policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 abrt_stream_connect($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 fs_list_cgroup_dirs($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 ssh_rw_stream_sockets($1_usertype)
 165                 ssh_delete_tmp($1_t)
 166                 ssh_signal($1_t)
 167         ')
 168 ')
 169
 170 #######################################
 171 ## <summary>
 172 ##      Allow a home directory for which the
 173 ##      role has read-only access.
 174 ## </summary>
 175 ## <desc>
 176 ##      <p>
 177 ##      Allow a home directory for which the
 178 ##      role has read-only access.
 179 ##      </p>
 180 ##      <p>
 181 ##      This does not allow execute access.
 182 ##      </p>
 183 ## </desc>
 184 ## <param name="role">
 185 ##      <summary>
 186 ##      The user role
 187 ##      </summary>
 188 ## </param>
 189 ## <param name="userdomain">
 190 ##      <summary>
 191 ##      The user domain
 192 ##      </summary>
 193 ## </param>
 194 ## <rolebase/>
 195 #
 196 interface(`userdom_ro_home_role',`
 197         gen_require(`
 198                 type user_home_t, user_home_dir_t;
 199         ')
 200
 201         role $1 types { user_home_t user_home_dir_t };
 202
 203         ##############################
 204         #
 205         # Domain access to home dir
 206         #
 207
 208         type_member $2 user_home_dir_t:dir user_home_dir_t;
 209
 210         # read-only home directory
 211         allow $2 user_home_dir_t:dir list_dir_perms;
 212         allow $2 user_home_t:dir list_dir_perms;
 213         allow $2 user_home_t:file entrypoint;
 214         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 215         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 216         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 217         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 218         files_list_home($2)
 219
 220 ')
 221
 222 #######################################
 223 ## <summary>
 224 ##      Allow a home directory for which the
 225 ##      role has full access.
 226 ## </summary>
 227 ## <desc>
 228 ##      <p>
 229 ##      Allow a home directory for which the
 230 ##      role has full access.
 231 ##      </p>
 232 ##      <p>
 233 ##      This does not allow execute access.
 234 ##      </p>
 235 ## </desc>
 236 ## <param name="role">
 237 ##      <summary>
 238 ##      The user role
 239 ##      </summary>
 240 ## </param>
 241 ## <param name="userdomain">
 242 ##      <summary>
 243 ##      The user domain
 244 ##      </summary>
 245 ## </param>
 246 ## <rolebase/>
 247 #
 248 interface(`userdom_manage_home_role',`
 249         gen_require(`
 250                 type user_home_t, user_home_dir_t;
 251                 attribute user_home_type;
 252         ')
 253
 254         role $1 types { user_home_type user_home_dir_t };
 255
 256         ##############################
 257         #
 258         # Domain access to home dir
 259         #
 260
 261         type_member $2 user_home_dir_t:dir user_home_dir_t;
 262
 263         # full control of the home directory
 264         allow $2 user_home_t:dir mounton;
 265         allow $2 user_home_t:file entrypoint;
 266
 267         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 268         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 269         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 280         files_list_home($2)
 281
 282         # cjp: this should probably be removed:
 283         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 284
 285         tunable_policy(`use_nfs_home_dirs',`
 286                 fs_mount_nfs($2)
 287                 fs_mounton_nfs($2)
 288                 fs_manage_nfs_dirs($2)
 289                 fs_manage_nfs_files($2)
 290                 fs_manage_nfs_symlinks($2)
 291                 fs_manage_nfs_named_sockets($2)
 292                 fs_manage_nfs_named_pipes($2)
 293         ')
 294
 295         tunable_policy(`use_samba_home_dirs',`
 296                 fs_mount_cifs($2)
 297                 fs_mounton_cifs($2)
 298                 fs_manage_cifs_dirs($2)
 299                 fs_manage_cifs_files($2)
 300                 fs_manage_cifs_symlinks($2)
 301                 fs_manage_cifs_named_sockets($2)
 302                 fs_manage_cifs_named_pipes($2)
 303         ')
 304 ')
 305
 306 #######################################
 307 ## <summary>
 308 ##      Manage user temporary files
 309 ## </summary>
 310 ## <param name="role">
 311 ##      <summary>
 312 ##      Role allowed access.
 313 ##      </summary>
 314 ## </param>
 315 ## <param name="domain">
 316 ##      <summary>
 317 ##      Domain allowed access.
 318 ##      </summary>
 319 ## </param>
 320 ## <rolebase/>
 321 #
 322 interface(`userdom_manage_tmp_role',`
 323         gen_require(`
 324                 attribute user_tmp_type;
 325                 type user_tmp_t;
 326         ')
 327
 328         role $1 types user_tmp_t;
 329
 330         files_poly_member_tmp($2, user_tmp_t)
 331
 332         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 333         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 334         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 335         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 336         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 337         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 338         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 339         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 340         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 341         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 342         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 343 ')
 344
 345 #######################################
 346 ## <summary>
 347 ##      Dontaudit search of user bin dirs.
 348 ## </summary>
 349 ## <param name="domain">
 350 ##      <summary>
 351 ##      Domain to not audit.
 352 ##      </summary>
 353 ## </param>
 354 #
 355 interface(`userdom_dontaudit_search_user_bin_dirs',`
 356         gen_require(`
 357                 type home_bin_t;
 358         ')
 359
 360         dontaudit $1 home_bin_t:dir search_dir_perms;
 361 ')
 362
 363 #######################################
 364 ## <summary>
 365 ##      Execute user bin files.
 366 ## </summary>
 367 ## <param name="domain">
 368 ##      <summary>
 369 ##      Domain allowed access.
 370 ##      </summary>
 371 ## </param>
 372 #
 373 interface(`userdom_exec_user_bin_files',`
 374         gen_require(`
 375                 attribute user_home_type;
 376                 type home_bin_t, user_home_dir_t;
 377         ')
 378
 379         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 380         files_search_home($1)
 381 ')
 382
 383 #######################################
 384 ## <summary>
 385 ##      The execute access user temporary files.
 386 ## </summary>
 387 ## <param name="domain">
 388 ##      <summary>
 389 ##      Domain allowed access.
 390 ##      </summary>
 391 ## </param>
 392 ## <rolebase/>
 393 #
 394 interface(`userdom_exec_user_tmp_files',`
 395         gen_require(`
 396                 type user_tmp_t;
 397         ')
 398
 399         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 400         dontaudit $1 user_tmp_t:sock_file execute;
 401         files_search_tmp($1)
 402 ')
 403
 404 #######################################
 405 ## <summary>
 406 ##      Role access for the user tmpfs type
 407 ##      that the user has full access.
 408 ## </summary>
 409 ## <desc>
 410 ##      <p>
 411 ##      Role access for the user tmpfs type
 412 ##      that the user has full access.
 413 ##      </p>
 414 ##      <p>
 415 ##      This does not allow execute access.
 416 ##      </p>
 417 ## </desc>
 418 ## <param name="role">
 419 ##      <summary>
 420 ##      Role allowed access.
 421 ##      </summary>
 422 ## </param>
 423 ## <param name="domain">
 424 ##      <summary>
 425 ##      Domain allowed access.
 426 ##      </summary>
 427 ## </param>
 428 ## <rolecap/>
 429 #
 430 interface(`userdom_manage_tmpfs_role',`
 431         gen_require(`
 432                 attribute user_tmpfs_type;
 433                 type user_tmpfs_t;
 434         ')
 435
 436         role $1 types user_tmpfs_t;
 437
 438         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 439         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 440         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 441         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 444         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449 ')
 450
 451 #######################################
 452 ## <summary>
 453 ##      The interface allowing the user basic
 454 ##      network permissions
 455 ## </summary>
 456 ## <param name="userdomain">
 457 ##      <summary>
 458 ##      The user domain
 459 ##      </summary>
 460 ## </param>
 461 ## <rolebase/>
 462 #
 463 interface(`userdom_basic_networking',`
 464
 465         allow $1 self:tcp_socket create_stream_socket_perms;
 466         allow $1 self:udp_socket create_socket_perms;
 467
 468         corenet_all_recvfrom_unlabeled($1)
 469         corenet_all_recvfrom_netlabel($1)
 470         corenet_tcp_sendrecv_generic_if($1)
 471         corenet_udp_sendrecv_generic_if($1)
 472         corenet_tcp_sendrecv_generic_node($1)
 473         corenet_udp_sendrecv_generic_node($1)
 474         corenet_tcp_sendrecv_all_ports($1)
 475         corenet_udp_sendrecv_all_ports($1)
 476         corenet_tcp_connect_all_ports($1)
 477         corenet_sendrecv_all_client_packets($1)
 478
 479         optional_policy(`
 480                 init_tcp_recvfrom_all_daemons($1)
 481                 init_udp_recvfrom_all_daemons($1)
 482         ')
 483
 484         optional_policy(`
 485                 ipsec_match_default_spd($1)
 486         ')
 487
 488 ')
 489
 490 #######################################
 491 ## <summary>
 492 ##      The template for creating a user xwindows client.  (Deprecated)
 493 ## </summary>
 494 ## <param name="userdomain_prefix">
 495 ##      <summary>
 496 ##      The prefix of the user domain (e.g., user
 497 ##      is the prefix for user_t).
 498 ##      </summary>
 499 ## </param>
 500 ## <rolebase/>
 501 #
 502 template(`userdom_xwindows_client_template',`
 503         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 504         gen_require(`
 505                 type $1_t, user_tmpfs_t;
 506         ')
 507
 508         dev_rw_xserver_misc($1_t)
 509         dev_rw_power_management($1_t)
 510         dev_read_input($1_t)
 511         dev_read_misc($1_t)
 512         dev_write_misc($1_t)
 513         # open office is looking for the following
 514         dev_getattr_agp_dev($1_t)
 515         dev_dontaudit_rw_dri($1_t)
 516         # GNOME checks for usb and other devices:
 517         dev_rw_usbfs($1_t)
 518         dev_rw_generic_usb_dev($1_t)
 519
 520         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 521         xserver_xsession_entry_type($1_t)
 522         xserver_dontaudit_write_log($1_t)
 523         xserver_stream_connect_xdm($1_t)
 524         # certain apps want to read xdm.pid file
 525         xserver_read_xdm_pid($1_t)
 526         # gnome-session creates socket under /tmp/.ICE-unix/
 527         xserver_create_xdm_tmp_sockets($1_t)
 528         # Needed for escd, remove if we get escd policy
 529         xserver_manage_xdm_tmp_files($1_t)
 530 ')
 531
 532 #######################################
 533 ## <summary>
 534 ##      The template for allowing the user to change passwords.
 535 ## </summary>
 536 ## <param name="userdomain_prefix">
 537 ##      <summary>
 538 ##      The prefix of the user domain (e.g., user
 539 ##      is the prefix for user_t).
 540 ##      </summary>
 541 ## </param>
 542 ## <rolebase/>
 543 #
 544 template(`userdom_change_password_template',`
 545         gen_require(`
 546                 type $1_t;
 547                 role $1_r;
 548         ')
 549
 550         optional_policy(`
 551                 usermanage_run_chfn($1_t,$1_r)
 552                 usermanage_run_passwd($1_t,$1_r)
 553         ')
 554 ')
 555
 556 #######################################
 557 ## <summary>
 558 ##      The template containing rules common to unprivileged
 559 ##      users and administrative users.
 560 ## </summary>
 561 ## <desc>
 562 ##      <p>
 563 ##      This template creates a user domain, types, and
 564 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 565 ##      </p>
 566 ## </desc>
 567 ## <param name="userdomain_prefix">
 568 ##      <summary>
 569 ##      The prefix of the user domain (e.g., user
 570 ##      is the prefix for user_t).
 571 ##      </summary>
 572 ## </param>
 573 #
 574 template(`userdom_common_user_template',`
 575         gen_require(`
 576                 attribute unpriv_userdomain;
 577         ')
 578
 579         userdom_basic_networking($1_usertype)
 580
 581         ##############################
 582         #
 583         # User domain Local policy
 584         #
 585
 586         # evolution and gnome-session try to create a netlink socket
 587         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 588         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 589         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 590         allow $1_t self:socket create_socket_perms;
 591
 592         allow $1_usertype unpriv_userdomain:fd use;
 593
 594         kernel_read_system_state($1_usertype)
 595         kernel_read_network_state($1_usertype)
 596         kernel_read_software_raid_state($1_usertype)
 597         kernel_read_net_sysctls($1_usertype)
 598         # Very permissive allowing every domain to see every type:
 599         kernel_get_sysvipc_info($1_usertype)
 600         # Find CDROM devices:
 601         kernel_read_device_sysctls($1_usertype)
 602         kernel_request_load_module($1_usertype)
 603
 604         corenet_udp_bind_generic_node($1_usertype)
 605         corenet_udp_bind_generic_port($1_usertype)
 606
 607         dev_read_rand($1_usertype)
 608         dev_write_sound($1_usertype)
 609         dev_read_sound($1_usertype)
 610         dev_read_sound_mixer($1_usertype)
 611         dev_write_sound_mixer($1_usertype)
 612
 613         files_exec_etc_files($1_usertype)
 614         files_search_locks($1_usertype)
 615         # Check to see if cdrom is mounted
 616         files_search_mnt($1_usertype)
 617         # cjp: perhaps should cut back on file reads:
 618         files_read_var_files($1_usertype)
 619         files_read_var_symlinks($1_usertype)
 620         files_read_generic_spool($1_usertype)
 621         files_read_var_lib_files($1_usertype)
 622         # Stat lost+found.
 623         files_getattr_lost_found_dirs($1_usertype)
 624         files_read_config_files($1_usertype)
 625         fs_read_noxattr_fs_files($1_usertype)
 626         fs_read_noxattr_fs_symlinks($1_usertype)
 627         fs_rw_cgroup_files($1_usertype)
 628
 629         application_getattr_socket($1_usertype)
 630
 631         logging_send_syslog_msg($1_usertype)
 632         logging_send_audit_msgs($1_usertype)
 633         selinux_get_enforce_mode($1_usertype)
 634
 635         # cjp: some of this probably can be removed
 636         selinux_get_fs_mount($1_usertype)
 637         selinux_validate_context($1_usertype)
 638         selinux_compute_access_vector($1_usertype)
 639         selinux_compute_create_context($1_usertype)
 640         selinux_compute_relabel_context($1_usertype)
 641         selinux_compute_user_contexts($1_usertype)
 642
 643         # for eject
 644         storage_getattr_fixed_disk_dev($1_usertype)
 645
 646         auth_read_login_records($1_usertype)
 647         auth_run_pam($1_t,$1_r)
 648         auth_run_utempter($1_t,$1_r)
 649
 650         init_read_utmp($1_usertype)
 651
 652         seutil_read_file_contexts($1_usertype)
 653         seutil_read_default_contexts($1_usertype)
 654         seutil_run_newrole($1_t,$1_r)
 655         seutil_exec_checkpolicy($1_t)
 656         seutil_exec_setfiles($1_usertype)
 657         # for when the network connection is killed
 658         # this is needed when a login role can change
 659         # to this one.
 660         seutil_dontaudit_signal_newrole($1_t)
 661
 662         tunable_policy(`user_direct_mouse',`
 663                 dev_read_mouse($1_usertype)
 664         ')
 665
 666         tunable_policy(`user_ttyfile_stat',`
 667                 term_getattr_all_ttys($1_t)
 668         ')
 669
 670         optional_policy(`
 671                 alsa_read_rw_config($1_usertype)
 672                 alsa_manage_home_files($1_t)
 673                 alsa_relabel_home_files($1_t)
 674         ')
 675
 676         optional_policy(`
 677                 # Allow graphical boot to check battery lifespan
 678                 apm_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 canna_stream_connect($1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 chrome_role($1_r, $1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 colord_read_lib_files($1_usertype)
 691         ')
 692
 693         optional_policy(`
 694                 dbus_system_bus_client($1_usertype)
 695
 696                 allow $1_usertype $1_usertype:dbus  send_msg;
 697
 698                 optional_policy(`
 699                         avahi_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         policykit_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         bluetooth_dbus_chat($1_usertype)
 708                 ')
 709
 710                 optional_policy(`
 711                         consolekit_dbus_chat($1_usertype)
 712                         consolekit_read_log($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         devicekit_dbus_chat($1_usertype)
 717                         devicekit_dbus_chat_power($1_usertype)
 718                         devicekit_dbus_chat_disk($1_usertype)
 719                 ')
 720
 721                 optional_policy(`
 722                         evolution_dbus_chat($1_usertype)
 723                         evolution_alarm_dbus_chat($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         gnome_dbus_chat_gconfdefault($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         hal_dbus_chat($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         kde_dbus_chat_backlighthelper($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         modemmanager_dbus_chat($1_usertype)
 740                 ')
 741
 742                 optional_policy(`
 743                         networkmanager_dbus_chat($1_usertype)
 744                         networkmanager_read_lib_files($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         vpn_dbus_chat($1_usertype)
 749                 ')
 750         ')
 751
 752         optional_policy(`
 753                 git_session_role($1_r, $1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 inetd_use_fds($1_usertype)
 758                 inetd_rw_tcp_sockets($1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inn_read_config($1_usertype)
 763                 inn_read_news_lib($1_usertype)
 764                 inn_read_news_spool($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 lircd_stream_connect($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 locate_read_lib_files($1_usertype)
 773         ')
 774
 775         # for running depmod as part of the kernel packaging process
 776         optional_policy(`
 777                 modutils_read_module_config($1_usertype)
 778         ')
 779
 780         optional_policy(`
 781                 mta_rw_spool($1_usertype)
 782                 mta_manage_queue($1_usertype)
 783                 mta_filetrans_home_content($1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 nsplugin_role($1_r, $1_usertype)
 788         ')
 789
 790         optional_policy(`
 791                 tunable_policy(`allow_user_mysql_connect',`
 792                         mysql_stream_connect($1_t)
 793                 ')
 794         ')
 795
 796         optional_policy(`
 797                 oident_manage_user_content($1_t)
 798                 oident_relabel_user_content($1_t)
 799         ')
 800
 801         optional_policy(`
 802                 # to allow monitoring of pcmcia status
 803                 pcmcia_read_pid($1_usertype)
 804         ')
 805
 806         optional_policy(`
 807                 pcscd_read_pub_files($1_usertype)
 808                 pcscd_stream_connect($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 tunable_policy(`allow_user_postgresql_connect',`
 813                         postgresql_stream_connect($1_usertype)
 814                         postgresql_tcp_connect($1_usertype)
 815                 ')
 816         ')
 817
 818         optional_policy(`
 819                 resmgr_stream_connect($1_usertype)
 820         ')
 821
 822         optional_policy(`
 823                 rpc_dontaudit_getattr_exports($1_usertype)
 824                 rpc_manage_nfs_rw_content($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpcbind_stream_connect($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 samba_stream_connect_winbind($1_usertype)
 833         ')
 834
 835         optional_policy(`
 836                 sandbox_transition($1_usertype, $1_r)
 837         ')
 838
 839         optional_policy(`
 840                 seunshare_role_template($1, $1_r, $1_t)
 841         ')
 842
 843         optional_policy(`
 844                 slrnpull_search_spool($1_usertype)
 845         ')
 846
 847 ')
 848
 849 #######################################
 850 ## <summary>
 851 ##      The template for creating a login user.
 852 ## </summary>
 853 ## <desc>
 854 ##      <p>
 855 ##      This template creates a user domain, types, and
 856 ##      rules for the user's tty, pty, home directories,
 857 ##      tmp, and tmpfs files.
 858 ##      </p>
 859 ## </desc>
 860 ## <param name="userdomain_prefix">
 861 ##      <summary>
 862 ##      The prefix of the user domain (e.g., user
 863 ##      is the prefix for user_t).
 864 ##      </summary>
 865 ## </param>
 866 #
 867 template(`userdom_login_user_template', `
 868         gen_require(`
 869                 class context contains;
 870         ')
 871
 872         userdom_base_user_template($1)
 873
 874         userdom_manage_home_role($1_r, $1_usertype)
 875
 876         userdom_manage_tmp_role($1_r, $1_usertype)
 877         userdom_manage_tmpfs_role($1_r, $1_usertype)
 878
 879         ifelse(`$1',`unconfined',`',`
 880                 gen_tunable(allow_$1_exec_content, true)
 881
 882                 tunable_policy(`allow_$1_exec_content',`
 883                         userdom_exec_user_tmp_files($1_usertype)
 884                         userdom_exec_user_home_content_files($1_usertype)
 885                 ')
 886                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 887                         fs_exec_nfs_files($1_usertype)
 888                 ')
 889
 890                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 891                         fs_exec_cifs_files($1_usertype)
 892                 ')
 893         ')
 894
 895         userdom_change_password_template($1)
 896
 897         ##############################
 898         #
 899         # User domain Local policy
 900         #
 901
 902         allow $1_t self:capability { setgid chown fowner };
 903         dontaudit $1_t self:capability { sys_nice fsetid };
 904
 905         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 906         dontaudit $1_t self:process setrlimit;
 907         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 908
 909         allow $1_t self:context contains;
 910
 911         kernel_dontaudit_read_system_state($1_usertype)
 912         kernel_dontaudit_list_all_proc($1_usertype)
 913
 914         dev_read_sysfs($1_usertype)
 915         dev_read_urand($1_usertype)
 916
 917         domain_use_interactive_fds($1_usertype)
 918         # Command completion can fire hundreds of denials
 919         domain_dontaudit_exec_all_entry_files($1_usertype)
 920
 921         files_dontaudit_list_default($1_usertype)
 922         files_dontaudit_read_default_files($1_usertype)
 923         # Stat lost+found.
 924         files_getattr_lost_found_dirs($1_usertype)
 925
 926         fs_get_all_fs_quotas($1_usertype)
 927         fs_getattr_all_fs($1_usertype)
 928         fs_search_all($1_usertype)
 929         fs_list_inotifyfs($1_usertype)
 930         fs_rw_anon_inodefs_files($1_usertype)
 931
 932         auth_dontaudit_write_login_records($1_t)
 933         auth_rw_cache($1_t)
 934
 935         application_exec_all($1_t)
 936         # The library functions always try to open read-write first,
 937         # then fall back to read-only if it fails.
 938         init_dontaudit_rw_utmp($1_t)
 939
 940         # Stop warnings about access to /dev/console
 941         init_dontaudit_use_fds($1_usertype)
 942         init_dontaudit_use_script_fds($1_usertype)
 943
 944         libs_exec_lib_files($1_usertype)
 945
 946         logging_dontaudit_getattr_all_logs($1_usertype)
 947
 948         # for running TeX programs
 949         miscfiles_read_tetex_data($1_usertype)
 950         miscfiles_exec_tetex_data($1_usertype)
 951
 952         seutil_read_config($1_usertype)
 953
 954         optional_policy(`
 955                 cups_read_config($1_usertype)
 956                 cups_stream_connect($1_usertype)
 957                 cups_stream_connect_ptal($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 kerberos_use($1_usertype)
 962                 kerberos_filetrans_home_content($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 mta_dontaudit_read_spool_symlinks($1_usertype)
 967         ')
 968
 969         optional_policy(`
 970                 quota_dontaudit_getattr_db($1_usertype)
 971         ')
 972
 973         optional_policy(`
 974                 rpm_read_db($1_usertype)
 975                 rpm_dontaudit_manage_db($1_usertype)
 976                 rpm_read_cache($1_usertype)
 977         ')
 978
 979         optional_policy(`
 980                 oddjob_run_mkhomedir($1_t, $1_r)
 981         ')
 982 ')
 983
 984 #######################################
 985 ## <summary>
 986 ##      The template for creating a unprivileged login user.
 987 ## </summary>
 988 ## <desc>
 989 ##      <p>
 990 ##      This template creates a user domain, types, and
 991 ##      rules for the user's tty, pty, home directories,
 992 ##      tmp, and tmpfs files.
 993 ##      </p>
 994 ## </desc>
 995 ## <param name="userdomain_prefix">
 996 ##      <summary>
 997 ##      The prefix of the user domain (e.g., user
 998 ##      is the prefix for user_t).
 999 ##      </summary>
1000 ## </param>
1001 #
1002 template(`userdom_restricted_user_template',`
1003         gen_require(`
1004                 attribute unpriv_userdomain;
1005         ')
1006
1007         userdom_login_user_template($1)
1008
1009         typeattribute $1_t unpriv_userdomain;
1010         domain_interactive_fd($1_t)
1011
1012         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1013         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1014
1015         ##############################
1016         #
1017         # Local policy
1018         #
1019
1020         optional_policy(`
1021                 loadkeys_run($1_t, $1_r)
1022         ')
1023 ')
1024
1025 #######################################
1026 ## <summary>
1027 ##      The template for creating a unprivileged xwindows login user.
1028 ## </summary>
1029 ## <desc>
1030 ##      <p>
1031 ##      The template for creating a unprivileged xwindows login user.
1032 ##      </p>
1033 ##      <p>
1034 ##      This template creates a user domain, types, and
1035 ##      rules for the user's tty, pty, home directories,
1036 ##      tmp, and tmpfs files.
1037 ##      </p>
1038 ## </desc>
1039 ## <param name="userdomain_prefix">
1040 ##      <summary>
1041 ##      The prefix of the user domain (e.g., user
1042 ##      is the prefix for user_t).
1043 ##      </summary>
1044 ## </param>
1045 #
1046 template(`userdom_restricted_xwindows_user_template',`
1047
1048         userdom_restricted_user_template($1)
1049
1050         ##############################
1051         #
1052         # Local policy
1053         #
1054
1055         auth_role($1_r, $1_t)
1056         auth_search_pam_console_data($1_usertype)
1057         auth_dontaudit_read_login_records($1_usertype)
1058
1059         dev_read_sound($1_usertype)
1060         dev_write_sound($1_usertype)
1061         # gnome keyring wants to read this.
1062         dev_dontaudit_read_rand($1_usertype)
1063         # temporarily allow since openoffice requires this
1064         dev_read_rand($1_usertype)
1065
1066         dev_read_video_dev($1_usertype)
1067         dev_write_video_dev($1_usertype)
1068         dev_rw_wireless($1_usertype)
1069
1070         libs_dontaudit_setattr_lib_files($1_usertype)
1071
1072         tunable_policy(`user_rw_noexattrfile',`
1073                 dev_rw_usbfs($1_t)
1074                 dev_rw_generic_usb_dev($1_usertype)
1075
1076                 fs_manage_noxattr_fs_files($1_usertype)
1077                 fs_manage_noxattr_fs_dirs($1_usertype)
1078                 fs_manage_dos_dirs($1_usertype)
1079                 fs_manage_dos_files($1_usertype)
1080                 storage_raw_read_removable_device($1_usertype)
1081                 storage_raw_write_removable_device($1_usertype)
1082         ')
1083
1084         logging_send_syslog_msg($1_usertype)
1085         logging_dontaudit_send_audit_msgs($1_t)
1086
1087         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1088         logging_send_audit_msgs($1_t)
1089         selinux_get_enforce_mode($1_t)
1090         seutil_exec_restorecond($1_t)
1091         seutil_read_file_contexts($1_t)
1092         seutil_read_default_contexts($1_t)
1093
1094         xserver_restricted_role($1_r, $1_t)
1095
1096         optional_policy(`
1097                 alsa_read_rw_config($1_usertype)
1098         ')
1099
1100          # cjp: needed by KDE apps
1101          # bug: #682499
1102          optional_policy(`
1103                 gnome_read_usr_config($1_usertype)
1104                 gnome_role_gkeyringd($1, $1_r, $1_t)
1105                 # cjp: telepathy F15 bugs
1106                 telepathy_role($1_r, $1_t, $1)
1107         ')
1108
1109         optional_policy(`
1110                 dbus_role_template($1, $1_r, $1_usertype)
1111                 dbus_system_bus_client($1_usertype)
1112                 allow $1_usertype $1_usertype:dbus send_msg;
1113
1114                 optional_policy(`
1115                         abrt_dbus_chat($1_usertype)
1116                         abrt_run_helper($1_usertype, $1_r)
1117                 ')
1118
1119                 optional_policy(`
1120                         consolekit_dontaudit_read_log($1_usertype)
1121                         consolekit_dbus_chat($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         cups_dbus_chat($1_usertype)
1126                         cups_dbus_chat_config($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         devicekit_dbus_chat($1_usertype)
1131                         devicekit_dbus_chat_disk($1_usertype)
1132                         devicekit_dbus_chat_power($1_usertype)
1133                 ')
1134
1135                 optional_policy(`
1136                         fprintd_dbus_chat($1_t)
1137                 ')
1138         ')
1139
1140         optional_policy(`
1141                 openoffice_role_template($1, $1_r, $1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 policykit_role($1_r, $1_usertype)
1146         ')
1147
1148         optional_policy(`
1149                 pulseaudio_role($1_r, $1_usertype)
1150                 pulseaudio_filetrans_admin_home_content($1_usertype)
1151                 pulseaudio_filetrans_home_content($1_usertype)
1152         ')
1153
1154         optional_policy(`
1155                 rtkit_scheduled($1_usertype)
1156         ')
1157
1158         optional_policy(`
1159                 setroubleshoot_dontaudit_stream_connect($1_t)
1160         ')
1161
1162         optional_policy(`
1163                 udev_read_db($1_usertype)
1164         ')
1165
1166         optional_policy(`
1167                 wm_role_template($1, $1_r, $1_t)
1168         ')
1169 ')
1170
1171 #######################################
1172 ## <summary>
1173 ##      The template for creating a unprivileged user roughly
1174 ##      equivalent to a regular linux user.
1175 ## </summary>
1176 ## <desc>
1177 ##      <p>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ##      </p>
1181 ##      <p>
1182 ##      This template creates a user domain, types, and
1183 ##      rules for the user's tty, pty, home directories,
1184 ##      tmp, and tmpfs files.
1185 ##      </p>
1186 ## </desc>
1187 ## <param name="userdomain_prefix">
1188 ##      <summary>
1189 ##      The prefix of the user domain (e.g., user
1190 ##      is the prefix for user_t).
1191 ##      </summary>
1192 ## </param>
1193 #
1194 template(`userdom_unpriv_user_template', `
1195
1196         ##############################
1197         #
1198         # Declarations
1199         #
1200
1201         # Inherit rules for ordinary users.
1202         userdom_restricted_xwindows_user_template($1)
1203         userdom_common_user_template($1)
1204
1205         ##############################
1206         #
1207         # Local policy
1208         #
1209
1210         # port access is audited even if dac would not have allowed it, so dontaudit it here
1211 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1212         # Need the following rule to allow users to run vpnc
1213         corenet_tcp_bind_xserver_port($1_t)
1214         corenet_tcp_bind_generic_node($1_usertype)
1215
1216         storage_rw_fuse($1_t)
1217
1218         files_exec_usr_files($1_t)
1219    # cjp: why?
1220         files_read_kernel_symbol_table($1_t)
1221
1222         ifndef(`enable_mls',`
1223                 fs_exec_noxattr($1_t)
1224
1225                 tunable_policy(`user_rw_noexattrfile',`
1226                         fs_manage_noxattr_fs_files($1_t)
1227                         fs_manage_noxattr_fs_dirs($1_t)
1228                         # Write floppies
1229                         storage_raw_read_removable_device($1_t)
1230                         storage_raw_write_removable_device($1_t)
1231                 ',`
1232                         storage_raw_read_removable_device($1_t)
1233                 ')
1234         ')
1235
1236         miscfiles_read_hwdata($1_usertype)
1237
1238         # Allow users to run TCP servers (bind to ports and accept connection from
1239         # the same domain and outside users) disabling this forces FTP passive mode
1240         # and may change other protocols
1241
1242         tunable_policy(`user_share_music',`
1243                 corenet_tcp_bind_daap_port($1_usertype)
1244         ')
1245
1246         tunable_policy(`user_tcp_server',`
1247                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1248         ')
1249
1250         tunable_policy(`user_setrlimit',`
1251                 allow $1_usertype self:process setrlimit;
1252         ')
1253
1254         optional_policy(`
1255                 cdrecord_role($1_r, $1_t)
1256         ')
1257
1258         optional_policy(`
1259                 cron_role($1_r, $1_t)
1260         ')
1261
1262         optional_policy(`
1263                 games_rw_data($1_usertype)
1264         ')
1265
1266         optional_policy(`
1267                 gpg_role($1_r, $1_usertype)
1268         ')
1269
1270         optional_policy(`
1271                 gnomeclock_dbus_chat($1_t)
1272         ')
1273
1274         optional_policy(`
1275                 gpm_stream_connect($1_usertype)
1276         ')
1277
1278         optional_policy(`
1279                 execmem_role_template($1, $1_r, $1_t)
1280         ')
1281
1282         optional_policy(`
1283                 java_role_template($1, $1_r, $1_t)
1284         ')
1285
1286         optional_policy(`
1287                 mono_role_template($1, $1_r, $1_t)
1288         ')
1289
1290         optional_policy(`
1291                 mount_run_fusermount($1_t, $1_r)
1292                 mount_read_pid_files($1_t)
1293         ')
1294
1295         optional_policy(`
1296                 wine_role_template($1, $1_r, $1_t)
1297         ')
1298
1299         optional_policy(`
1300                 postfix_run_postdrop($1_t, $1_r)
1301         ')
1302
1303         # Run pppd in pppd_t by default for user
1304         optional_policy(`
1305                 ppp_run_cond($1_t, $1_r)
1306         ')
1307 ')
1308
1309 #######################################
1310 ## <summary>
1311 ##      The template for creating an administrative user.
1312 ## </summary>
1313 ## <desc>
1314 ##      <p>
1315 ##      This template creates a user domain, types, and
1316 ##      rules for the user's tty, pty, home directories,
1317 ##      tmp, and tmpfs files.
1318 ##      </p>
1319 ##      <p>
1320 ##      The privileges given to administrative users are:
1321 ##      <ul>
1322 ##              <li>Raw disk access</li>
1323 ##              <li>Set all sysctls</li>
1324 ##              <li>All kernel ring buffer controls</li>
1325 ##              <li>Create, read, write, and delete all files but shadow</li>
1326 ##              <li>Manage source and binary format SELinux policy</li>
1327 ##              <li>Run insmod</li>
1328 ##      </ul>
1329 ##      </p>
1330 ## </desc>
1331 ## <param name="userdomain_prefix">
1332 ##      <summary>
1333 ##      The prefix of the user domain (e.g., sysadm
1334 ##      is the prefix for sysadm_t).
1335 ##      </summary>
1336 ## </param>
1337 #
1338 template(`userdom_admin_user_template',`
1339         gen_require(`
1340                 attribute admindomain;
1341                 class passwd { passwd chfn chsh rootok crontab };
1342         ')
1343
1344         ##############################
1345         #
1346         # Declarations
1347         #
1348
1349         # Inherit rules for ordinary users.
1350         userdom_login_user_template($1)
1351         userdom_common_user_template($1)
1352
1353         domain_obj_id_change_exemption($1_t)
1354         role system_r types $1_t;
1355
1356         typeattribute $1_t admindomain;
1357
1358         ifdef(`direct_sysadm_daemon',`
1359                 domain_system_change_exemption($1_t)
1360         ')
1361
1362         ##############################
1363         #
1364         # $1_t local policy
1365         #
1366
1367         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1368         allow $1_t self:capability2 syslog;
1369         allow $1_t self:process { setexec setfscreate };
1370         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1371         allow $1_t self:tun_socket create;
1372         # Set password information for other users.
1373         allow $1_t self:passwd { passwd chfn chsh };
1374         # Skip authentication when pam_rootok is specified.
1375         allow $1_t self:passwd rootok;
1376
1377         # Manipulate other users crontab.
1378         allow $1_t self:passwd crontab;
1379
1380         kernel_read_software_raid_state($1_t)
1381         kernel_getattr_core_if($1_t)
1382         kernel_getattr_message_if($1_t)
1383         kernel_change_ring_buffer_level($1_t)
1384         kernel_clear_ring_buffer($1_t)
1385         kernel_read_ring_buffer($1_t)
1386         kernel_get_sysvipc_info($1_t)
1387         kernel_rw_all_sysctls($1_t)
1388         # signal unlabeled processes:
1389         kernel_kill_unlabeled($1_t)
1390         kernel_signal_unlabeled($1_t)
1391         kernel_sigstop_unlabeled($1_t)
1392         kernel_signull_unlabeled($1_t)
1393         kernel_sigchld_unlabeled($1_t)
1394         kernel_signal($1_t)
1395
1396         corenet_tcp_bind_generic_port($1_t)
1397         # allow setting up tunnels
1398         corenet_rw_tun_tap_dev($1_t)
1399
1400         dev_getattr_generic_blk_files($1_t)
1401         dev_getattr_generic_chr_files($1_t)
1402         # for lsof
1403         dev_getattr_mtrr_dev($1_t)
1404         # Allow MAKEDEV to work
1405         dev_create_all_blk_files($1_t)
1406         dev_create_all_chr_files($1_t)
1407         dev_delete_all_blk_files($1_t)
1408         dev_delete_all_chr_files($1_t)
1409         dev_rename_all_blk_files($1_t)
1410         dev_rename_all_chr_files($1_t)
1411         dev_create_generic_symlinks($1_t)
1412         dev_rw_generic_usb_dev($1_t)
1413         dev_rw_usbfs($1_t)
1414
1415         domain_setpriority_all_domains($1_t)
1416         domain_read_all_domains_state($1_t)
1417         domain_getattr_all_domains($1_t)
1418         domain_getcap_all_domains($1_t)
1419         domain_dontaudit_ptrace_all_domains($1_t)
1420         # signal all domains:
1421         domain_kill_all_domains($1_t)
1422         domain_signal_all_domains($1_t)
1423         domain_signull_all_domains($1_t)
1424         domain_sigstop_all_domains($1_t)
1425         domain_sigstop_all_domains($1_t)
1426         domain_sigchld_all_domains($1_t)
1427         # for lsof
1428         domain_getattr_all_sockets($1_t)
1429         domain_dontaudit_getattr_all_sockets($1_t)
1430
1431         files_exec_usr_src_files($1_t)
1432
1433         fs_getattr_all_fs($1_t)
1434         fs_getattr_all_files($1_t)
1435         fs_list_all($1_t)
1436         fs_set_all_quotas($1_t)
1437         fs_exec_noxattr($1_t)
1438
1439         storage_raw_read_removable_device($1_t)
1440         storage_raw_write_removable_device($1_t)
1441         storage_dontaudit_read_fixed_disk($1_t)
1442
1443         term_use_all_inherited_terms($1_t)
1444         term_use_unallocated_ttys($1_t)
1445
1446         auth_getattr_shadow($1_t)
1447         # Manage almost all files
1448         auth_manage_all_files_except_shadow($1_t)
1449         # Relabel almost all files
1450         auth_relabel_all_files_except_shadow($1_t)
1451
1452         init_telinit($1_t)
1453
1454         logging_send_syslog_msg($1_t)
1455
1456         optional_policy(`
1457                 modutils_domtrans_insmod($1_t)
1458                 modutils_domtrans_depmod($1_t)
1459         ')
1460
1461         # The following rule is temporary until such time that a complete
1462         # policy management infrastructure is in place so that an administrator
1463         # cannot directly manipulate policy files with arbitrary programs.
1464         seutil_manage_src_policy($1_t)
1465         # Violates the goal of limiting write access to checkpolicy.
1466         # But presently necessary for installing the file_contexts file.
1467         seutil_manage_bin_policy($1_t)
1468
1469         userdom_manage_user_home_content_dirs($1_t)
1470         userdom_manage_user_home_content_files($1_t)
1471         userdom_manage_user_home_content_symlinks($1_t)
1472         userdom_manage_user_home_content_pipes($1_t)
1473         userdom_manage_user_home_content_sockets($1_t)
1474         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1475
1476         tunable_policy(`user_rw_noexattrfile',`
1477                 fs_manage_noxattr_fs_files($1_t)
1478                 fs_manage_noxattr_fs_dirs($1_t)
1479         ',`
1480                 fs_read_noxattr_fs_files($1_t)
1481         ')
1482
1483         optional_policy(`
1484                 postgresql_unconfined($1_t)
1485         ')
1486
1487         optional_policy(`
1488                 userhelper_exec($1_t)
1489         ')
1490 ')
1491
1492 ########################################
1493 ## <summary>
1494 ##      Allow user to run as a secadm
1495 ## </summary>
1496 ## <desc>
1497 ##      <p>
1498 ##      Create objects in a user home directory
1499 ##      with an automatic type transition to
1500 ##      a specified private type.
1501 ##      </p>
1502 ##      <p>
1503 ##      This is a templated interface, and should only
1504 ##      be called from a per-userdomain template.
1505 ##      </p>
1506 ## </desc>
1507 ## <param name="domain">
1508 ##      <summary>
1509 ##      Domain allowed access.
1510 ##      </summary>
1511 ## </param>
1512 ## <param name="role">
1513 ##      <summary>
1514 ##      The role  of the object to create.
1515 ##      </summary>
1516 ## </param>
1517 #
1518 template(`userdom_security_admin_template',`
1519         allow $1 self:capability { dac_read_search dac_override };
1520
1521         corecmd_exec_shell($1)
1522
1523         domain_obj_id_change_exemption($1)
1524
1525         dev_relabel_all_dev_nodes($1)
1526
1527         files_create_boot_flag($1)
1528         files_create_default_dir($1)
1529         files_root_filetrans_default($1, dir)
1530
1531         # Necessary for managing /boot/efi
1532         fs_manage_dos_files($1)
1533
1534         mls_process_read_up($1)
1535         mls_file_read_all_levels($1)
1536         mls_file_upgrade($1)
1537         mls_file_downgrade($1)
1538
1539         selinux_set_enforce_mode($1)
1540         selinux_set_all_booleans($1)
1541         selinux_set_parameters($1)
1542         selinux_read_policy($1)
1543
1544         auth_relabel_all_files_except_shadow($1)
1545         auth_relabel_shadow($1)
1546
1547         init_exec($1)
1548
1549         logging_send_syslog_msg($1)
1550         logging_read_audit_log($1)
1551         logging_read_generic_logs($1)
1552         logging_read_audit_config($1)
1553
1554         seutil_manage_bin_policy($1)
1555         seutil_manage_default_contexts($1)
1556         seutil_manage_file_contexts($1)
1557         seutil_manage_module_store($1)
1558         seutil_manage_config($1)
1559         seutil_run_checkpolicy($1,$2)
1560         seutil_run_loadpolicy($1,$2)
1561         seutil_run_semanage($1,$2)
1562         seutil_run_setsebool($1,$2)
1563         seutil_run_setfiles($1, $2)
1564
1565         seutil_manage_bin_policy($1)
1566     seutil_manage_default_contexts($1)
1567     seutil_manage_file_contexts($1)
1568     seutil_manage_module_store($1)
1569     seutil_manage_config($1)
1570
1571         optional_policy(`
1572                 aide_run($1,$2)
1573         ')
1574
1575         optional_policy(`
1576                 consoletype_exec($1)
1577         ')
1578
1579         optional_policy(`
1580                 dmesg_exec($1)
1581         ')
1582
1583         optional_policy(`
1584                 ipsec_run_setkey($1,$2)
1585         ')
1586
1587         optional_policy(`
1588                 netlabel_run_mgmt($1,$2)
1589         ')
1590
1591         optional_policy(`
1592                 samhain_run($1, $2)
1593         ')
1594 ')
1595
1596 ########################################
1597 ## <summary>
1598 ##      Make the specified type usable in a
1599 ##      user home directory.
1600 ## </summary>
1601 ## <param name="type">
1602 ##      <summary>
1603 ##      Type to be used as a file in the
1604 ##      user home directory.
1605 ##      </summary>
1606 ## </param>
1607 #
1608 interface(`userdom_user_home_content',`
1609         gen_require(`
1610                 type user_home_t;
1611                 attribute user_home_type;
1612         ')
1613
1614         allow $1 user_home_t:filesystem associate;
1615         files_type($1)
1616         ubac_constrained($1)
1617
1618         files_poly_member($1)
1619         typeattribute $1  user_home_type;
1620 ')
1621
1622 ########################################
1623 ## <summary>
1624 ##      Make the specified type usable in a
1625 ##      generic temporary directory.
1626 ## </summary>
1627 ## <param name="type">
1628 ##      <summary>
1629 ##      Type to be used as a file in the
1630 ##      generic temporary directory.
1631 ##      </summary>
1632 ## </param>
1633 #
1634 interface(`userdom_user_tmp_content',`
1635         gen_require(`
1636                 attribute user_tmp_type;
1637         ')
1638
1639         typeattribute $1 user_tmp_type;
1640
1641         files_tmp_file($1)
1642         ubac_constrained($1)
1643 ')
1644
1645 ########################################
1646 ## <summary>
1647 ##      Make the specified type usable in a
1648 ##      generic tmpfs_t directory.
1649 ## </summary>
1650 ## <param name="type">
1651 ##      <summary>
1652 ##      Type to be used as a file in the
1653 ##      generic temporary directory.
1654 ##      </summary>
1655 ## </param>
1656 #
1657 interface(`userdom_user_tmpfs_content',`
1658         gen_require(`
1659                 attribute user_tmpfs_type;
1660         ')
1661
1662         typeattribute $1 user_tmpfs_type;
1663
1664         files_tmpfs_file($1)
1665         ubac_constrained($1)
1666 ')
1667
1668 ########################################
1669 ## <summary>
1670 ##      Allow domain to attach to TUN devices created by administrative users.
1671 ## </summary>
1672 ## <param name="domain">
1673 ##      <summary>
1674 ##      Domain allowed access.
1675 ##      </summary>
1676 ## </param>
1677 #
1678 interface(`userdom_attach_admin_tun_iface',`
1679         gen_require(`
1680                 attribute admindomain;
1681         ')
1682
1683         allow $1 admindomain:tun_socket relabelfrom;
1684         allow $1 self:tun_socket relabelto;
1685 ')
1686
1687 ########################################
1688 ## <summary>
1689 ##      Set the attributes of a user pty.
1690 ## </summary>
1691 ## <param name="domain">
1692 ##      <summary>
1693 ##      Domain allowed access.
1694 ##      </summary>
1695 ## </param>
1696 #
1697 interface(`userdom_setattr_user_ptys',`
1698         gen_require(`
1699                 type user_devpts_t;
1700         ')
1701
1702         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1703 ')
1704
1705 ########################################
1706 ## <summary>
1707 ##      Create a user pty.
1708 ## </summary>
1709 ## <param name="domain">
1710 ##      <summary>
1711 ##      Domain allowed access.
1712 ##      </summary>
1713 ## </param>
1714 #
1715 interface(`userdom_create_user_pty',`
1716         gen_require(`
1717                 type user_devpts_t;
1718         ')
1719
1720         term_create_pty($1, user_devpts_t)
1721 ')
1722
1723 ########################################
1724 ## <summary>
1725 ##      Get the attributes of user home directories.
1726 ## </summary>
1727 ## <param name="domain">
1728 ##      <summary>
1729 ##      Domain allowed access.
1730 ##      </summary>
1731 ## </param>
1732 #
1733 interface(`userdom_getattr_user_home_dirs',`
1734         gen_require(`
1735                 type user_home_dir_t;
1736         ')
1737
1738         allow $1 user_home_dir_t:dir getattr_dir_perms;
1739         files_search_home($1)
1740 ')
1741
1742 ########################################
1743 ## <summary>
1744 ##      Do not audit attempts to get the attributes of user home directories.
1745 ## </summary>
1746 ## <param name="domain">
1747 ##      <summary>
1748 ##      Domain to not audit.
1749 ##      </summary>
1750 ## </param>
1751 #
1752 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1753         gen_require(`
1754                 type user_home_dir_t;
1755         ')
1756
1757         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1758 ')
1759
1760 ########################################
1761 ## <summary>
1762 ##      Search user home directories.
1763 ## </summary>
1764 ## <param name="domain">
1765 ##      <summary>
1766 ##      Domain allowed access.
1767 ##      </summary>
1768 ## </param>
1769 #
1770 interface(`userdom_search_user_home_dirs',`
1771         gen_require(`
1772                 type user_home_dir_t;
1773         ')
1774
1775         allow $1 user_home_dir_t:dir search_dir_perms;
1776         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1777         files_search_home($1)
1778 ')
1779
1780 ########################################
1781 ## <summary>
1782 ##      Do not audit attempts to search user home directories.
1783 ## </summary>
1784 ## <desc>
1785 ##      <p>
1786 ##      Do not audit attempts to search user home directories.
1787 ##      This will supress SELinux denial messages when the specified
1788 ##      domain is denied the permission to search these directories.
1789 ##      </p>
1790 ## </desc>
1791 ## <param name="domain">
1792 ##      <summary>
1793 ##      Domain to not audit.
1794 ##      </summary>
1795 ## </param>
1796 ## <infoflow type="none"/>
1797 #
1798 interface(`userdom_dontaudit_search_user_home_dirs',`
1799         gen_require(`
1800                 type user_home_dir_t;
1801         ')
1802
1803         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1804 ')
1805
1806 ########################################
1807 ## <summary>
1808 ##      List user home directories.
1809 ## </summary>
1810 ## <param name="domain">
1811 ##      <summary>
1812 ##      Domain allowed access.
1813 ##      </summary>
1814 ## </param>
1815 #
1816 interface(`userdom_list_user_home_dirs',`
1817         gen_require(`
1818                 type user_home_dir_t;
1819         ')
1820
1821         allow $1 user_home_dir_t:dir list_dir_perms;
1822         files_search_home($1)
1823
1824         tunable_policy(`use_nfs_home_dirs',`
1825                 fs_list_nfs($1)
1826         ')
1827
1828         tunable_policy(`use_samba_home_dirs',`
1829                 fs_list_cifs($1)
1830         ')
1831 ')
1832
1833 ########################################
1834 ## <summary>
1835 ##      Do not audit attempts to list user home subdirectories.
1836 ## </summary>
1837 ## <param name="domain">
1838 ##      <summary>
1839 ##      Domain to not audit.
1840 ##      </summary>
1841 ## </param>
1842 #
1843 interface(`userdom_dontaudit_list_user_home_dirs',`
1844         gen_require(`
1845                 type user_home_dir_t;
1846                 type user_home_t;
1847         ')
1848
1849         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1850         dontaudit $1 user_home_t:dir list_dir_perms;
1851 ')
1852
1853 ########################################
1854 ## <summary>
1855 ##      Create user home directories.
1856 ## </summary>
1857 ## <param name="domain">
1858 ##      <summary>
1859 ##      Domain allowed access.
1860 ##      </summary>
1861 ## </param>
1862 #
1863 interface(`userdom_create_user_home_dirs',`
1864         gen_require(`
1865                 type user_home_dir_t;
1866         ')
1867
1868         allow $1 user_home_dir_t:dir create_dir_perms;
1869 ')
1870
1871 ########################################
1872 ## <summary>
1873 ##      Create user home directories.
1874 ## </summary>
1875 ## <param name="domain">
1876 ##      <summary>
1877 ##      Domain allowed access.
1878 ##      </summary>
1879 ## </param>
1880 #
1881 interface(`userdom_manage_user_home_dirs',`
1882         gen_require(`
1883                 type user_home_dir_t;
1884         ')
1885
1886         allow $1 user_home_dir_t:dir manage_dir_perms;
1887 ')
1888
1889 ########################################
1890 ## <summary>
1891 ##      Relabel to user home directories.
1892 ## </summary>
1893 ## <param name="domain">
1894 ##      <summary>
1895 ##      Domain allowed access.
1896 ##      </summary>
1897 ## </param>
1898 #
1899 interface(`userdom_relabelto_user_home_dirs',`
1900         gen_require(`
1901                 type user_home_dir_t;
1902         ')
1903
1904         allow $1 user_home_dir_t:dir relabelto;
1905 ')
1906
1907
1908 ########################################
1909 ## <summary>
1910 ##      Relabel to user home files.
1911 ## </summary>
1912 ## <param name="domain">
1913 ##      <summary>
1914 ##      Domain allowed access.
1915 ##      </summary>
1916 ## </param>
1917 #
1918 interface(`userdom_relabelto_user_home_files',`
1919         gen_require(`
1920                 type user_home_t;
1921         ')
1922
1923         allow $1 user_home_t:file relabelto;
1924 ')
1925 ########################################
1926 ## <summary>
1927 ##      Relabel user home files.
1928 ## </summary>
1929 ## <param name="domain">
1930 ##      <summary>
1931 ##      Domain allowed access.
1932 ##      </summary>
1933 ## </param>
1934 #
1935 interface(`userdom_relabel_user_home_files',`
1936         gen_require(`
1937                 type user_home_t;
1938         ')
1939
1940         allow $1 user_home_t:file relabel_file_perms;
1941 ')
1942
1943 ########################################
1944 ## <summary>
1945 ##      Create directories in the home dir root with
1946 ##      the user home directory type.
1947 ## </summary>
1948 ## <param name="domain">
1949 ##      <summary>
1950 ##      Domain allowed access.
1951 ##      </summary>
1952 ## </param>
1953 #
1954 interface(`userdom_home_filetrans_user_home_dir',`
1955         gen_require(`
1956                 type user_home_dir_t;
1957         ')
1958
1959         files_home_filetrans($1, user_home_dir_t, dir)
1960 ')
1961
1962 ########################################
1963 ## <summary>
1964 ##      Do a domain transition to the specified
1965 ##      domain when executing a program in the
1966 ##      user home directory.
1967 ## </summary>
1968 ## <desc>
1969 ##      <p>
1970 ##      Do a domain transition to the specified
1971 ##      domain when executing a program in the
1972 ##      user home directory.
1973 ##      </p>
1974 ##      <p>
1975 ##      No interprocess communication (signals, pipes,
1976 ##      etc.) is provided by this interface since
1977 ##      the domains are not owned by this module.
1978 ##      </p>
1979 ## </desc>
1980 ## <param name="source_domain">
1981 ##      <summary>
1982 ##      Domain allowed to transition.
1983 ##      </summary>
1984 ## </param>
1985 ## <param name="target_domain">
1986 ##      <summary>
1987 ##      Domain to transition to.
1988 ##      </summary>
1989 ## </param>
1990 #
1991 interface(`userdom_user_home_domtrans',`
1992         gen_require(`
1993                 type user_home_dir_t, user_home_t;
1994         ')
1995
1996         domain_auto_trans($1, user_home_t, $2)
1997         allow $1 user_home_dir_t:dir search_dir_perms;
1998         files_search_home($1)
1999 ')
2000
2001 ########################################
2002 ## <summary>
2003 ##      Do not audit attempts to search user home content directories.
2004 ## </summary>
2005 ## <param name="domain">
2006 ##      <summary>
2007 ##      Domain to not audit.
2008 ##      </summary>
2009 ## </param>
2010 #
2011 interface(`userdom_dontaudit_search_user_home_content',`
2012         gen_require(`
2013                 type user_home_t;
2014         ')
2015
2016         dontaudit $1 user_home_t:dir search_dir_perms;
2017         fs_dontaudit_list_nfs($1)
2018         fs_dontaudit_list_cifs($1)
2019 ')
2020
2021 ########################################
2022 ## <summary>
2023 ##      List contents of users home directory.
2024 ## </summary>
2025 ## <param name="domain">
2026 ##      <summary>
2027 ##      Domain allowed access.
2028 ##      </summary>
2029 ## </param>
2030 #
2031 interface(`userdom_list_user_home_content',`
2032         gen_require(`
2033                 type user_home_dir_t;
2034                 attribute user_home_type;
2035         ')
2036
2037         files_list_home($1)
2038         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2039 ')
2040
2041 ########################################
2042 ## <summary>
2043 ##      Create, read, write, and delete directories
2044 ##      in a user home subdirectory.
2045 ## </summary>
2046 ## <param name="domain">
2047 ##      <summary>
2048 ##      Domain allowed access.
2049 ##      </summary>
2050 ## </param>
2051 #
2052 interface(`userdom_manage_user_home_content_dirs',`
2053         gen_require(`
2054                 type user_home_dir_t, user_home_t;
2055         ')
2056
2057         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2058         files_search_home($1)
2059 ')
2060
2061 ########################################
2062 ## <summary>
2063 ##      Delete directories in a user home subdirectory.
2064 ## </summary>
2065 ## <param name="domain">
2066 ##      <summary>
2067 ##      Domain allowed access.
2068 ##      </summary>
2069 ## </param>
2070 #
2071 interface(`userdom_delete_user_home_content_dirs',`
2072         gen_require(`
2073                 type user_home_t;
2074         ')
2075
2076         allow $1 user_home_t:dir delete_dir_perms;
2077 ')
2078
2079 ########################################
2080 ## <summary>
2081 ##      Delete all directories in a user home subdirectory.
2082 ## </summary>
2083 ## <param name="domain">
2084 ##      <summary>
2085 ##      Domain allowed access.
2086 ##      </summary>
2087 ## </param>
2088 #
2089 interface(`userdom_delete_all_user_home_content_dirs',`
2090         gen_require(`
2091                 attribute user_home_type;
2092         ')
2093
2094         allow $1 user_home_type:dir delete_dir_perms;
2095 ')
2096
2097 ########################################
2098 ## <summary>
2099 ##      Set the attributes of user home files.
2100 ## </summary>
2101 ## <param name="domain">
2102 ##      <summary>
2103 ##      Domain allowed access.
2104 ##      </summary>
2105 ## </param>
2106 ## <rolecap/>
2107 #
2108 interface(`userdom_setattr_user_home_content_files',`
2109         gen_require(`
2110                 type user_home_t;
2111         ')
2112
2113         allow $1 user_home_t:file setattr;
2114 ')
2115
2116 ########################################
2117 ## <summary>
2118 ##      Do not audit attempts to set the
2119 ##      attributes of user home files.
2120 ## </summary>
2121 ## <param name="domain">
2122 ##      <summary>
2123 ##      Domain to not audit.
2124 ##      </summary>
2125 ## </param>
2126 #
2127 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2128         gen_require(`
2129                 type user_home_t;
2130         ')
2131
2132         dontaudit $1 user_home_t:file setattr_file_perms;
2133 ')
2134
2135 ########################################
2136 ## <summary>
2137 ##      Set the attributes of all user home directories.
2138 ## </summary>
2139 ## <param name="domain">
2140 ##      <summary>
2141 ##      Domain allowed access.
2142 ##      </summary>
2143 ## </param>
2144 ## <rolecap/>
2145 #
2146 interface(`userdom_setattr_all_user_home_content_dirs',`
2147         gen_require(`
2148                 attribute user_home_type;
2149         ')
2150
2151         allow $1 user_home_type:dir setattr_dir_perms;
2152 ')
2153
2154 ########################################
2155 ## <summary>
2156 ##      Mmap user home files.
2157 ## </summary>
2158 ## <param name="domain">
2159 ##      <summary>
2160 ##      Domain allowed access.
2161 ##      </summary>
2162 ## </param>
2163 #
2164 interface(`userdom_mmap_user_home_content_files',`
2165         gen_require(`
2166                 type user_home_dir_t, user_home_t;
2167         ')
2168
2169         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2170         files_search_home($1)
2171 ')
2172
2173 ########################################
2174 ## <summary>
2175 ##      Read user home files.
2176 ## </summary>
2177 ## <param name="domain">
2178 ##      <summary>
2179 ##      Domain allowed access.
2180 ##      </summary>
2181 ## </param>
2182 #
2183 interface(`userdom_read_user_home_content_files',`
2184         gen_require(`
2185                 type user_home_dir_t, user_home_t;
2186         ')
2187
2188         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2189         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2190         files_search_home($1)
2191 ')
2192
2193 ########################################
2194 ## <summary>
2195 ##      Do not audit attempts to getattr user home files.
2196 ## </summary>
2197 ## <param name="domain">
2198 ##      <summary>
2199 ##      Domain to not audit.
2200 ##      </summary>
2201 ## </param>
2202 #
2203 interface(`userdom_dontaudit_getattr_user_home_content',`
2204         gen_require(`
2205                 attribute user_home_type;
2206         ')
2207
2208         dontaudit $1 user_home_type:dir getattr;
2209         dontaudit $1 user_home_type:file getattr;
2210 ')
2211
2212 ########################################
2213 ## <summary>
2214 ##      Do not audit attempts to read user home files.
2215 ## </summary>
2216 ## <param name="domain">
2217 ##      <summary>
2218 ##      Domain to not audit.
2219 ##      </summary>
2220 ## </param>
2221 #
2222 interface(`userdom_dontaudit_read_user_home_content_files',`
2223         gen_require(`
2224                 attribute user_home_type;
2225                 type user_home_dir_t;
2226         ')
2227
2228         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2229         dontaudit $1 user_home_type:dir list_dir_perms;
2230         dontaudit $1 user_home_type:file read_file_perms;
2231         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2232 ')
2233
2234 ########################################
2235 ## <summary>
2236 ##      Do not audit attempts to append user home files.
2237 ## </summary>
2238 ## <param name="domain">
2239 ##      <summary>
2240 ##      Domain to not audit.
2241 ##      </summary>
2242 ## </param>
2243 #
2244 interface(`userdom_dontaudit_append_user_home_content_files',`
2245         gen_require(`
2246                 type user_home_t;
2247         ')
2248
2249         dontaudit $1 user_home_t:file append_file_perms;
2250 ')
2251
2252 ########################################
2253 ## <summary>
2254 ##      Do not audit attempts to write user home files.
2255 ## </summary>
2256 ## <param name="domain">
2257 ##      <summary>
2258 ##      Domain to not audit.
2259 ##      </summary>
2260 ## </param>
2261 #
2262 interface(`userdom_dontaudit_write_user_home_content_files',`
2263         gen_require(`
2264                 type user_home_t;
2265         ')
2266
2267         dontaudit $1 user_home_t:file write_file_perms;
2268 ')
2269
2270 ########################################
2271 ## <summary>
2272 ##      Delete files in a user home subdirectory.
2273 ## </summary>
2274 ## <param name="domain">
2275 ##      <summary>
2276 ##      Domain allowed access.
2277 ##      </summary>
2278 ## </param>
2279 #
2280 interface(`userdom_delete_user_home_content_files',`
2281         gen_require(`
2282                 type user_home_t;
2283         ')
2284
2285         allow $1 user_home_t:file delete_file_perms;
2286 ')
2287
2288 ########################################
2289 ## <summary>
2290 ##      Delete all files in a user home subdirectory.
2291 ## </summary>
2292 ## <param name="domain">
2293 ##      <summary>
2294 ##      Domain allowed access.
2295 ##      </summary>
2296 ## </param>
2297 #
2298 interface(`userdom_delete_all_user_home_content_files',`
2299         gen_require(`
2300                 attribute user_home_type;
2301         ')
2302
2303         allow $1 user_home_type:file delete_file_perms;
2304 ')
2305
2306 ########################################
2307 ## <summary>
2308 ##      Delete sock files in a user home subdirectory.
2309 ## </summary>
2310 ## <param name="domain">
2311 ##      <summary>
2312 ##      Domain allowed access.
2313 ##      </summary>
2314 ## </param>
2315 #
2316 interface(`userdom_delete_user_home_content_sock_files',`
2317         gen_require(`
2318                 type user_home_t;
2319         ')
2320
2321         allow $1 user_home_t:sock_file delete_file_perms;
2322 ')
2323
2324 ########################################
2325 ## <summary>
2326 ##      Delete all sock files in a user home subdirectory.
2327 ## </summary>
2328 ## <param name="domain">
2329 ##      <summary>
2330 ##      Domain allowed access.
2331 ##      </summary>
2332 ## </param>
2333 #
2334 interface(`userdom_delete_all_user_home_content_sock_files',`
2335         gen_require(`
2336                 attribute user_home_type;
2337         ')
2338
2339         allow $1 user_home_type:sock_file delete_file_perms;
2340 ')
2341
2342 ########################################
2343 ## <summary>
2344 ##      Do not audit attempts to write user home files.
2345 ## </summary>
2346 ## <param name="domain">
2347 ##      <summary>
2348 ##      Domain to not audit.
2349 ##      </summary>
2350 ## </param>
2351 #
2352 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2353         gen_require(`
2354                 type user_home_t;
2355         ')
2356
2357         dontaudit $1 user_home_t:file relabel_file_perms;
2358 ')
2359
2360 ########################################
2361 ## <summary>
2362 ##      Read user home subdirectory symbolic links.
2363 ## </summary>
2364 ## <param name="domain">
2365 ##      <summary>
2366 ##      Domain allowed access.
2367 ##      </summary>
2368 ## </param>
2369 #
2370 interface(`userdom_read_user_home_content_symlinks',`
2371         gen_require(`
2372                 type user_home_dir_t, user_home_t;
2373         ')
2374
2375         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2376 ')
2377
2378 ########################################
2379 ## <summary>
2380 ##      Execute user home files.
2381 ## </summary>
2382 ## <param name="domain">
2383 ##      <summary>
2384 ##      Domain allowed access.
2385 ##      </summary>
2386 ## </param>
2387 ## <rolecap/>
2388 #
2389 interface(`userdom_exec_user_home_content_files',`
2390         gen_require(`
2391                 type user_home_dir_t;
2392                 attribute user_home_type;
2393         ')
2394
2395         files_search_home($1)
2396         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2397         dontaudit $1 user_home_type:sock_file execute;
2398         ')
2399
2400 ########################################
2401 ## <summary>
2402 ##      Do not audit attempts to execute user home files.
2403 ## </summary>
2404 ## <param name="domain">
2405 ##      <summary>
2406 ##      Domain to not audit.
2407 ##      </summary>
2408 ## </param>
2409 #
2410 interface(`userdom_dontaudit_exec_user_home_content_files',`
2411         gen_require(`
2412                 type user_home_t;
2413         ')
2414
2415         dontaudit $1 user_home_t:file exec_file_perms;
2416 ')
2417
2418 ########################################
2419 ## <summary>
2420 ##      Create, read, write, and delete files
2421 ##      in a user home subdirectory.
2422 ## </summary>
2423 ## <param name="domain">
2424 ##      <summary>
2425 ##      Domain allowed access.
2426 ##      </summary>
2427 ## </param>
2428 #
2429 interface(`userdom_manage_user_home_content_files',`
2430         gen_require(`
2431                 type user_home_dir_t, user_home_t;
2432         ')
2433
2434         manage_files_pattern($1, user_home_t, user_home_t)
2435         allow $1 user_home_dir_t:dir search_dir_perms;
2436         files_search_home($1)
2437 ')
2438
2439 ########################################
2440 ## <summary>
2441 ##      Do not audit attempts to create, read, write, and delete directories
2442 ##      in a user home subdirectory.
2443 ## </summary>
2444 ## <param name="domain">
2445 ##      <summary>
2446 ##      Domain to not audit.
2447 ##      </summary>
2448 ## </param>
2449 #
2450 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2451         gen_require(`
2452                 type user_home_dir_t, user_home_t;
2453         ')
2454
2455         dontaudit $1 user_home_t:dir manage_dir_perms;
2456 ')
2457
2458 ########################################
2459 ## <summary>
2460 ##      Create, read, write, and delete symbolic links
2461 ##      in a user home subdirectory.
2462 ## </summary>
2463 ## <param name="domain">
2464 ##      <summary>
2465 ##      Domain allowed access.
2466 ##      </summary>
2467 ## </param>
2468 #
2469 interface(`userdom_manage_user_home_content_symlinks',`
2470         gen_require(`
2471                 type user_home_dir_t, user_home_t;
2472         ')
2473
2474         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2475         allow $1 user_home_dir_t:dir search_dir_perms;
2476         files_search_home($1)
2477 ')
2478
2479 ########################################
2480 ## <summary>
2481 ##      Delete symbolic links in a user home directory.
2482 ## </summary>
2483 ## <param name="domain">
2484 ##      <summary>
2485 ##      Domain allowed access.
2486 ##      </summary>
2487 ## </param>
2488 #
2489 interface(`userdom_delete_user_home_content_symlinks',`
2490         gen_require(`
2491                 type user_home_t;
2492         ')
2493
2494         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2495 ')
2496
2497 ########################################
2498 ## <summary>
2499 ##      Delete all symbolic links in a user home directory.
2500 ## </summary>
2501 ## <param name="domain">
2502 ##      <summary>
2503 ##      Domain allowed access.
2504 ##      </summary>
2505 ## </param>
2506 #
2507 interface(`userdom_delete_all_user_home_content_symlinks',`
2508         gen_require(`
2509                 attribute user_home_type;
2510         ')
2511
2512         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2513 ')
2514
2515 ########################################
2516 ## <summary>
2517 ##      Create, read, write, and delete named pipes
2518 ##      in a user home subdirectory.
2519 ## </summary>
2520 ## <param name="domain">
2521 ##      <summary>
2522 ##      Domain allowed access.
2523 ##      </summary>
2524 ## </param>
2525 #
2526 interface(`userdom_manage_user_home_content_pipes',`
2527         gen_require(`
2528                 type user_home_dir_t, user_home_t;
2529         ')
2530
2531         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2532         allow $1 user_home_dir_t:dir search_dir_perms;
2533         files_search_home($1)
2534 ')
2535
2536 ########################################
2537 ## <summary>
2538 ##      Create, read, write, and delete named sockets
2539 ##      in a user home subdirectory.
2540 ## </summary>
2541 ## <param name="domain">
2542 ##      <summary>
2543 ##      Domain allowed access.
2544 ##      </summary>
2545 ## </param>
2546 #
2547 interface(`userdom_manage_user_home_content_sockets',`
2548         gen_require(`
2549                 type user_home_dir_t, user_home_t;
2550         ')
2551
2552         allow $1 user_home_dir_t:dir search_dir_perms;
2553         manage_sock_files_pattern($1, user_home_t, user_home_t)
2554         files_search_home($1)
2555 ')
2556
2557 ########################################
2558 ## <summary>
2559 ##      Create objects in a user home directory
2560 ##      with an automatic type transition to
2561 ##      a specified private type.
2562 ## </summary>
2563 ## <param name="domain">
2564 ##      <summary>
2565 ##      Domain allowed access.
2566 ##      </summary>
2567 ## </param>
2568 ## <param name="private_type">
2569 ##      <summary>
2570 ##      The type of the object to create.
2571 ##      </summary>
2572 ## </param>
2573 ## <param name="object_class">
2574 ##      <summary>
2575 ##      The class of the object to be created.
2576 ##      </summary>
2577 ## </param>
2578 #
2579 interface(`userdom_user_home_dir_filetrans',`
2580         gen_require(`
2581                 type user_home_dir_t;
2582         ')
2583
2584         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2585         files_search_home($1)
2586 ')
2587
2588 ########################################
2589 ## <summary>
2590 ##      Create objects in a user home directory
2591 ##      with an automatic type transition to
2592 ##      a specified private type.
2593 ## </summary>
2594 ## <param name="domain">
2595 ##      <summary>
2596 ##      Domain allowed access.
2597 ##      </summary>
2598 ## </param>
2599 ## <param name="private_type">
2600 ##      <summary>
2601 ##      The type of the object to create.
2602 ##      </summary>
2603 ## </param>
2604 ## <param name="object_class">
2605 ##      <summary>
2606 ##      The class of the object to be created.
2607 ##      </summary>
2608 ## </param>
2609 #
2610 interface(`userdom_user_home_content_filetrans',`
2611         gen_require(`
2612                 type user_home_dir_t, user_home_t;
2613         ')
2614
2615         filetrans_pattern($1, user_home_t, $2, $3)
2616         allow $1 user_home_dir_t:dir search_dir_perms;
2617         files_search_home($1)
2618 ')
2619
2620 ########################################
2621 ## <summary>
2622 ##      Create objects in a user home directory
2623 ##      with an automatic type transition to
2624 ##      the user home file type.
2625 ## </summary>
2626 ## <param name="domain">
2627 ##      <summary>
2628 ##      Domain allowed access.
2629 ##      </summary>
2630 ## </param>
2631 ## <param name="object_class">
2632 ##      <summary>
2633 ##      The class of the object to be created.
2634 ##      </summary>
2635 ## </param>
2636 #
2637 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2638         gen_require(`
2639                 type user_home_dir_t, user_home_t;
2640         ')
2641
2642         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2643         files_search_home($1)
2644 ')
2645
2646 ########################################
2647 ## <summary>
2648 ##      Write to user temporary named sockets.
2649 ## </summary>
2650 ## <param name="domain">
2651 ##      <summary>
2652 ##      Domain allowed access.
2653 ##      </summary>
2654 ## </param>
2655 #
2656 interface(`userdom_write_user_tmp_sockets',`
2657         gen_require(`
2658                 type user_tmp_t;
2659         ')
2660
2661         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2662         files_search_tmp($1)
2663 ')
2664
2665 ########################################
2666 ## <summary>
2667 ##      List user temporary directories.
2668 ## </summary>
2669 ## <param name="domain">
2670 ##      <summary>
2671 ##      Domain allowed access.
2672 ##      </summary>
2673 ## </param>
2674 #
2675 interface(`userdom_list_user_tmp',`
2676         gen_require(`
2677                 type user_tmp_t;
2678         ')
2679
2680         allow $1 user_tmp_t:dir list_dir_perms;
2681         files_search_tmp($1)
2682 ')
2683
2684 ########################################
2685 ## <summary>
2686 ##      Do not audit attempts to list user
2687 ##      temporary directories.
2688 ## </summary>
2689 ## <param name="domain">
2690 ##      <summary>
2691 ##      Domain to not audit.
2692 ##      </summary>
2693 ## </param>
2694 #
2695 interface(`userdom_dontaudit_list_user_tmp',`
2696         gen_require(`
2697                 type user_tmp_t;
2698         ')
2699
2700         dontaudit $1 user_tmp_t:dir list_dir_perms;
2701 ')
2702
2703 ########################################
2704 ## <summary>
2705 ##      Do not audit attempts to manage users
2706 ##      temporary directories.
2707 ## </summary>
2708 ## <param name="domain">
2709 ##      <summary>
2710 ##      Domain to not audit.
2711 ##      </summary>
2712 ## </param>
2713 #
2714 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2715         gen_require(`
2716                 type user_tmp_t;
2717         ')
2718
2719         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2720 ')
2721
2722 ########################################
2723 ## <summary>
2724 ##      Read user temporary files.
2725 ## </summary>
2726 ## <param name="domain">
2727 ##      <summary>
2728 ##      Domain allowed access.
2729 ##      </summary>
2730 ## </param>
2731 #
2732 interface(`userdom_read_user_tmp_files',`
2733         gen_require(`
2734                 type user_tmp_t;
2735         ')
2736
2737         read_files_pattern($1, user_tmp_t, user_tmp_t)
2738         allow $1 user_tmp_t:dir list_dir_perms;
2739         files_search_tmp($1)
2740 ')
2741
2742 ########################################
2743 ## <summary>
2744 ##      Do not audit attempts to read users
2745 ##      temporary files.
2746 ## </summary>
2747 ## <param name="domain">
2748 ##      <summary>
2749 ##      Domain to not audit.
2750 ##      </summary>
2751 ## </param>
2752 #
2753 interface(`userdom_dontaudit_read_user_tmp_files',`
2754         gen_require(`
2755                 type user_tmp_t;
2756         ')
2757
2758         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2759 ')
2760
2761 ########################################
2762 ## <summary>
2763 ##      Do not audit attempts to append users
2764 ##      temporary files.
2765 ## </summary>
2766 ## <param name="domain">
2767 ##      <summary>
2768 ##      Domain to not audit.
2769 ##      </summary>
2770 ## </param>
2771 #
2772 interface(`userdom_dontaudit_append_user_tmp_files',`
2773         gen_require(`
2774                 type user_tmp_t;
2775         ')
2776
2777         dontaudit $1 user_tmp_t:file append_file_perms;
2778 ')
2779
2780 ########################################
2781 ## <summary>
2782 ##      Read and write user temporary files.
2783 ## </summary>
2784 ## <param name="domain">
2785 ##      <summary>
2786 ##      Domain allowed access.
2787 ##      </summary>
2788 ## </param>
2789 #
2790 interface(`userdom_rw_user_tmp_files',`
2791         gen_require(`
2792                 type user_tmp_t;
2793         ')
2794
2795         allow $1 user_tmp_t:dir list_dir_perms;
2796         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2797         files_search_tmp($1)
2798 ')
2799
2800 ########################################
2801 ## <summary>
2802 ##      Do not audit attempts to manage users
2803 ##      temporary files.
2804 ## </summary>
2805 ## <param name="domain">
2806 ##      <summary>
2807 ##      Domain to not audit.
2808 ##      </summary>
2809 ## </param>
2810 #
2811 interface(`userdom_dontaudit_manage_user_tmp_files',`
2812         gen_require(`
2813                 type user_tmp_t;
2814         ')
2815
2816         dontaudit $1 user_tmp_t:file manage_file_perms;
2817 ')
2818
2819 ########################################
2820 ## <summary>
2821 ##      Read user temporary symbolic links.
2822 ## </summary>
2823 ## <param name="domain">
2824 ##      <summary>
2825 ##      Domain allowed access.
2826 ##      </summary>
2827 ## </param>
2828 #
2829 interface(`userdom_read_user_tmp_symlinks',`
2830         gen_require(`
2831                 type user_tmp_t;
2832         ')
2833
2834         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2835         allow $1 user_tmp_t:dir list_dir_perms;
2836         files_search_tmp($1)
2837 ')
2838
2839 ########################################
2840 ## <summary>
2841 ##      Create, read, write, and delete user
2842 ##      temporary directories.
2843 ## </summary>
2844 ## <param name="domain">
2845 ##      <summary>
2846 ##      Domain allowed access.
2847 ##      </summary>
2848 ## </param>
2849 #
2850 interface(`userdom_manage_user_tmp_dirs',`
2851         gen_require(`
2852                 type user_tmp_t;
2853         ')
2854
2855         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2856         files_search_tmp($1)
2857 ')
2858
2859 ########################################
2860 ## <summary>
2861 ##      Create, read, write, and delete user
2862 ##      temporary files.
2863 ## </summary>
2864 ## <param name="domain">
2865 ##      <summary>
2866 ##      Domain allowed access.
2867 ##      </summary>
2868 ## </param>
2869 #
2870 interface(`userdom_manage_user_tmp_files',`
2871         gen_require(`
2872                 type user_tmp_t;
2873         ')
2874
2875         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2876         files_search_tmp($1)
2877 ')
2878
2879 ########################################
2880 ## <summary>
2881 ##      Create, read, write, and delete user
2882 ##      temporary symbolic links.
2883 ## </summary>
2884 ## <param name="domain">
2885 ##      <summary>
2886 ##      Domain allowed access.
2887 ##      </summary>
2888 ## </param>
2889 #
2890 interface(`userdom_manage_user_tmp_symlinks',`
2891         gen_require(`
2892                 type user_tmp_t;
2893         ')
2894
2895         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2896         files_search_tmp($1)
2897 ')
2898
2899 ########################################
2900 ## <summary>
2901 ##      Create, read, write, and delete user
2902 ##      temporary named pipes.
2903 ## </summary>
2904 ## <param name="domain">
2905 ##      <summary>
2906 ##      Domain allowed access.
2907 ##      </summary>
2908 ## </param>
2909 #
2910 interface(`userdom_manage_user_tmp_pipes',`
2911         gen_require(`
2912                 type user_tmp_t;
2913         ')
2914
2915         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2916         files_search_tmp($1)
2917 ')
2918
2919 ########################################
2920 ## <summary>
2921 ##      Create, read, write, and delete user
2922 ##      temporary named sockets.
2923 ## </summary>
2924 ## <param name="domain">
2925 ##      <summary>
2926 ##      Domain allowed access.
2927 ##      </summary>
2928 ## </param>
2929 #
2930 interface(`userdom_manage_user_tmp_sockets',`
2931         gen_require(`
2932                 type user_tmp_t;
2933         ')
2934
2935         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2936         files_search_tmp($1)
2937 ')
2938
2939 ########################################
2940 ## <summary>
2941 ##      Create objects in a user temporary directory
2942 ##      with an automatic type transition to
2943 ##      a specified private type.
2944 ## </summary>
2945 ## <param name="domain">
2946 ##      <summary>
2947 ##      Domain allowed access.
2948 ##      </summary>
2949 ## </param>
2950 ## <param name="private_type">
2951 ##      <summary>
2952 ##      The type of the object to create.
2953 ##      </summary>
2954 ## </param>
2955 ## <param name="object_class">
2956 ##      <summary>
2957 ##      The class of the object to be created.
2958 ##      </summary>
2959 ## </param>
2960 #
2961 interface(`userdom_user_tmp_filetrans',`
2962         gen_require(`
2963                 type user_tmp_t;
2964         ')
2965
2966         filetrans_pattern($1, user_tmp_t, $2, $3)
2967         files_search_tmp($1)
2968 ')
2969
2970 ########################################
2971 ## <summary>
2972 ##      Create objects in the temporary directory
2973 ##      with an automatic type transition to
2974 ##      the user temporary type.
2975 ## </summary>
2976 ## <param name="domain">
2977 ##      <summary>
2978 ##      Domain allowed access.
2979 ##      </summary>
2980 ## </param>
2981 ## <param name="object_class">
2982 ##      <summary>
2983 ##      The class of the object to be created.
2984 ##      </summary>
2985 ## </param>
2986 #
2987 interface(`userdom_tmp_filetrans_user_tmp',`
2988         gen_require(`
2989                 type user_tmp_t;
2990         ')
2991
2992         files_tmp_filetrans($1, user_tmp_t, $2)
2993 ')
2994
2995 ########################################
2996 ## <summary>
2997 ##      Read user tmpfs files.
2998 ## </summary>
2999 ## <param name="domain">
3000 ##      <summary>
3001 ##      Domain allowed access.
3002 ##      </summary>
3003 ## </param>
3004 #
3005 interface(`userdom_read_user_tmpfs_files',`
3006         gen_require(`
3007                 type user_tmpfs_t;
3008         ')
3009
3010         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3011         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3012         allow $1 user_tmpfs_t:dir list_dir_perms;
3013         fs_search_tmpfs($1)
3014 ')
3015
3016 ########################################
3017 ## <summary>
3018 ##      Read/Write user tmpfs files.
3019 ## </summary>
3020 ## <param name="domain">
3021 ##      <summary>
3022 ##      Domain allowed access.
3023 ##      </summary>
3024 ## </param>
3025 #
3026 interface(`userdom_rw_user_tmpfs_files',`
3027         gen_require(`
3028                 type user_tmpfs_t;
3029         ')
3030
3031         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3032         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3033         allow $1 user_tmpfs_t:dir list_dir_perms;
3034         fs_search_tmpfs($1)
3035 ')
3036
3037 ########################################
3038 ## <summary>
3039 ##      Get the attributes of a user domain tty.
3040 ## </summary>
3041 ## <param name="domain">
3042 ##      <summary>
3043 ##      Domain allowed access.
3044 ##      </summary>
3045 ## </param>
3046 #
3047 interface(`userdom_getattr_user_ttys',`
3048         gen_require(`
3049                 type user_tty_device_t;
3050         ')
3051
3052         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3053 ')
3054
3055 ########################################
3056 ## <summary>
3057 ##      Do not audit attempts to get the attributes of a user domain tty.
3058 ## </summary>
3059 ## <param name="domain">
3060 ##      <summary>
3061 ##      Domain to not audit.
3062 ##      </summary>
3063 ## </param>
3064 #
3065 interface(`userdom_dontaudit_getattr_user_ttys',`
3066         gen_require(`
3067                 type user_tty_device_t;
3068         ')
3069
3070         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3071 ')
3072
3073 ########################################
3074 ## <summary>
3075 ##      Set the attributes of a user domain tty.
3076 ## </summary>
3077 ## <param name="domain">
3078 ##      <summary>
3079 ##      Domain allowed access.
3080 ##      </summary>
3081 ## </param>
3082 #
3083 interface(`userdom_setattr_user_ttys',`
3084         gen_require(`
3085                 type user_tty_device_t;
3086         ')
3087
3088         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3089 ')
3090
3091 ########################################
3092 ## <summary>
3093 ##      Do not audit attempts to set the attributes of a user domain tty.
3094 ## </summary>
3095 ## <param name="domain">
3096 ##      <summary>
3097 ##      Domain to not audit.
3098 ##      </summary>
3099 ## </param>
3100 #
3101 interface(`userdom_dontaudit_setattr_user_ttys',`
3102         gen_require(`
3103                 type user_tty_device_t;
3104         ')
3105
3106         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3107 ')
3108
3109 ########################################
3110 ## <summary>
3111 ##      Read and write a user domain tty.
3112 ## </summary>
3113 ## <param name="domain">
3114 ##      <summary>
3115 ##      Domain allowed access.
3116 ##      </summary>
3117 ## </param>
3118 #
3119 interface(`userdom_use_user_ttys',`
3120         gen_require(`
3121                 type user_tty_device_t;
3122         ')
3123
3124         allow $1 user_tty_device_t:chr_file rw_term_perms;
3125 ')
3126
3127 ########################################
3128 ## <summary>
3129 ##      Read and write a inherited user domain tty.
3130 ## </summary>
3131 ## <param name="domain">
3132 ##      <summary>
3133 ##      Domain allowed access.
3134 ##      </summary>
3135 ## </param>
3136 #
3137 interface(`userdom_use_inherited_user_ttys',`
3138         gen_require(`
3139                 type user_tty_device_t;
3140         ')
3141
3142         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3143 ')
3144
3145 ########################################
3146 ## <summary>
3147 ##      Read and write a user domain pty.
3148 ## </summary>
3149 ## <param name="domain">
3150 ##      <summary>
3151 ##      Domain allowed access.
3152 ##      </summary>
3153 ## </param>
3154 #
3155 interface(`userdom_use_user_ptys',`
3156         gen_require(`
3157                 type user_devpts_t;
3158         ')
3159
3160         allow $1 user_devpts_t:chr_file rw_term_perms;
3161 ')
3162
3163 ########################################
3164 ## <summary>
3165 ##      Read and write a inherited user domain pty.
3166 ## </summary>
3167 ## <param name="domain">
3168 ##      <summary>
3169 ##      Domain allowed access.
3170 ##      </summary>
3171 ## </param>
3172 #
3173 interface(`userdom_use_inherited_user_ptys',`
3174         gen_require(`
3175                 type user_devpts_t;
3176         ')
3177
3178         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3179 ')
3180
3181 ########################################
3182 ## <summary>
3183 ##      Read and write a inherited user TTYs and PTYs.
3184 ## </summary>
3185 ## <desc>
3186 ##      <p>
3187 ##      Allow the specified domain to read and write inherited user
3188 ##      TTYs and PTYs. This will allow the domain to
3189 ##      interact with the user via the terminal. Typically
3190 ##      all interactive applications will require this
3191 ##      access.
3192 ##      </p>
3193 ## </desc>
3194 ## <param name="domain">
3195 ##      <summary>
3196 ##      Domain allowed access.
3197 ##      </summary>
3198 ## </param>
3199 ## <infoflow type="both" weight="10"/>
3200 #
3201 interface(`userdom_use_inherited_user_terminals',`
3202         gen_require(`
3203                 type user_tty_device_t, user_devpts_t;
3204         ')
3205
3206         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3207         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3208 ')
3209
3210 #######################################
3211 ## <summary>
3212 ##  Allow attempts to read and write
3213 ##  a user domain tty and pty.
3214 ## </summary>
3215 ## <param name="domain">
3216 ##  <summary>
3217 ##  Domain to not audit.
3218 ##  </summary>
3219 ## </param>
3220 #
3221 interface(`userdom_use_user_terminals',`
3222     gen_require(`
3223         type user_tty_device_t, user_devpts_t;
3224     ')
3225
3226     allow $1 user_tty_device_t:chr_file rw_term_perms;
3227     allow $1 user_devpts_t:chr_file rw_term_perms;
3228 ')
3229
3230 ########################################
3231 ## <summary>
3232 ##      Do not audit attempts to read and write
3233 ##      a user domain tty and pty.
3234 ## </summary>
3235 ## <param name="domain">
3236 ##      <summary>
3237 ##      Domain to not audit.
3238 ##      </summary>
3239 ## </param>
3240 #
3241 interface(`userdom_dontaudit_use_user_terminals',`
3242         gen_require(`
3243                 type user_tty_device_t, user_devpts_t;
3244         ')
3245
3246         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3247         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3248 ')
3249
3250
3251 ########################################
3252 ## <summary>
3253 ##      Get attributes of user domain tty and pty.
3254 ## </summary>
3255 ## <param name="domain">
3256 ##      <summary>
3257 ##      Domain allowed access.
3258 ##      </summary>
3259 ## </param>
3260 #
3261 interface(`userdom_getattr_user_terminals',`
3262         gen_require(`
3263                 type user_tty_device_t, user_devpts_t;
3264         ')
3265
3266         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3267 ')
3268
3269 ########################################
3270 ## <summary>
3271 ##      Execute a shell in all user domains.  This
3272 ##      is an explicit transition, requiring the
3273 ##      caller to use setexeccon().
3274 ## </summary>
3275 ## <param name="domain">
3276 ##      <summary>
3277 ##      Domain allowed to transition.
3278 ##      </summary>
3279 ## </param>
3280 #
3281 interface(`userdom_spec_domtrans_all_users',`
3282         gen_require(`
3283                 attribute userdomain;
3284         ')
3285
3286         corecmd_shell_spec_domtrans($1, userdomain)
3287         allow userdomain $1:fd use;
3288         allow userdomain $1:fifo_file rw_file_perms;
3289         allow userdomain $1:process sigchld;
3290 ')
3291
3292 ########################################
3293 ## <summary>
3294 ##      Execute an Xserver session in all unprivileged user domains.  This
3295 ##      is an explicit transition, requiring the
3296 ##      caller to use setexeccon().
3297 ## </summary>
3298 ## <param name="domain">
3299 ##      <summary>
3300 ##      Domain allowed to transition.
3301 ##      </summary>
3302 ## </param>
3303 #
3304 interface(`userdom_xsession_spec_domtrans_all_users',`
3305         gen_require(`
3306                 attribute userdomain;
3307         ')
3308
3309         xserver_xsession_spec_domtrans($1, userdomain)
3310         allow userdomain $1:fd use;
3311         allow userdomain $1:fifo_file rw_file_perms;
3312         allow userdomain $1:process sigchld;
3313 ')
3314
3315 ########################################
3316 ## <summary>
3317 ##      Execute a shell in all unprivileged user domains.  This
3318 ##      is an explicit transition, requiring the
3319 ##      caller to use setexeccon().
3320 ## </summary>
3321 ## <param name="domain">
3322 ##      <summary>
3323 ##      Domain allowed to transition.
3324 ##      </summary>
3325 ## </param>
3326 #
3327 interface(`userdom_spec_domtrans_unpriv_users',`
3328         gen_require(`
3329                 attribute unpriv_userdomain;
3330         ')
3331
3332         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3333         allow unpriv_userdomain $1:fd use;
3334         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3335         allow unpriv_userdomain $1:process sigchld;
3336 ')
3337
3338 ########################################
3339 ## <summary>
3340 ##      Execute an Xserver session in all unprivileged user domains.  This
3341 ##      is an explicit transition, requiring the
3342 ##      caller to use setexeccon().
3343 ## </summary>
3344 ## <param name="domain">
3345 ##      <summary>
3346 ##      Domain allowed to transition.
3347 ##      </summary>
3348 ## </param>
3349 #
3350 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3351         gen_require(`
3352                 attribute unpriv_userdomain;
3353         ')
3354
3355         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3356         allow unpriv_userdomain $1:fd use;
3357         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3358         allow unpriv_userdomain $1:process sigchld;
3359 ')
3360
3361 ########################################
3362 ## <summary>
3363 ##      Manage unpriviledged user SysV sempaphores.
3364 ## </summary>
3365 ## <param name="domain">
3366 ##      <summary>
3367 ##      Domain allowed access.
3368 ##      </summary>
3369 ## </param>
3370 #
3371 interface(`userdom_manage_unpriv_user_semaphores',`
3372         gen_require(`
3373                 attribute unpriv_userdomain;
3374         ')
3375
3376         allow $1 unpriv_userdomain:sem create_sem_perms;
3377 ')
3378
3379 ########################################
3380 ## <summary>
3381 ##      Manage unpriviledged user SysV shared
3382 ##      memory segments.
3383 ## </summary>
3384 ## <param name="domain">
3385 ##      <summary>
3386 ##      Domain allowed access.
3387 ##      </summary>
3388 ## </param>
3389 #
3390 interface(`userdom_manage_unpriv_user_shared_mem',`
3391         gen_require(`
3392                 attribute unpriv_userdomain;
3393         ')
3394
3395         allow $1 unpriv_userdomain:shm create_shm_perms;
3396 ')
3397
3398 ########################################
3399 ## <summary>
3400 ##      Execute bin_t in the unprivileged user domains. This
3401 ##      is an explicit transition, requiring the
3402 ##      caller to use setexeccon().
3403 ## </summary>
3404 ## <param name="domain">
3405 ##      <summary>
3406 ##      Domain allowed to transition.
3407 ##      </summary>
3408 ## </param>
3409 #
3410 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3411         gen_require(`
3412                 attribute unpriv_userdomain;
3413         ')
3414
3415         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3416         allow unpriv_userdomain $1:fd use;
3417         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3418         allow unpriv_userdomain $1:process sigchld;
3419 ')
3420
3421 ########################################
3422 ## <summary>
3423 ##      Execute all entrypoint files in unprivileged user
3424 ##      domains. This is an explicit transition, requiring the
3425 ##      caller to use setexeccon().
3426 ## </summary>
3427 ## <param name="domain">
3428 ##      <summary>
3429 ##      Domain allowed access.
3430 ##      </summary>
3431 ## </param>
3432 #
3433 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3434         gen_require(`
3435                 attribute unpriv_userdomain;
3436         ')
3437
3438         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3439         allow unpriv_userdomain $1:fd use;
3440         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3441         allow unpriv_userdomain $1:process sigchld;
3442 ')
3443
3444 ########################################
3445 ## <summary>
3446 ##      Search users home directories.
3447 ## </summary>
3448 ## <param name="domain">
3449 ##      <summary>
3450 ##      Domain allowed access.
3451 ##      </summary>
3452 ## </param>
3453 #
3454 interface(`userdom_search_user_home_content',`
3455         gen_require(`
3456                 type user_home_dir_t;
3457                 attribute user_home_type;
3458         ')
3459
3460         files_list_home($1)
3461         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3462         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3463 ')
3464
3465 ########################################
3466 ## <summary>
3467 ##      Send general signals to unprivileged user domains.
3468 ## </summary>
3469 ## <param name="domain">
3470 ##      <summary>
3471 ##      Domain allowed access.
3472 ##      </summary>
3473 ## </param>
3474 #
3475 interface(`userdom_signal_unpriv_users',`
3476         gen_require(`
3477                 attribute unpriv_userdomain;
3478         ')
3479
3480         allow $1 unpriv_userdomain:process signal;
3481 ')
3482
3483 ########################################
3484 ## <summary>
3485 ##      Inherit the file descriptors from unprivileged user domains.
3486 ## </summary>
3487 ## <param name="domain">
3488 ##      <summary>
3489 ##      Domain allowed access.
3490 ##      </summary>
3491 ## </param>
3492 #
3493 interface(`userdom_use_unpriv_users_fds',`
3494         gen_require(`
3495                 attribute unpriv_userdomain;
3496         ')
3497
3498         allow $1 unpriv_userdomain:fd use;
3499 ')
3500
3501 ########################################
3502 ## <summary>
3503 ##      Do not audit attempts to inherit the file descriptors
3504 ##      from unprivileged user domains.
3505 ## </summary>
3506 ## <desc>
3507 ##      <p>
3508 ##      Do not audit attempts to inherit the file descriptors
3509 ##      from unprivileged user domains. This will supress
3510 ##      SELinux denial messages when the specified domain is denied
3511 ##      the permission to inherit these file descriptors.
3512 ##      </p>
3513 ## </desc>
3514 ## <param name="domain">
3515 ##      <summary>
3516 ##      Domain to not audit.
3517 ##      </summary>
3518 ## </param>
3519 ## <infoflow type="none"/>
3520 #
3521 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3522         gen_require(`
3523                 attribute unpriv_userdomain;
3524         ')
3525
3526         dontaudit $1 unpriv_userdomain:fd use;
3527 ')
3528
3529 ########################################
3530 ## <summary>
3531 ##      Do not audit attempts to use user ptys.
3532 ## </summary>
3533 ## <param name="domain">
3534 ##      <summary>
3535 ##      Domain to not audit.
3536 ##      </summary>
3537 ## </param>
3538 #
3539 interface(`userdom_dontaudit_use_user_ptys',`
3540         gen_require(`
3541                 type user_devpts_t;
3542         ')
3543
3544         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3545 ')
3546
3547 ########################################
3548 ## <summary>
3549 ##      Relabel files to unprivileged user pty types.
3550 ## </summary>
3551 ## <param name="domain">
3552 ##      <summary>
3553 ##      Domain allowed access.
3554 ##      </summary>
3555 ## </param>
3556 #
3557 interface(`userdom_relabelto_user_ptys',`
3558         gen_require(`
3559                 type user_devpts_t;
3560         ')
3561
3562         allow $1 user_devpts_t:chr_file relabelto;
3563 ')
3564
3565 ########################################
3566 ## <summary>
3567 ##      Do not audit attempts to relabel files from
3568 ##      user pty types.
3569 ## </summary>
3570 ## <param name="domain">
3571 ##      <summary>
3572 ##      Domain to not audit.
3573 ##      </summary>
3574 ## </param>
3575 #
3576 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3577         gen_require(`
3578                 type user_devpts_t;
3579         ')
3580
3581         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3582 ')
3583
3584 ########################################
3585 ## <summary>
3586 ##      Write all users files in /tmp
3587 ## </summary>
3588 ## <param name="domain">
3589 ##      <summary>
3590 ##      Domain allowed access.
3591 ##      </summary>
3592 ## </param>
3593 #
3594 interface(`userdom_write_user_tmp_files',`
3595         gen_require(`
3596                 type user_tmp_t;
3597         ')
3598
3599         write_files_pattern($1, user_tmp_t, user_tmp_t)
3600 ')
3601
3602 ########################################
3603 ## <summary>
3604 ##      Do not audit attempts to write users
3605 ##      temporary files.
3606 ## </summary>
3607 ## <param name="domain">
3608 ##      <summary>
3609 ##      Domain to not audit.
3610 ##      </summary>
3611 ## </param>
3612 #
3613 interface(`userdom_dontaudit_write_user_tmp_files',`
3614         gen_require(`
3615                 type user_tmp_t;
3616         ')
3617
3618         dontaudit $1 user_tmp_t:file write;
3619 ')
3620
3621 ########################################
3622 ## <summary>
3623 ##      Do not audit attempts to read/write users
3624 ##      temporary fifo files.
3625 ## </summary>
3626 ## <param name="domain">
3627 ##      <summary>
3628 ##      Domain to not audit.
3629 ##      </summary>
3630 ## </param>
3631 #
3632 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3633         gen_require(`
3634                 type user_tmp_t;
3635         ')
3636
3637         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3638 ')
3639
3640 ########################################
3641 ## <summary>
3642 ##      Do not audit attempts to use user ttys.
3643 ## </summary>
3644 ## <param name="domain">
3645 ##      <summary>
3646 ##      Domain to not audit.
3647 ##      </summary>
3648 ## </param>
3649 #
3650 interface(`userdom_dontaudit_use_user_ttys',`
3651         gen_require(`
3652                 type user_tty_device_t;
3653         ')
3654
3655         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3656 ')
3657
3658 ########################################
3659 ## <summary>
3660 ##      Read the process state of all user domains.
3661 ## </summary>
3662 ## <param name="domain">
3663 ##      <summary>
3664 ##      Domain allowed access.
3665 ##      </summary>
3666 ## </param>
3667 #
3668 interface(`userdom_read_all_users_state',`
3669         gen_require(`
3670                 attribute userdomain;
3671         ')
3672
3673         read_files_pattern($1, userdomain, userdomain)
3674         read_lnk_files_pattern($1,userdomain,userdomain)
3675         kernel_search_proc($1)
3676 ')
3677
3678 ########################################
3679 ## <summary>
3680 ##      Get the attributes of all user domains.
3681 ## </summary>
3682 ## <param name="domain">
3683 ##      <summary>
3684 ##      Domain allowed access.
3685 ##      </summary>
3686 ## </param>
3687 #
3688 interface(`userdom_getattr_all_users',`
3689         gen_require(`
3690                 attribute userdomain;
3691         ')
3692
3693         allow $1 userdomain:process getattr;
3694 ')
3695
3696 ########################################
3697 ## <summary>
3698 ##      Inherit the file descriptors from all user domains
3699 ## </summary>
3700 ## <param name="domain">
3701 ##      <summary>
3702 ##      Domain allowed access.
3703 ##      </summary>
3704 ## </param>
3705 #
3706 interface(`userdom_use_all_users_fds',`
3707         gen_require(`
3708                 attribute userdomain;
3709         ')
3710
3711         allow $1 userdomain:fd use;
3712 ')
3713
3714 ########################################
3715 ## <summary>
3716 ##      Do not audit attempts to inherit the file
3717 ##      descriptors from any user domains.
3718 ## </summary>
3719 ## <param name="domain">
3720 ##      <summary>
3721 ##      Domain to not audit.
3722 ##      </summary>
3723 ## </param>
3724 #
3725 interface(`userdom_dontaudit_use_all_users_fds',`
3726         gen_require(`
3727                 attribute userdomain;
3728         ')
3729
3730         dontaudit $1 userdomain:fd use;
3731 ')
3732
3733 ########################################
3734 ## <summary>
3735 ##      Send general signals to all user domains.
3736 ## </summary>
3737 ## <param name="domain">
3738 ##      <summary>
3739 ##      Domain allowed access.
3740 ##      </summary>
3741 ## </param>
3742 #
3743 interface(`userdom_signal_all_users',`
3744         gen_require(`
3745                 attribute userdomain;
3746         ')
3747
3748         allow $1 userdomain:process signal;
3749 ')
3750
3751 ########################################
3752 ## <summary>
3753 ##      Send kill signals to all user domains.
3754 ## </summary>
3755 ## <param name="domain">
3756 ##      <summary>
3757 ##      Domain allowed access.
3758 ##      </summary>
3759 ## </param>
3760 #
3761 interface(`userdom_kill_all_users',`
3762         gen_require(`
3763                 attribute userdomain;
3764         ')
3765
3766         allow $1 userdomain:process sigkill;
3767 ')
3768
3769 ########################################
3770 ## <summary>
3771 ##      Send a SIGCHLD signal to all user domains.
3772 ## </summary>
3773 ## <param name="domain">
3774 ##      <summary>
3775 ##      Domain allowed access.
3776 ##      </summary>
3777 ## </param>
3778 #
3779 interface(`userdom_sigchld_all_users',`
3780         gen_require(`
3781                 attribute userdomain;
3782         ')
3783
3784         allow $1 userdomain:process sigchld;
3785 ')
3786
3787 ########################################
3788 ## <summary>
3789 ##      Create keys for all user domains.
3790 ## </summary>
3791 ## <param name="domain">
3792 ##      <summary>
3793 ##      Domain allowed access.
3794 ##      </summary>
3795 ## </param>
3796 #
3797 interface(`userdom_create_all_users_keys',`
3798         gen_require(`
3799                 attribute userdomain;
3800         ')
3801
3802         allow $1 userdomain:key create;
3803 ')
3804
3805 ########################################
3806 ## <summary>
3807 ##      Send a dbus message to all user domains.
3808 ## </summary>
3809 ## <param name="domain">
3810 ##      <summary>
3811 ##      Domain allowed access.
3812 ##      </summary>
3813 ## </param>
3814 #
3815 interface(`userdom_dbus_send_all_users',`
3816         gen_require(`
3817                 attribute userdomain;
3818                 class dbus send_msg;
3819         ')
3820
3821         allow $1 userdomain:dbus send_msg;
3822 ')
3823
3824 ########################################
3825 ## <summary>
3826 ##      Allow apps to set rlimits on userdomain
3827 ## </summary>
3828 ## <param name="domain">
3829 ##      <summary>
3830 ##      Domain allowed access.
3831 ##      </summary>
3832 ## </param>
3833 #
3834 interface(`userdom_set_rlimitnh',`
3835         gen_require(`
3836                 attribute userdomain;
3837         ')
3838
3839         allow $1 userdomain:process rlimitinh;
3840 ')
3841
3842 ########################################
3843 ## <summary>
3844 ##      Define this type as a Allow apps to set rlimits on userdomain
3845 ## </summary>
3846 ## <param name="domain">
3847 ##      <summary>
3848 ##      Domain allowed access.
3849 ##      </summary>
3850 ## </param>
3851 ## <param name="userdomain_prefix">
3852 ##      <summary>
3853 ##      The prefix of the user domain (e.g., user
3854 ##      is the prefix for user_t).
3855 ## </summary>
3856 ## </param>
3857 ## <param name="domain">
3858 ##      <summary>
3859 ##      Domain allowed access.
3860 ##      </summary>
3861 ## </param>
3862 #
3863 template(`userdom_unpriv_usertype',`
3864         gen_require(`
3865                 attribute unpriv_userdomain, userdomain;
3866                 attribute $1_usertype;
3867         ')
3868         typeattribute $2  $1_usertype;
3869         typeattribute $2  unpriv_userdomain;
3870         typeattribute $2  userdomain;
3871
3872         ubac_constrained($2)
3873 ')
3874
3875 ########################################
3876 ## <summary>
3877 ##      Connect to users over an unix stream socket.
3878 ## </summary>
3879 ## <param name="domain">
3880 ##      <summary>
3881 ##      Domain allowed access.
3882 ##      </summary>
3883 ## </param>
3884 #
3885 interface(`userdom_stream_connect',`
3886         gen_require(`
3887                 type user_tmp_t;
3888                 attribute userdomain;
3889         ')
3890
3891         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3892 ')
3893
3894 ########################################
3895 ## <summary>
3896 ##      Ptrace user domains.
3897 ## </summary>
3898 ## <param name="domain">
3899 ##      <summary>
3900 ##      Domain allowed access.
3901 ##      </summary>
3902 ## </param>
3903 #
3904 interface(`userdom_ptrace_all_users',`
3905         gen_require(`
3906                 attribute userdomain;
3907         ')
3908
3909         allow $1 userdomain:process ptrace;
3910 ')
3911
3912 ########################################
3913 ## <summary>
3914 ##      dontaudit Search /root
3915 ## </summary>
3916 ## <param name="domain">
3917 ##      <summary>
3918 ##      Domain to not audit.
3919 ##      </summary>
3920 ## </param>
3921 #
3922 interface(`userdom_dontaudit_search_admin_dir',`
3923         gen_require(`
3924                 type admin_home_t;
3925         ')
3926
3927         dontaudit $1 admin_home_t:dir search_dir_perms;
3928 ')
3929
3930 ########################################
3931 ## <summary>
3932 ##      dontaudit list /root
3933 ## </summary>
3934 ## <param name="domain">
3935 ##      <summary>
3936 ##      Domain to not audit.
3937 ##      </summary>
3938 ## </param>
3939 #
3940 interface(`userdom_dontaudit_list_admin_dir',`
3941         gen_require(`
3942                 type admin_home_t;
3943         ')
3944
3945         dontaudit $1 admin_home_t:dir list_dir_perms;
3946 ')
3947
3948 ########################################
3949 ## <summary>
3950 ##      Allow domain to  list /root
3951 ## </summary>
3952 ## <param name="domain">
3953 ##      <summary>
3954 ##      Domain allowed access.
3955 ##      </summary>
3956 ## </param>
3957 #
3958 interface(`userdom_list_admin_dir',`
3959         gen_require(`
3960                 type admin_home_t;
3961         ')
3962
3963         allow $1 admin_home_t:dir list_dir_perms;
3964 ')
3965
3966 ########################################
3967 ## <summary>
3968 ##      Allow Search /root
3969 ## </summary>
3970 ## <param name="domain">
3971 ##      <summary>
3972 ##      Domain allowed access.
3973 ##      </summary>
3974 ## </param>
3975 #
3976 interface(`userdom_search_admin_dir',`
3977         gen_require(`
3978                 type admin_home_t;
3979         ')
3980
3981         allow $1 admin_home_t:dir search_dir_perms;
3982 ')
3983
3984 ########################################
3985 ## <summary>
3986 ##      RW unpriviledged user SysV sempaphores.
3987 ## </summary>
3988 ## <param name="domain">
3989 ##      <summary>
3990 ##      Domain allowed access.
3991 ##      </summary>
3992 ## </param>
3993 #
3994 interface(`userdom_rw_semaphores',`
3995         gen_require(`
3996                 attribute unpriv_userdomain;
3997         ')
3998
3999         allow $1 unpriv_userdomain:sem rw_sem_perms;
4000 ')
4001
4002 ########################################
4003 ## <summary>
4004 ##      Send a message to unpriv users over a unix domain
4005 ##      datagram socket.
4006 ## </summary>
4007 ## <param name="domain">
4008 ##      <summary>
4009 ##      Domain allowed access.
4010 ##      </summary>
4011 ## </param>
4012 #
4013 interface(`userdom_dgram_send',`
4014         gen_require(`
4015                 attribute unpriv_userdomain;
4016         ')
4017
4018         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4019 ')
4020
4021 ######################################
4022 ## <summary>
4023 ##      Send a message to users over a unix domain
4024 ##      datagram socket.
4025 ## </summary>
4026 ## <param name="domain">
4027 ##      <summary>
4028 ##      Domain allowed access.
4029 ##      </summary>
4030 ## </param>
4031 #
4032 interface(`userdom_users_dgram_send',`
4033         gen_require(`
4034                  attribute userdomain;
4035       ')
4036
4037        allow $1 userdomain:unix_dgram_socket sendto;
4038 ')
4039
4040 #######################################
4041 ## <summary>
4042 ##      Allow execmod on files in homedirectory
4043 ## </summary>
4044 ## <param name="domain">
4045 ##      <summary>
4046 ##      Domain allowed access.
4047 ##      </summary>
4048 ## </param>
4049 ## <rolebase/>
4050 #
4051 interface(`userdom_execmod_user_home_files',`
4052         gen_require(`
4053                 type user_home_type;
4054         ')
4055
4056         allow $1 user_home_type:file execmod;
4057 ')
4058
4059 ########################################
4060 ## <summary>
4061 ##      Read admin home files.
4062 ## </summary>
4063 ## <param name="domain">
4064 ##      <summary>
4065 ##      Domain allowed access.
4066 ##      </summary>
4067 ## </param>
4068 ## <rolecap/>
4069 #
4070 interface(`userdom_read_admin_home_files',`
4071         gen_require(`
4072                 type admin_home_t;
4073         ')
4074
4075         read_files_pattern($1, admin_home_t, admin_home_t)
4076 ')
4077
4078 ########################################
4079 ## <summary>
4080 ##      Execute admin home files.
4081 ## </summary>
4082 ## <param name="domain">
4083 ##      <summary>
4084 ##      Domain allowed access.
4085 ##      </summary>
4086 ## </param>
4087 ## <rolecap/>
4088 #
4089 interface(`userdom_exec_admin_home_files',`
4090         gen_require(`
4091                 type admin_home_t;
4092         ')
4093
4094         exec_files_pattern($1, admin_home_t, admin_home_t)
4095 ')
4096
4097 ########################################
4098 ## <summary>
4099 ##      Append files inherited
4100 ##      in the /root directory.
4101 ## </summary>
4102 ## <param name="domain">
4103 ##      <summary>
4104 ##      Domain allowed access.
4105 ##      </summary>
4106 ## </param>
4107 #
4108 interface(`userdom_inherit_append_admin_home_files',`
4109         gen_require(`
4110                 type admin_home_t;
4111         ')
4112
4113         allow $1 admin_home_t:file { getattr append };
4114 ')
4115
4116
4117 #######################################
4118 ## <summary>
4119 ##      Manage all files/directories in the homedir
4120 ## </summary>
4121 ## <param name="userdomain">
4122 ##      <summary>
4123 ##      The user domain
4124 ##      </summary>
4125 ## </param>
4126 ## <rolebase/>
4127 #
4128 interface(`userdom_manage_user_home_content',`
4129         gen_require(`
4130                 type user_home_dir_t, user_home_t;
4131                 attribute user_home_type;
4132         ')
4133
4134         files_list_home($1)
4135         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4136         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4137         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4138         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4139         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4140         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4141
4142 ')
4143
4144
4145 ########################################
4146 ## <summary>
4147 ##      Create objects in a user home directory
4148 ##      with an automatic type transition to
4149 ##      the user home file type.
4150 ## </summary>
4151 ## <param name="domain">
4152 ##      <summary>
4153 ##      Domain allowed access.
4154 ##      </summary>
4155 ## </param>
4156 ## <param name="object_class">
4157 ##      <summary>
4158 ##      The class of the object to be created.
4159 ##      </summary>
4160 ## </param>
4161 #
4162 interface(`userdom_user_home_dir_filetrans_pattern',`
4163         gen_require(`
4164                 type user_home_dir_t, user_home_t;
4165         ')
4166
4167         type_transition $1 user_home_dir_t:$2 user_home_t;
4168 ')
4169
4170 ########################################
4171 ## <summary>
4172 ##      Create objects in the /root directory
4173 ##      with an automatic type transition to
4174 ##      a specified private type.
4175 ## </summary>
4176 ## <param name="domain">
4177 ##      <summary>
4178 ##      Domain allowed access.
4179 ##      </summary>
4180 ## </param>
4181 ## <param name="private_type">
4182 ##      <summary>
4183 ##      The type of the object to create.
4184 ##      </summary>
4185 ## </param>
4186 ## <param name="object_class">
4187 ##      <summary>
4188 ##      The class of the object to be created.
4189 ##      </summary>
4190 ## </param>
4191 #
4192 interface(`userdom_admin_home_dir_filetrans',`
4193         gen_require(`
4194                 type admin_home_t;
4195         ')
4196
4197         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4198 ')
4199
4200 ########################################
4201 ## <summary>
4202 ##      Send signull to unprivileged user domains.
4203 ## </summary>
4204 ## <param name="domain">
4205 ##      <summary>
4206 ##      Domain allowed access.
4207 ##      </summary>
4208 ## </param>
4209 #
4210 interface(`userdom_signull_unpriv_users',`
4211         gen_require(`
4212                 attribute unpriv_userdomain;
4213         ')
4214
4215         allow $1 unpriv_userdomain:process signull;
4216 ')
4217
4218 ########################################
4219 ## <summary>
4220 ##      Write all users files in /tmp
4221 ## </summary>
4222 ## <param name="domain">
4223 ##      <summary>
4224 ##      Domain allowed access.
4225 ##      </summary>
4226 ## </param>
4227 #
4228 interface(`userdom_write_user_tmp_dirs',`
4229         gen_require(`
4230                 type user_tmp_t;
4231         ')
4232
4233         write_files_pattern($1, user_tmp_t, user_tmp_t)
4234 ')
4235
4236 ########################################
4237 ## <summary>
4238 ##      Manage keys for all user domains.
4239 ## </summary>
4240 ## <param name="domain">
4241 ##      <summary>
4242 ##      Domain allowed access.
4243 ##      </summary>
4244 ## </param>
4245 #
4246 interface(`userdom_manage_all_users_keys',`
4247         gen_require(`
4248                 attribute userdomain;
4249         ')
4250
4251         allow $1 userdomain:key manage_key_perms;
4252 ')
4253
4254
4255 ########################################
4256 ## <summary>
4257 ##      Do not audit attempts to read and write
4258 ##      unserdomain stream.
4259 ## </summary>
4260 ## <param name="domain">
4261 ##      <summary>
4262 ##      Domain to not audit.
4263 ##      </summary>
4264 ## </param>
4265 #
4266 interface(`userdom_dontaudit_rw_stream',`
4267         gen_require(`
4268                 attribute userdomain;
4269         ')
4270
4271         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4272 ')
4273
4274 ########################################
4275 ## <summary>
4276 ##      Do not audit attempts to read and write
4277 ##      unserdomain datagram socket.
4278 ## </summary>
4279 ## <param name="domain">
4280 ##      <summary>
4281 ##      Domain to not audit.
4282 ##      </summary>
4283 ## </param>
4284 #
4285 interface(`userdom_dontaudit_rw_dgram_socket',`
4286         gen_require(`
4287                 attribute userdomain;
4288         ')
4289
4290         dontaudit $1 userdomain:unix_dgram_socket { read write };
4291 ')
4292
4293 ########################################
4294 ## <summary>
4295 ##      Append files
4296 ##      in a user home subdirectory.
4297 ## </summary>
4298 ## <param name="domain">
4299 ##      <summary>
4300 ##      Domain allowed access.
4301 ##      </summary>
4302 ## </param>
4303 #
4304 interface(`userdom_append_user_home_content_files',`
4305         gen_require(`
4306                 type user_home_dir_t, user_home_t;
4307         ')
4308
4309         append_files_pattern($1, user_home_t, user_home_t)
4310         allow $1 user_home_dir_t:dir search_dir_perms;
4311         files_search_home($1)
4312 ')
4313
4314 ########################################
4315 ## <summary>
4316 ##      Read files inherited
4317 ##      in a user home subdirectory.
4318 ## </summary>
4319 ## <param name="domain">
4320 ##      <summary>
4321 ##      Domain allowed access.
4322 ##      </summary>
4323 ## </param>
4324 #
4325 interface(`userdom_read_inherited_user_home_content_files',`
4326         gen_require(`
4327                 attribute user_home_type;
4328         ')
4329
4330         allow $1 user_home_type:file { getattr read };
4331 ')
4332
4333 ########################################
4334 ## <summary>
4335 ##      Append files inherited
4336 ##      in a user home subdirectory.
4337 ## </summary>
4338 ## <param name="domain">
4339 ##      <summary>
4340 ##      Domain allowed access.
4341 ##      </summary>
4342 ## </param>
4343 #
4344 interface(`userdom_inherit_append_user_home_content_files',`
4345         gen_require(`
4346                 type user_home_t;
4347         ')
4348
4349         allow $1 user_home_t:file { getattr append };
4350 ')
4351
4352 ########################################
4353 ## <summary>
4354 ##      Append files inherited
4355 ##      in a user tmp files.
4356 ## </summary>
4357 ## <param name="domain">
4358 ##      <summary>
4359 ##      Domain allowed access.
4360 ##      </summary>
4361 ## </param>
4362 #
4363 interface(`userdom_inherit_append_user_tmp_files',`
4364         gen_require(`
4365                 type user_tmp_t;
4366         ')
4367
4368         allow $1 user_tmp_t:file { getattr append };
4369 ')
4370
4371 ######################################
4372 ## <summary>
4373 ##      Read audio files in the users homedir.
4374 ## </summary>
4375 ## <param name="domain">
4376 ##      <summary>
4377 ##      Domain allowed access.
4378 ##      </summary>
4379 ## </param>
4380 ## <rolecap/>
4381 #
4382 interface(`userdom_read_home_audio_files',`
4383         gen_require(`
4384                 type audio_home_t;
4385         ')
4386
4387         userdom_search_user_home_dirs($1)
4388         allow $1 audio_home_t:dir list_dir_perms;
4389         read_files_pattern($1, audio_home_t, audio_home_t)
4390         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4391 ')
4392
4393 ########################################
4394 ## <summary>
4395 ##      Do not audit attempts to write all user home content files.
4396 ## </summary>
4397 ## <param name="domain">
4398 ##      <summary>
4399 ##      Domain to not audit.
4400 ##      </summary>
4401 ## </param>
4402 #
4403 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4404         gen_require(`
4405                 attribute user_home_type;
4406         ')
4407
4408         dontaudit $1 user_home_type:file write_file_perms;
4409 ')
4410
4411 ########################################
4412 ## <summary>
4413 ##      Do not audit attempts to write all user tmp content files.
4414 ## </summary>
4415 ## <param name="domain">
4416 ##      <summary>
4417 ##      Domain to not audit.
4418 ##      </summary>
4419 ## </param>
4420 #
4421 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4422         gen_require(`
4423                 attribute user_tmp_type;
4424         ')
4425
4426         dontaudit $1 user_tmp_type:file write_file_perms;
4427 ')
4428
4429 ########################################
4430 ## <summary>
4431 ##      Manage all user temporary content.
4432 ## </summary>
4433 ## <param name="domain">
4434 ##      <summary>
4435 ##      Domain allowed access.
4436 ##      </summary>
4437 ## </param>
4438 #
4439 interface(`userdom_manage_all_user_tmp_content',`
4440         gen_require(`
4441                 attribute user_tmp_type;
4442         ')
4443
4444         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4445         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4446         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4447         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4448         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4449         files_search_tmp($1)
4450 ')
4451
4452 ########################################
4453 ## <summary>
4454 ##      List all user temporary content.
4455 ## </summary>
4456 ## <param name="domain">
4457 ##      <summary>
4458 ##      Domain allowed access.
4459 ##      </summary>
4460 ## </param>
4461 #
4462 interface(`userdom_list_all_user_tmp_content',`
4463         gen_require(`
4464                 attribute user_tmp_type;
4465         ')
4466
4467         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4468         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4469         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4470         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4471         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4472         files_search_var($1)
4473         files_search_tmp($1)
4474 ')
4475
4476 ########################################
4477 ## <summary>
4478 ##      Manage all user tmpfs content.
4479 ## </summary>
4480 ## <param name="domain">
4481 ##      <summary>
4482 ##      Domain allowed access.
4483 ##      </summary>
4484 ## </param>
4485 #
4486 interface(`userdom_manage_all_user_tmpfs_content',`
4487         gen_require(`
4488                 attribute user_tmpfs_type;
4489         ')
4490
4491         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4492         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4493         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4494         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4495         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4496         fs_search_tmpfs($1)
4497 ')
4498
4499 ########################################
4500 ## <summary>
4501 ##      Delete all user temporary content.
4502 ## </summary>
4503 ## <param name="domain">
4504 ##      <summary>
4505 ##      Domain allowed access.
4506 ##      </summary>
4507 ## </param>
4508 #
4509 interface(`userdom_delete_all_user_tmp_content',`
4510         gen_require(`
4511                 attribute user_tmp_type;
4512         ')
4513
4514         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4515         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4516         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4517         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4518         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4519         # /var/tmp
4520         files_search_var($1)
4521         files_delete_tmp_dir_entry($1)
4522 ')
4523
4524 ########################################
4525 ## <summary>
4526 ##      Read system SSL certificates in the users homedir.
4527 ## </summary>
4528 ## <param name="domain">
4529 ##      <summary>
4530 ##      Domain allowed access.
4531 ##      </summary>
4532 ## </param>
4533 #
4534 interface(`userdom_read_home_certs',`
4535         gen_require(`
4536                 type home_cert_t;
4537         ')
4538
4539         userdom_search_user_home_content($1)
4540         allow $1 home_cert_t:dir list_dir_perms;
4541         read_files_pattern($1, home_cert_t, home_cert_t)
4542         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4543 ')
4544
4545 #######################################
4546 ## <summary>
4547 ##  Dontaudit Write system SSL certificates in the users homedir.
4548 ## </summary>
4549 ## <param name="domain">
4550 ##  <summary>
4551 ##      Domain to not audit.
4552 ##  </summary>
4553 ## </param>
4554 #
4555 interface(`userdom_dontaudit_write_home_certs',`
4556     gen_require(`
4557         type home_cert_t;
4558     ')
4559
4560     dontaudit $1 home_cert_t:file write;
4561 ')
4562
4563 ########################################
4564 ## <summary>
4565 ##      dontaudit Search getatrr /root files
4566 ## </summary>
4567 ## <param name="domain">
4568 ##      <summary>
4569 ##      Domain to not audit.
4570 ##      </summary>
4571 ## </param>
4572 #
4573 interface(`userdom_dontaudit_getattr_admin_home_files',`
4574         gen_require(`
4575                 type admin_home_t;
4576         ')
4577
4578         dontaudit $1 admin_home_t:file getattr;
4579 ')
4580
4581 ########################################
4582 ## <summary>
4583 ##      dontaudit read /root lnk files
4584 ## </summary>
4585 ## <param name="domain">
4586 ##      <summary>
4587 ##      Domain to not audit.
4588 ##      </summary>
4589 ## </param>
4590 #
4591 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4592         gen_require(`
4593                 type admin_home_t;
4594         ')
4595
4596         dontaudit $1 admin_home_t:lnk_file read;
4597 ')
4598
4599 ########################################
4600 ## <summary>
4601 ##      dontaudit read /root files
4602 ## </summary>
4603 ## <param name="domain">
4604 ##      <summary>
4605 ##      Domain to not audit.
4606 ##      </summary>
4607 ## </param>
4608 #
4609 interface(`userdom_dontaudit_read_admin_home_files',`
4610         gen_require(`
4611                 type admin_home_t;
4612         ')
4613
4614         dontaudit $1 admin_home_t:file read_file_perms;
4615 ')
4616
4617 ########################################
4618 ## <summary>
4619 ##      Create, read, write, and delete user
4620 ##      temporary chr files.
4621 ## </summary>
4622 ## <param name="domain">
4623 ##      <summary>
4624 ##      Domain allowed access.
4625 ##      </summary>
4626 ## </param>
4627 #
4628 interface(`userdom_manage_user_tmp_chr_files',`
4629         gen_require(`
4630                 type user_tmp_t;
4631         ')
4632
4633         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4634         files_search_tmp($1)
4635 ')
4636
4637 ########################################
4638 ## <summary>
4639 ##      Create, read, write, and delete user
4640 ##      temporary blk files.
4641 ## </summary>
4642 ## <param name="domain">
4643 ##      <summary>
4644 ##      Domain allowed access.
4645 ##      </summary>
4646 ## </param>
4647 #
4648 interface(`userdom_manage_user_tmp_blk_files',`
4649         gen_require(`
4650                 type user_tmp_t;
4651         ')
4652
4653         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4654         files_search_tmp($1)
4655 ')
4656
4657 ########################################
4658 ## <summary>
4659 ##      Dontaudit attempt to set attributes on  user temporary directories.
4660 ## </summary>
4661 ## <param name="domain">
4662 ##      <summary>
4663 ##      Domain to not audit.
4664 ##      </summary>
4665 ## </param>
4666 #
4667 interface(`userdom_dontaudit_setattr_user_tmp',`
4668         gen_require(`
4669                 type user_tmp_t;
4670         ')
4671
4672         dontaudit $1 user_tmp_t:dir setattr;
4673 ')
4674
4675 ########################################
4676 ## <summary>
4677 ##      Write all inherited users files in /tmp
4678 ## </summary>
4679 ## <param name="domain">
4680 ##      <summary>
4681 ##      Domain allowed access.
4682 ##      </summary>
4683 ## </param>
4684 #
4685 interface(`userdom_write_inherited_user_tmp_files',`
4686         gen_require(`
4687                 type user_tmp_t;
4688         ')
4689
4690         allow $1 user_tmp_t:file write;
4691 ')
4692
4693 ########################################
4694 ## <summary>
4695 ##      Delete all users files in /tmp
4696 ## </summary>
4697 ## <param name="domain">
4698 ##      <summary>
4699 ##      Domain allowed access.
4700 ##      </summary>
4701 ## </param>
4702 #
4703 interface(`userdom_delete_user_tmp_files',`
4704         gen_require(`
4705                 type user_tmp_t;
4706         ')
4707
4708         allow $1 user_tmp_t:file delete_file_perms;
4709 ')
4710
4711 ########################################
4712 ## <summary>
4713 ##      Delete user tmpfs files.
4714 ## </summary>
4715 ## <param name="domain">
4716 ##      <summary>
4717 ##      Domain allowed access.
4718 ##      </summary>
4719 ## </param>
4720 #
4721 interface(`userdom_delete_user_tmpfs_files',`
4722         gen_require(`
4723                 type user_tmpfs_t;
4724         ')
4725
4726         allow $1 user_tmpfs_t:file delete_file_perms;
4727 ')
4728
4729 ########################################
4730 ## <summary>
4731 ##      Read/Write unpriviledged user SysV shared
4732 ##      memory segments.
4733 ## </summary>
4734 ## <param name="domain">
4735 ##      <summary>
4736 ##      Domain allowed access.
4737 ##      </summary>
4738 ## </param>
4739 #
4740 interface(`userdom_rw_unpriv_user_shared_mem',`
4741         gen_require(`
4742                 attribute unpriv_userdomain;
4743         ')
4744
4745         allow $1 unpriv_userdomain:shm rw_shm_perms;
4746 ')
4747
4748 ########################################
4749 ## <summary>
4750 ##      Do not audit attempts to search user
4751 ##      temporary directories.
4752 ## </summary>
4753 ## <param name="domain">
4754 ##      <summary>
4755 ##      Domain to not audit.
4756 ##      </summary>
4757 ## </param>
4758 #
4759 interface(`userdom_dontaudit_search_user_tmp',`
4760         gen_require(`
4761                 type user_tmp_t;
4762         ')
4763
4764         dontaudit $1 user_tmp_t:dir search_dir_perms;
4765 ')
4766
4767 ########################################
4768 ## <summary>
4769 ##      Execute a file in a user home directory
4770 ##      in the specified domain.
4771 ## </summary>
4772 ## <desc>
4773 ##      <p>
4774 ##      Execute a file in a user home directory
4775 ##      in the specified domain.
4776 ##      </p>
4777 ##      <p>
4778 ##      No interprocess communication (signals, pipes,
4779 ##      etc.) is provided by this interface since
4780 ##      the domains are not owned by this module.
4781 ##      </p>
4782 ## </desc>
4783 ## <param name="domain">
4784 ##      <summary>
4785 ##      Domain allowed access.
4786 ##      </summary>
4787 ## </param>
4788 ## <param name="target_domain">
4789 ##      <summary>
4790 ##      The type of the new process.
4791 ##      </summary>
4792 ## </param>
4793 #
4794 interface(`userdom_domtrans_user_home',`
4795         gen_require(`
4796                 type user_home_t;
4797         ')
4798
4799         read_lnk_files_pattern($1, user_home_t, user_home_t)
4800         domain_transition_pattern($1, user_home_t, $2)
4801         type_transition $1 user_home_t:process $2;
4802 ')
4803
4804 ########################################
4805 ## <summary>
4806 ##      Execute a file in a user tmp directory
4807 ##      in the specified domain.
4808 ## </summary>
4809 ## <desc>
4810 ##      <p>
4811 ##      Execute a file in a user tmp directory
4812 ##      in the specified domain.
4813 ##      </p>
4814 ##      <p>
4815 ##      No interprocess communication (signals, pipes,
4816 ##      etc.) is provided by this interface since
4817 ##      the domains are not owned by this module.
4818 ##      </p>
4819 ## </desc>
4820 ## <param name="domain">
4821 ##      <summary>
4822 ##      Domain allowed access.
4823 ##      </summary>
4824 ## </param>
4825 ## <param name="target_domain">
4826 ##      <summary>
4827 ##      The type of the new process.
4828 ##      </summary>
4829 ## </param>
4830 #
4831 interface(`userdom_domtrans_user_tmp',`
4832         gen_require(`
4833                 type user_tmp_t;
4834         ')
4835
4836         files_search_tmp($1)
4837         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4838         domain_transition_pattern($1, user_tmp_t, $2)
4839         type_transition $1 user_tmp_t:process $2;
4840 ')
4841
4842 ########################################
4843 ## <summary>
4844 ##      Do not audit attempts to read all user home content files.
4845 ## </summary>
4846 ## <param name="domain">
4847 ##      <summary>
4848 ##      Domain to not audit.
4849 ##      </summary>
4850 ## </param>
4851 #
4852 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4853         gen_require(`
4854                 attribute user_home_type;
4855         ')
4856
4857         dontaudit $1 user_home_type:file read_file_perms;
4858 ')
4859
4860 ########################################
4861 ## <summary>
4862 ##      Do not audit attempts to read all user tmp content files.
4863 ## </summary>
4864 ## <param name="domain">
4865 ##      <summary>
4866 ##      Domain to not audit.
4867 ##      </summary>
4868 ## </param>
4869 #
4870 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4871         gen_require(`
4872                 attribute user_tmp_type;
4873         ')
4874
4875         dontaudit $1 user_tmp_type:file read_file_perms;
4876 ')
4877
4878 #######################################
4879 ## <summary>
4880 ## Read and write unpriviledged user SysV sempaphores.
4881 ## </summary>
4882 ## <param name="domain">
4883 ## <summary>
4884 ## Domain allowed access.
4885 ## </summary>
4886 ## </param>
4887 #
4888 interface(`userdom_rw_unpriv_user_semaphores',`
4889    gen_require(`
4890        attribute unpriv_userdomain;
4891    ')
4892
4893    allow $1 unpriv_userdomain:sem rw_sem_perms;
4894 ')