3493
3494 ########################################
3495 ## <summary>
3496 ##      Get the attributes of all user domains.
3497 ## </summary>
3498 ## <param name="domain">
3499 ##      <summary>
3500 ##      Domain allowed access.
3501 ##      </summary>
3502 ## </param>
3503 #
3504 interface(`userdom_getattr_all_users',`
3505         gen_require(`
3506                 attribute userdomain;
3507         ')
3508
3509         allow $1 userdomain:process getattr;
3510 ')
3511
3512 ########################################
3513 ## <summary>
3514 ##      Inherit the file descriptors from all user domains
3515 ## </summary>
3516 ## <param name="domain">
3517 ##      <summary>
3518 ##      Domain allowed access.
3519 ##      </summary>
3520 ## </param>
3521 #
3522 interface(`userdom_use_all_users_fds',`
3523         gen_require(`
3524                 attribute userdomain;
3525         ')
3526
3527         allow $1 userdomain:fd use;
3528 ')
3529
3530 ########################################
3531 ## <summary>
3532 ##      Do not audit attempts to inherit the file
3533 ##      descriptors from any user domains.
3534 ## </summary>
3535 ## <param name="domain">
3536 ##      <summary>
3537 ##      Domain to not audit.
3538 ##      </summary>
3539 ## </param>
3540 #
3541 interface(`userdom_dontaudit_use_all_users_fds',`
3542         gen_require(`
3543                 attribute userdomain;
3544         ')
3545
3546         dontaudit $1 userdomain:fd use;
3547 ')
3548
3549 ########################################
3550 ## <summary>
3551 ##      Send general signals to all user domains.
3552 ## </summary>
3553 ## <param name="domain">
3554 ##      <summary>
3555 ##      Domain allowed access.
3556 ##      </summary>
3557 ## </param>
3558 #
3559 interface(`userdom_signal_all_users',`
3560         gen_require(`
3561                 attribute userdomain;
3562         ')
3563
3564         allow $1 userdomain:process signal;
3565 ')
3566
3567 ########################################
3568 ## <summary>
3569 ##      Send kill signals to all user domains.
3570 ## </summary>
3571 ## <param name="domain">
3572 ##      <summary>
3573 ##      Domain allowed access.
3574 ##      </summary>
3575 ## </param>
3576 #
3577 interface(`userdom_kill_all_users',`
3578         gen_require(`
3579                 attribute userdomain;
3580         ')
3581
3582         allow $1 userdomain:process sigkill;
3583 ')
3584
3585 ########################################
3586 ## <summary>
3587 ##      Send a SIGCHLD signal to all user domains.
3588 ## </summary>
3589 ## <param name="domain">
3590 ##      <summary>
3591 ##      Domain allowed access.
3592 ##      </summary>
3593 ## </param>
3594 #
3595 interface(`userdom_sigchld_all_users',`
3596         gen_require(`
3597                 attribute userdomain;
3598         ')
3599
3600         allow $1 userdomain:process sigchld;
3601 ')
3602
3603 ########################################
3604 ## <summary>
3605 ##      Create keys for all user domains.
3606 ## </summary>
3607 ## <param name="domain">
3608 ##      <summary>
3609 ##      Domain allowed access.
3610 ##      </summary>
3611 ## </param>
3612 #
3613 interface(`userdom_create_all_users_keys',`
3614         gen_require(`
3615                 attribute userdomain;
3616         ')
3617
3618         allow $1 userdomain:key create;
3619 ')
3620
3621 ########################################
3622 ## <summary>
3623 ##      Send a dbus message to all user domains.
3624 ## </summary>
3625 ## <param name="domain">
3626 ##      <summary>
3627 ##      Domain allowed access.
3628 ##      </summary>
3629 ## </param>
3630 #
3631 interface(`userdom_dbus_send_all_users',`
3632         gen_require(`
3633                 attribute userdomain;
3634                 class dbus send_msg;
3635         ')
3636
3637         allow $1 userdomain:dbus send_msg;
3638 ')
3639
3640 ########################################
3641 ## <summary>
3642 ##      Allow apps to set rlimits on userdomain
3643 ## </summary>
3644 ## <param name="domain">
3645 ##      <summary>
3646 ##      Domain allowed access.
3647 ##      </summary>
3648 ## </param>
3649 #
3650 interface(`userdom_set_rlimitnh',`
3651         gen_require(`
3652                 attribute userdomain;
3653         ')
3654
3655         allow $1 userdomain:process rlimitinh;
3656 ')
3657
3658 ########################################
3659 ## <summary>
3660 ##      Define this type as a Allow apps to set rlimits on userdomain
3661 ## </summary>
3662 ## <param name="domain">
3663 ##      <summary>
3664 ##      Domain allowed access.
3665 ##      </summary>
3666 ## </param>
3667 ## <param name="userdomain_prefix">
3668 ##      <summary>
3669 ##      The prefix of the user domain (e.g., user
3670 ##      is the prefix for user_t).
3671 ## </summary>
3672 ## </param>
3673 ## <param name="domain">
3674 ##      <summary>
3675 ##      Domain allowed access.
3676 ##      </summary>
3677 ## </param>
3678 #
3679 template(`userdom_unpriv_usertype',`
3680         gen_require(`
3681                 attribute unpriv_userdomain, userdomain;
3682                 attribute $1_usertype;
3683         ')
3684         typeattribute $2  $1_usertype;
3685         typeattribute $2  unpriv_userdomain;
3686         typeattribute $2  userdomain;
3687
3688         ubac_constrained($2)
3689 ')
3690
3691 ########################################
3692 ## <summary>
3693 ##      Connect to users over an unix stream socket.
3694 ## </summary>
3695 ## <param name="domain">
3696 ##      <summary>
3697 ##      Domain allowed access.
3698 ##      </summary>
3699 ## </param>
3700 #
3701 interface(`userdom_stream_connect',`
3702         gen_require(`
3703                 type user_tmp_t;
3704                 attribute userdomain;
3705         ')
3706
3707         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3708 ')
3709
3710 ########################################
3711 ## <summary>
3712 ##      Ptrace user domains.
3713 ## </summary>
3714 ## <param name="domain">
3715 ##      <summary>
3716 ##      Domain allowed access.
3717 ##      </summary>
3718 ## </param>
3719 #
3720 interface(`userdom_ptrace_all_users',`
3721         gen_require(`
3722                 attribute userdomain;
3723         ')
3724
3725         allow $1 userdomain:process ptrace;
3726 ')
3727
3728 ########################################
3729 ## <summary>
3730 ##      dontaudit Search /root
3731 ## </summary>
3732 ## <param name="domain">
3733 ##      <summary>
3734 ##      Domain to not audit.
3735 ##      </summary>
3736 ## </param>
3737 #
3738 interface(`userdom_dontaudit_search_admin_dir',`
3739         gen_require(`
3740                 type admin_home_t;
3741         ')
3742
3743         dontaudit $1 admin_home_t:dir search_dir_perms;
3744 ')
3745
3746 ########################################
3747 ## <summary>
3748 ##      dontaudit list /root
3749 ## </summary>
3750 ## <param name="domain">
3751 ##      <summary>
3752 ##      Domain to not audit.
3753 ##      </summary>
3754 ## </param>
3755 #
3756 interface(`userdom_dontaudit_list_admin_dir',`
3757         gen_require(`
3758                 type admin_home_t;
3759         ')
3760
3761         dontaudit $1 admin_home_t:dir list_dir_perms;
3762 ')
3763
3764 ########################################
3765 ## <summary>
3766 ##      Allow domain to  list /root
3767 ## </summary>
3768 ## <param name="domain">
3769 ##      <summary>
3770 ##      Domain allowed access.
3771 ##      </summary>
3772 ## </param>
3773 #
3774 interface(`userdom_list_admin_dir',`
3775         gen_require(`
3776                 type admin_home_t;
3777         ')
3778
3779         allow $1 admin_home_t:dir list_dir_perms;
3780 ')
3781
3782 ########################################
3783 ## <summary>
3784 ##      Allow Search /root
3785 ## </summary>
3786 ## <param name="domain">
3787 ##      <summary>
3788 ##      Domain allowed access.
3789 ##      </summary>
3790 ## </param>
3791 #
3792 interface(`userdom_search_admin_dir',`
3793         gen_require(`
3794                 type admin_home_t;
3795         ')
3796
3797         allow $1 admin_home_t:dir search_dir_perms;
3798 ')
3799
3800 ########################################
3801 ## <summary>
3802 ##      RW unpriviledged user SysV sempaphores.
3803 ## </summary>
3804 ## <param name="domain">
3805 ##      <summary>
3806 ##      Domain allowed access.
3807 ##      </summary>
3808 ## </param>
3809 #
3810 interface(`userdom_rw_semaphores',`
3811         gen_require(`
3812                 attribute unpriv_userdomain;
3813         ')
3814
3815         allow $1 unpriv_userdomain:sem rw_sem_perms;
3816 ')
3817
3818 ########################################
3819 ## <summary>
3820 ##      Send a message to unpriv users over a unix domain
3821 ##      datagram socket.
3822 ## </summary>
3823 ## <param name="domain">
3824 ##      <summary>
3825 ##      Domain allowed access.
3826 ##      </summary>
3827 ## </param>
3828 #
3829 interface(`userdom_dgram_send',`
3830         gen_require(`
3831                 attribute unpriv_userdomain;
3832         ')
3833
3834         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3835 ')
3836
3837 ######################################
3838 ## <summary>
3839 ##      Send a message to users over a unix domain
3840 ##      datagram socket.
3841 ## </summary>
3842 ## <param name="domain">
3843 ##      <summary>
3844 ##      Domain allowed access.
3845 ##      </summary>
3846 ## </param>
3847 #
3848 interface(`userdom_users_dgram_send',`
3849         gen_require(`
3850                  attribute userdomain;
3851       ')
3852
3853        allow $1 userdomain:unix_dgram_socket sendto;
3854 ')
3855
3856 #######################################
3857 ## <summary>
3858 ##      Allow execmod on files in homedirectory
3859 ## </summary>
3860 ## <param name="domain">
3861 ##      <summary>
3862 ##      Domain allowed access.
3863 ##      </summary>
3864 ## </param>
3865 ## <rolebase/>
3866 #
3867 interface(`userdom_execmod_user_home_files',`
3868         gen_require(`
3869                 type user_home_type;
3870         ')
3871
3872         allow $1 user_home_type:file execmod;
3873 ')
3874
3875 ########################################
3876 ## <summary>
3877 ##      Read admin home files.
3878 ## </summary>
3879 ## <param name="domain">
3880 ##      <summary>
3881 ##      Domain allowed access.
3882 ##      </summary>
3883 ## </param>
3884 ## <rolecap/>
3885 #
3886 interface(`userdom_read_admin_home_files',`
3887         gen_require(`
3888                 type admin_home_t;
3889         ')
3890
3891         read_files_pattern($1, admin_home_t, admin_home_t)
3892 ')
3893
3894 ########################################
3895 ## <summary>
3896 ##      Execute admin home files.
3897 ## </summary>
3898 ## <param name="domain">
3899 ##      <summary>
3900 ##      Domain allowed access.
3901 ##      </summary>
3902 ## </param>
3903 ## <rolecap/>
3904 #
3905 interface(`userdom_exec_admin_home_files',`
3906         gen_require(`
3907                 type admin_home_t;
3908         ')
3909
3910         exec_files_pattern($1, admin_home_t, admin_home_t)
3911 ')
3912
3913 ########################################
3914 ## <summary>
3915 ##      Append files inherited
3916 ##      in the /root directory.
3917 ## </summary>
3918 ## <param name="domain">
3919 ##      <summary>
3920 ##      Domain allowed access.
3921 ##      </summary>
3922 ## </param>
3923 #
3924 interface(`userdom_inherit_append_admin_home_files',`
3925         gen_require(`
3926                 type admin_home_t;
3927         ')
3928
3929         allow $1 admin_home_t:file { getattr append };
3930 ')
3931
3932
3933 #######################################
3934 ## <summary>
3935 ##      Manage all files/directories in the homedir
3936 ## </summary>
3937 ## <param name="userdomain">
3938 ##      <summary>
3939 ##      The user domain
3940 ##      </summary>
3941 ## </param>
3942 ## <rolebase/>
3943 #
3944 interface(`userdom_manage_user_home_content',`
3945         gen_require(`
3946                 type user_home_dir_t, user_home_t;
3947                 attribute user_home_type;
3948         ')
3949
3950         files_list_home($1)
3951         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3952         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3953         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3954         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3955         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3956         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3957
3958 ')
3959
3960
3961 ########################################
3962 ## <summary>
3963 ##      Create objects in a user home directory
3964 ##      with an automatic type transition to
3965 ##      the user home file type.
3966 ## </summary>
3967 ## <param name="domain">
3968 ##      <summary>
3969 ##      Domain allowed access.
3970 ##      </summary>
3971 ## </param>
3972 ## <param name="object_class">
3973 ##      <summary>
3974 ##      The class of the object to be created.
3975 ##      </summary>
3976 ## </param>
3977 #
3978 interface(`userdom_user_home_dir_filetrans_pattern',`
3979         gen_require(`
3980                 type user_home_dir_t, user_home_t;
3981         ')
3982
3983         type_transition $1 user_home_dir_t:$2 user_home_t;
3984 ')
3985
3986 ########################################
3987 ## <summary>
3988 ##      Create objects in the /root directory
3989 ##      with an automatic type transition to
3990 ##      a specified private type.
3991 ## </summary>
3992 ## <param name="domain">
3993 ##      <summary>
3994 ##      Domain allowed access.
3995 ##      </summary>
3996 ## </param>
3997 ## <param name="private_type">
3998 ##      <summary>
3999 ##      The type of the object to create.
4000 ##      </summary>
4001 ## </param>
4002 ## <param name="object_class">
4003 ##      <summary>
4004 ##      The class of the object to be created.
4005 ##      </summary>
4006 ## </param>
4007 #
4008 interface(`userdom_admin_home_dir_filetrans',`
4009         gen_require(`
4010                 type admin_home_t;
4011         ')
4012
4013         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4014 ')
4015
4016 ########################################
4017 ## <summary>
4018 ##      Send signull to unprivileged user domains.
4019 ## </summary>
4020 ## <param name="domain">
4021 ##      <summary>
4022 ##      Domain allowed access.
4023 ##      </summary>
4024 ## </param>
4025 #
4026 interface(`userdom_signull_unpriv_users',`
4027         gen_require(`
4028                 attribute unpriv_userdomain;
4029         ')
4030
4031         allow $1 unpriv_userdomain:process signull;
4032 ')
4033
4034 ########################################
4035 ## <summary>
4036 ##      Write all users files in /tmp
4037 ## </summary>
4038 ## <param name="domain">
4039 ##      <summary>
4040 ##      Domain allowed access.
4041 ##      </summary>
4042 ## </param>
4043 #
4044 interface(`userdom_write_user_tmp_dirs',`
4045         gen_require(`
4046                 type user_tmp_t;
4047         ')
4048
4049         write_files_pattern($1, user_tmp_t, user_tmp_t)
4050 ')
4051
4052 ########################################
4053 ## <summary>
4054 ##      Manage keys for all user domains.
4055 ## </summary>
4056 ## <param name="domain">
4057 ##      <summary>
4058 ##      Domain allowed access.
4059 ##      </summary>
4060 ## </param>
4061 #
4062 interface(`userdom_manage_all_users_keys',`
4063         gen_require(`
4064                 attribute userdomain;
4065         ')
4066
4067         allow $1 userdomain:key manage_key_perms;
4068 ')
4069
4070
4071 ########################################
4072 ## <summary>
4073 ##      Do not audit attempts to read and write
4074 ##      unserdomain stream.
4075 ## </summary>
4076 ## <param name="domain">
4077 ##      <summary>
4078 ##      Domain to not audit.
4079 ##      </summary>
4080 ## </param>
4081 #
4082 interface(`userdom_dontaudit_rw_stream',`
4083         gen_require(`
4084                 attribute userdomain;
4085         ')
4086
4087         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4088 ')
4089
4090 ########################################
4091 ## <summary>
4092 ##      Do not audit attempts to read and write
4093 ##      unserdomain datagram socket.
4094 ## </summary>
4095 ## <param name="domain">
4096 ##      <summary>
4097 ##      Domain to not audit.
4098 ##      </summary>
4099 ## </param>
4100 #
4101 interface(`userdom_dontaudit_rw_dgram_socket',`
4102         gen_require(`
4103                 attribute userdomain;
4104         ')
4105
4106         dontaudit $1 userdomain:unix_dgram_socket { read write };
4107 ')
4108
4109 ########################################
4110 ## <summary>
4111 ##      Append files
4112 ##      in a user home subdirectory.
4113 ## </summary>
4114 ## <param name="domain">
4115 ##      <summary>
4116 ##      Domain allowed access.
4117 ##      </summary>
4118 ## </param>
4119 #
4120 interface(`userdom_append_user_home_content_files',`
4121         gen_require(`
4122                 type user_home_dir_t, user_home_t;
4123         ')
4124
4125         append_files_pattern($1, user_home_t, user_home_t)
4126         allow $1 user_home_dir_t:dir search_dir_perms;
4127         files_search_home($1)
4128 ')
4129
4130 ########################################
4131 ## <summary>
4132 ##      Read files inherited
4133 ##      in a user home subdirectory.
4134 ## </summary>
4135 ## <param name="domain">
4136 ##      <summary>
4137 ##      Domain allowed access.
4138 ##      </summary>
4139 ## </param>
4140 #
4141 interface(`userdom_read_inherited_user_home_content_files',`
4142         gen_require(`
4143                 attribute user_home_type;
4144         ')
4145
4146         allow $1 user_home_type:file { getattr read };
4147 ')
4148
4149 ########################################
4150 ## <summary>
4151 ##      Append files inherited
4152 ##      in a user home subdirectory.
4153 ## </summary>
4154 ## <param name="domain">
4155 ##      <summary>
4156 ##      Domain allowed access.
4157 ##      </summary>
4158 ## </param>
4159 #
4160 interface(`userdom_inherit_append_user_home_content_files',`
4161         gen_require(`
4162                 type user_home_t;
4163         ')
4164
4165         allow $1 user_home_t:file { getattr append };
4166 ')
4167
4168 ########################################
4169 ## <summary>
4170 ##      Append files inherited
4171 ##      in a user tmp files.
4172 ## </summary>
4173 ## <param name="domain">
4174 ##      <summary>
4175 ##      Domain allowed access.
4176 ##      </summary>
4177 ## </param>
4178 #
4179 interface(`userdom_inherit_append_user_tmp_files',`
4180         gen_require(`
4181                 type user_tmp_t;
4182         ')
4183
4184         allow $1 user_tmp_t:file { getattr append };
4185 ')
4186
4187 ######################################
4188 ## <summary>
4189 ##      Read audio files in the users homedir.
4190 ## </summary>
4191 ## <param name="domain">
4192 ##      <summary>
4193 ##      Domain allowed access.
4194 ##      </summary>
4195 ## </param>
4196 ## <rolecap/>
4197 #
4198 interface(`userdom_read_home_audio_files',`
4199         gen_require(`
4200                 type audio_home_t;
4201         ')
4202
4203         userdom_search_user_home_dirs($1)
4204         allow $1 audio_home_t:dir list_dir_perms;
4205         read_files_pattern($1, audio_home_t, audio_home_t)
4206         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4207 ')
4208
4209 ########################################
4210 ## <summary>
4211 ##      Do not audit attempts to write all user home content files.
4212 ## </summary>
4213 ## <param name="domain">
4214 ##      <summary>
4215 ##      Domain to not audit.
4216 ##      </summary>
4217 ## </param>
4218 #
4219 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4220         gen_require(`
4221                 attribute user_home_type;
4222         ')
4223
4224         dontaudit $1 user_home_type:file write_file_perms;
4225 ')
4226
4227 ########################################
4228 ## <summary>
4229 ##      Do not audit attempts to write all user tmp content files.
4230 ## </summary>
4231 ## <param name="domain">
4232 ##      <summary>
4233 ##      Domain to not audit.
4234 ##      </summary>
4235 ## </param>
4236 #
4237 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4238         gen_require(`
4239                 attribute user_tmp_type;
4240         ')
4241
4242         dontaudit $1 user_tmp_type:file write_file_perms;
4243 ')
4244
4245 ########################################
4246 ## <summary>
4247 ##      Manage all user temporary content.
4248 ## </summary>
4249 ## <param name="domain">
4250 ##      <summary>
4251 ##      Domain allowed access.
4252 ##      </summary>
4253 ## </param>
4254 #
4255 interface(`userdom_manage_all_user_tmp_content',`
4256         gen_require(`
4257                 attribute user_tmp_type;
4258         ')
4259
4260         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4261         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4262         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4263         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4264         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4265         files_search_tmp($1)
4266 ')
4267
4268 ########################################
4269 ## <summary>
4270 ##      List all user temporary content.
4271 ## </summary>
4272 ## <param name="domain">
4273 ##      <summary>
4274 ##      Domain allowed access.
4275 ##      </summary>
4276 ## </param>
4277 #
4278 interface(`userdom_list_all_user_tmp_content',`
4279         gen_require(`
4280                 attribute user_tmp_type;
4281         ')
4282
4283         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4284         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4285         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4286         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4287         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4288         files_search_var($1)
4289         files_search_tmp($1)
4290 ')
4291
4292 ########################################
4293 ## <summary>
4294 ##      Manage all user tmpfs content.
4295 ## </summary>
4296 ## <param name="domain">
4297 ##      <summary>
4298 ##      Domain allowed access.
4299 ##      </summary>
4300 ## </param>
4301 #
4302 interface(`userdom_manage_all_user_tmpfs_content',`
4303         gen_require(`
4304                 attribute user_tmpfs_type;
4305         ')
4306
4307         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4308         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4309         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4310         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4311         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4312         fs_search_tmpfs($1)
4313 ')
4314
4315 ########################################
4316 ## <summary>
4317 ##      Delete all user temporary content.
4318 ## </summary>
4319 ## <param name="domain">
4320 ##      <summary>
4321 ##      Domain allowed access.
4322 ##      </summary>
4323 ## </param>
4324 #
4325 interface(`userdom_delete_all_user_tmp_content',`
4326         gen_require(`
4327                 attribute user_tmp_type;
4328         ')
4329
4330         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4331         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4332         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4333         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4334         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4335         # /var/tmp
4336         files_search_var($1)
4337         files_delete_tmp_dir_entry($1)
4338 ')
4339
4340 ########################################
4341 ## <summary>
4342 ##      Read system SSL certificates in the users homedir.
4343 ## </summary>
4344 ## <param name="domain">
4345 ##      <summary>
4346 ##      Domain allowed access.
4347 ##      </summary>
4348 ## </param>
4349 #
4350 interface(`userdom_read_home_certs',`
4351         gen_require(`
4352                 type home_cert_t;
4353         ')
4354
4355         userdom_search_user_home_content($1)
4356         allow $1 home_cert_t:dir list_dir_perms;
4357         read_files_pattern($1, home_cert_t, home_cert_t)
4358         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4359 ')
4360
4361 #######################################
4362 ## <summary>
4363 ##  Dontaudit Write system SSL certificates in the users homedir.
4364 ## </summary>
4365 ## <param name="domain">
4366 ##  <summary>
4367 ##      Domain to not audit.
4368 ##  </summary>
4369 ## </param>
4370 #
4371 interface(`userdom_dontaudit_write_home_certs',`
4372     gen_require(`
4373         type home_cert_t;
4374     ')
4375
4376     dontaudit $1 home_cert_t:file write;
4377 ')
4378
4379 ########################################
4380 ## <summary>
4381 ##      dontaudit Search getatrr /root files
4382 ## </summary>
4383 ## <param name="domain">
4384 ##      <summary>
4385 ##      Domain to not audit.
4386 ##      </summary>
4387 ## </param>
4388 #
4389 interface(`userdom_dontaudit_getattr_admin_home_files',`
4390         gen_require(`
4391                 type admin_home_t;
4392         ')
4393
4394         dontaudit $1 admin_home_t:file getattr;
4395 ')
4396
4397 ########################################
4398 ## <summary>
4399 ##      dontaudit read /root lnk files
4400 ## </summary>
4401 ## <param name="domain">
4402 ##      <summary>
4403 ##      Domain to not audit.
4404 ##      </summary>
4405 ## </param>
4406 #
4407 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4408         gen_require(`
4409                 type admin_home_t;
4410         ')
4411
4412         dontaudit $1 admin_home_t:lnk_file read;
4413 ')
4414
4415 ########################################
4416 ## <summary>
4417 ##      dontaudit read /root files
4418 ## </summary>
4419 ## <param name="domain">
4420 ##      <summary>
4421 ##      Domain to not audit.
4422 ##      </summary>
4423 ## </param>
4424 #
4425 interface(`userdom_dontaudit_read_admin_home_files',`
4426         gen_require(`
4427                 type admin_home_t;
4428         ')
4429
4430         dontaudit $1 admin_home_t:file read_file_perms;
4431 ')
4432
4433 ########################################
4434 ## <summary>
4435 ##      Create, read, write, and delete user
4436 ##      temporary chr files.
4437 ## </summary>
4438 ## <param name="domain">
4439 ##      <summary>
4440 ##      Domain allowed access.
4441 ##      </summary>
4442 ## </param>
4443 #
4444 interface(`userdom_manage_user_tmp_chr_files',`
4445         gen_require(`
4446                 type user_tmp_t;
4447         ')
4448
4449         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4450         files_search_tmp($1)
4451 ')
4452
4453 ########################################
4454 ## <summary>
4455 ##      Create, read, write, and delete user
4456 ##      temporary blk files.
4457 ## </summary>
4458 ## <param name="domain">
4459 ##      <summary>
4460 ##      Domain allowed access.
4461 ##      </summary>
4462 ## </param>
4463 #
4464 interface(`userdom_manage_user_tmp_blk_files',`
4465         gen_require(`
4466                 type user_tmp_t;
4467         ')
4468
4469         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4470         files_search_tmp($1)
4471 ')
4472
4473 ########################################
4474 ## <summary>
4475 ##      Dontaudit attempt to set attributes on  user temporary directories.
4476 ## </summary>
4477 ## <param name="domain">
4478 ##      <summary>
4479 ##      Domain to not audit.
4480 ##      </summary>
4481 ## </param>
4482 #
4483 interface(`userdom_dontaudit_setattr_user_tmp',`
4484         gen_require(`
4485                 type user_tmp_t;
4486         ')
4487
4488         dontaudit $1 user_tmp_t:dir setattr;
4489 ')
4490
4491 ########################################
4492 ## <summary>
4493 ##      Write all inherited users files in /tmp
4494 ## </summary>
4495 ## <param name="domain">
4496 ##      <summary>
4497 ##      Domain allowed access.
4498 ##      </summary>
4499 ## </param>
4500 #
4501 interface(`userdom_write_inherited_user_tmp_files',`
4502         gen_require(`
4503                 type user_tmp_t;
4504         ')
4505
4506         allow $1 user_tmp_t:file write;
4507 ')
4508
4509 ########################################
4510 ## <summary>
4511 ##      Delete all users files in /tmp
4512 ## </summary>
4513 ## <param name="domain">
4514 ##      <summary>
4515 ##      Domain allowed access.
4516 ##      </summary>
4517 ## </param>
4518 #
4519 interface(`userdom_delete_user_tmp_files',`
4520         gen_require(`
4521                 type user_tmp_t;
4522         ')
4523
4524         allow $1 user_tmp_t:file delete_file_perms;
4525 ')
4526
4527 ########################################
4528 ## <summary>
4529 ##      Delete user tmpfs files.
4530 ## </summary>
4531 ## <param name="domain">
4532 ##      <summary>
4533 ##      Domain allowed access.
4534 ##      </summary>
4535 ## </param>
4536 #
4537 interface(`userdom_delete_user_tmpfs_files',`
4538         gen_require(`
4539                 type user_tmpfs_t;
4540         ')
4541
4542         allow $1 user_tmpfs_t:file delete_file_perms;
4543 ')
4544
4545 ########################################
4546 ## <summary>
4547 ##      Read/Write unpriviledged user SysV shared
4548 ##      memory segments.
4549 ## </summary>
4550 ## <param name="domain">
4551 ##      <summary>
4552 ##      Domain allowed access.
4553 ##      </summary>
4554 ## </param>
4555 #
4556 interface(`userdom_rw_unpriv_user_shared_mem',`
4557         gen_require(`
4558                 attribute unpriv_userdomain;
4559         ')
4560
4561         allow $1 unpriv_userdomain:shm rw_shm_perms;
4562 ')
4563
4564 ########################################
4565 ## <summary>
4566 ##      Do not audit attempts to search user
4567 ##      temporary directories.
4568 ## </summary>
4569 ## <param name="domain">
4570 ##      <summary>
4571 ##      Domain to not audit.
4572 ##      </summary>
4573 ## </param>
4574 #
4575 interface(`userdom_dontaudit_search_user_tmp',`
4576         gen_require(`
4577                 type user_tmp_t;
4578         ')
4579
4580         dontaudit $1 user_tmp_t:dir search_dir_perms;
4581 ')
4582
4583 ########################################
4584 ## <summary>
4585 ##      Execute a file in a user home directory
4586 ##      in the specified domain.
4587 ## </summary>
4588 ## <desc>
4589 ##      <p>
4590 ##      Execute a file in a user home directory
4591 ##      in the specified domain.
4592 ##      </p>
4593 ##      <p>
4594 ##      No interprocess communication (signals, pipes,
4595 ##      etc.) is provided by this interface since
4596 ##      the domains are not owned by this module.
4597 ##      </p>
4598 ## </desc>
4599 ## <param name="domain">
4600 ##      <summary>
4601 ##      Domain allowed access.
4602 ##      </summary>
4603 ## </param>
4604 ## <param name="target_domain">
4605 ##      <summary>
4606 ##      The type of the new process.
4607 ##      </summary>
4608 ## </param>
4609 #
4610 interface(`userdom_domtrans_user_home',`
4611         gen_require(`
4612                 type user_home_t;
4613         ')
4614
4615         read_lnk_files_pattern($1, user_home_t, user_home_t)
4616         domain_transition_pattern($1, user_home_t, $2)
4617         type_transition $1 user_home_t:process $2;
4618 ')
4619
4620 ########################################
4621 ## <summary>
4622 ##      Execute a file in a user tmp directory
4623 ##      in the specified domain.
4624 ## </summary>
4625 ## <desc>
4626 ##      <p>
4627 ##      Execute a file in a user tmp directory
4628 ##      in the specified domain.
4629 ##      </p>
4630 ##      <p>
4631 ##      No interprocess communication (signals, pipes,
4632 ##      etc.) is provided by this interface since
4633 ##      the domains are not owned by this module.
4634 ##      </p>
4635 ## </desc>
4636 ## <param name="domain">
4637 ##      <summary>
4638 ##      Domain allowed access.
4639 ##      </summary>
4640 ## </param>
4641 ## <param name="target_domain">
4642 ##      <summary>
4643 ##      The type of the new process.
4644 ##      </summary>
4645 ## </param>
4646 #
4647 interface(`userdom_domtrans_user_tmp',`
4648         gen_require(`
4649                 type user_tmp_t;
4650         ')
4651
4652         files_search_tmp($1)
4653         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4654         domain_transition_pattern($1, user_tmp_t, $2)
4655         type_transition $1 user_tmp_t:process $2;
4656 ')
4657
4658 ########################################
4659 ## <summary>
4660 ##      Do not audit attempts to read all user home content files.
4661 ## </summary>
4662 ## <param name="domain">
4663 ##      <summary>
4664 ##      Domain to not audit.
4665 ##      </summary>
4666 ## </param>
4667 #
4668 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4669         gen_require(`
4670                 attribute user_home_type;
4671         ')
4672
4673         dontaudit $1 user_home_type:file read_file_perms;
4674 ')
4675
4676 ########################################
4677 ## <summary>
4678 ##      Do not audit attempts to read all user tmp content files.
4679 ## </summary>
4680 ## <param name="domain">
4681 ##      <summary>
4682 ##      Domain to not audit.
4683 ##      </summary>
4684 ## </param>
4685 #
4686 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4687         gen_require(`
4688                 attribute user_tmp_type;
4689         ')
4690
4691         dontaudit $1 user_tmp_type:file read_file_perms;
4692 ')
4693