policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         miscfiles_read_localization($1_t)
 136         miscfiles_read_generic_certs($1_t)
 137
 138         miscfiles_read_all_certs($1_usertype)
 139         miscfiles_read_localization($1_usertype)
 140         miscfiles_read_man_pages($1_usertype)
 141         miscfiles_read_public_files($1_usertype)
 142
 143         tunable_policy(`allow_execmem',`
 144                 # Allow loading DSOs that require executable stack.
 145                 allow $1_t self:process execmem;
 146         ')
 147
 148         tunable_policy(`allow_execmem && allow_execstack',`
 149                 # Allow making the stack executable via mprotect.
 150                 allow $1_t self:process execstack;
 151         ')
 152
 153         optional_policy(`
 154                 fs_list_cgroup_dirs($1_usertype)
 155         ')
 156
 157
 158         optional_policy(`
 159                 ssh_rw_stream_sockets($1_usertype)
 160                 ssh_delete_tmp($1_t)
 161                 ssh_signal($1_t)
 162         ')
 163 ')
 164
 165 #######################################
 166 ## <summary>
 167 ##      Allow a home directory for which the
 168 ##      role has read-only access.
 169 ## </summary>
 170 ## <desc>
 171 ##      <p>
 172 ##      Allow a home directory for which the
 173 ##      role has read-only access.
 174 ##      </p>
 175 ##      <p>
 176 ##      This does not allow execute access.
 177 ##      </p>
 178 ## </desc>
 179 ## <param name="role">
 180 ##      <summary>
 181 ##      The user role
 182 ##      </summary>
 183 ## </param>
 184 ## <param name="userdomain">
 185 ##      <summary>
 186 ##      The user domain
 187 ##      </summary>
 188 ## </param>
 189 ## <rolebase/>
 190 #
 191 interface(`userdom_ro_home_role',`
 192         gen_require(`
 193                 type user_home_t, user_home_dir_t;
 194         ')
 195
 196         role $1 types { user_home_t user_home_dir_t };
 197
 198         ##############################
 199         #
 200         # Domain access to home dir
 201         #
 202
 203         type_member $2 user_home_dir_t:dir user_home_dir_t;
 204
 205         # read-only home directory
 206         allow $2 user_home_dir_t:dir list_dir_perms;
 207         allow $2 user_home_t:dir list_dir_perms;
 208         allow $2 user_home_t:file entrypoint;
 209         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 210         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 211         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 212         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 213         files_list_home($2)
 214
 215 ')
 216
 217 #######################################
 218 ## <summary>
 219 ##      Allow a home directory for which the
 220 ##      role has full access.
 221 ## </summary>
 222 ## <desc>
 223 ##      <p>
 224 ##      Allow a home directory for which the
 225 ##      role has full access.
 226 ##      </p>
 227 ##      <p>
 228 ##      This does not allow execute access.
 229 ##      </p>
 230 ## </desc>
 231 ## <param name="role">
 232 ##      <summary>
 233 ##      The user role
 234 ##      </summary>
 235 ## </param>
 236 ## <param name="userdomain">
 237 ##      <summary>
 238 ##      The user domain
 239 ##      </summary>
 240 ## </param>
 241 ## <rolebase/>
 242 #
 243 interface(`userdom_manage_home_role',`
 244         gen_require(`
 245                 type user_home_t, user_home_dir_t;
 246                 attribute user_home_type;
 247         ')
 248
 249         role $1 types { user_home_type user_home_dir_t };
 250
 251         ##############################
 252         #
 253         # Domain access to home dir
 254         #
 255
 256         type_member $2 user_home_dir_t:dir user_home_dir_t;
 257
 258         # full control of the home directory
 259         allow $2 user_home_t:dir mounton;
 260         allow $2 user_home_t:file entrypoint;
 261
 262         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 263         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 264         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 265         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 266         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 267         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 268         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 269         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 275         files_list_home($2)
 276
 277         # cjp: this should probably be removed:
 278         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 279
 280         tunable_policy(`use_nfs_home_dirs',`
 281                 fs_mount_nfs($2)
 282                 fs_mounton_nfs($2)
 283                 fs_manage_nfs_dirs($2)
 284                 fs_manage_nfs_files($2)
 285                 fs_manage_nfs_symlinks($2)
 286                 fs_manage_nfs_named_sockets($2)
 287                 fs_manage_nfs_named_pipes($2)
 288         ')
 289
 290         tunable_policy(`use_samba_home_dirs',`
 291                 fs_mount_cifs($2)
 292                 fs_mounton_cifs($2)
 293                 fs_manage_cifs_dirs($2)
 294                 fs_manage_cifs_files($2)
 295                 fs_manage_cifs_symlinks($2)
 296                 fs_manage_cifs_named_sockets($2)
 297                 fs_manage_cifs_named_pipes($2)
 298         ')
 299 ')
 300
 301 #######################################
 302 ## <summary>
 303 ##      Manage user temporary files
 304 ## </summary>
 305 ## <param name="role">
 306 ##      <summary>
 307 ##      Role allowed access.
 308 ##      </summary>
 309 ## </param>
 310 ## <param name="domain">
 311 ##      <summary>
 312 ##      Domain allowed access.
 313 ##      </summary>
 314 ## </param>
 315 ## <rolebase/>
 316 #
 317 interface(`userdom_manage_tmp_role',`
 318         gen_require(`
 319                 type user_tmp_t;
 320         ')
 321
 322         role $1 types user_tmp_t;
 323
 324         files_poly_member_tmp($2, user_tmp_t)
 325
 326         manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
 327         manage_files_pattern($2, user_tmp_t, user_tmp_t)
 328         manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
 329         manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
 330         manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
 331         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 332         relabel_files_pattern($2, user_tmp_t, user_tmp_t)
 333 ')
 334
 335 #######################################
 336 ## <summary>
 337 ##      Dontaudit search of user bin dirs.
 338 ## </summary>
 339 ## <param name="domain">
 340 ##      <summary>
 341 ##      Domain allowed access.
 342 ##      </summary>
 343 ## </param>
 344 #
 345 interface(`userdom_dontaudit_search_user_bin_dirs',`
 346         gen_require(`
 347                 type home_bin_t;
 348         ')
 349
 350         dontaudit $1 home_bin_t:dir search_dir_perms;
 351 ')
 352
 353 #######################################
 354 ## <summary>
 355 ##      Execute user bin files.
 356 ## </summary>
 357 ## <param name="domain">
 358 ##      <summary>
 359 ##      Domain allowed access.
 360 ##      </summary>
 361 ## </param>
 362 #
 363 interface(`userdom_exec_user_bin_files',`
 364         gen_require(`
 365                 attribute user_home_type;
 366                 type home_bin_t, user_home_dir_t;
 367         ')
 368
 369         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 370         files_search_home($1)
 371 ')
 372
 373 #######################################
 374 ## <summary>
 375 ##      The execute access user temporary files.
 376 ## </summary>
 377 ## <param name="domain">
 378 ##      <summary>
 379 ##      Domain allowed access.
 380 ##      </summary>
 381 ## </param>
 382 ## <rolebase/>
 383 #
 384 interface(`userdom_exec_user_tmp_files',`
 385         gen_require(`
 386                 type user_tmp_t;
 387         ')
 388
 389         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 390         dontaudit $1 user_tmp_t:sock_file execute;
 391         files_search_tmp($1)
 392 ')
 393
 394 #######################################
 395 ## <summary>
 396 ##      Role access for the user tmpfs type
 397 ##      that the user has full access.
 398 ## </summary>
 399 ## <desc>
 400 ##      <p>
 401 ##      Role access for the user tmpfs type
 402 ##      that the user has full access.
 403 ##      </p>
 404 ##      <p>
 405 ##      This does not allow execute access.
 406 ##      </p>
 407 ## </desc>
 408 ## <param name="role">
 409 ##      <summary>
 410 ##      Role allowed access.
 411 ##      </summary>
 412 ## </param>
 413 ## <param name="domain">
 414 ##      <summary>
 415 ##      Domain allowed access.
 416 ##      </summary>
 417 ## </param>
 418 ## <rolecap/>
 419 #
 420 interface(`userdom_manage_tmpfs_role',`
 421         gen_require(`
 422                 type user_tmpfs_t;
 423         ')
 424
 425         role $1 types user_tmpfs_t;
 426
 427         manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
 428         manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 429         manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 430         manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 431         manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
 432         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 433 ')
 434
 435 #######################################
 436 ## <summary>
 437 ##      The interface allowing the user basic
 438 ##      network permissions
 439 ## </summary>
 440 ## <param name="userdomain">
 441 ##      <summary>
 442 ##      The user domain
 443 ##      </summary>
 444 ## </param>
 445 ## <rolebase/>
 446 #
 447 interface(`userdom_basic_networking',`
 448
 449         allow $1 self:tcp_socket create_stream_socket_perms;
 450         allow $1 self:udp_socket create_socket_perms;
 451
 452         corenet_all_recvfrom_unlabeled($1)
 453         corenet_all_recvfrom_netlabel($1)
 454         corenet_tcp_sendrecv_generic_if($1)
 455         corenet_udp_sendrecv_generic_if($1)
 456         corenet_tcp_sendrecv_generic_node($1)
 457         corenet_udp_sendrecv_generic_node($1)
 458         corenet_tcp_sendrecv_all_ports($1)
 459         corenet_udp_sendrecv_all_ports($1)
 460         corenet_tcp_connect_all_ports($1)
 461         corenet_sendrecv_all_client_packets($1)
 462
 463         optional_policy(`
 464                 init_tcp_recvfrom_all_daemons($1)
 465                 init_udp_recvfrom_all_daemons($1)
 466         ')
 467
 468         optional_policy(`
 469                 ipsec_match_default_spd($1)
 470         ')
 471
 472 ')
 473
 474 #######################################
 475 ## <summary>
 476 ##      The template for creating a user xwindows client.  (Deprecated)
 477 ## </summary>
 478 ## <param name="userdomain_prefix">
 479 ##      <summary>
 480 ##      The prefix of the user domain (e.g., user
 481 ##      is the prefix for user_t).
 482 ##      </summary>
 483 ## </param>
 484 ## <rolebase/>
 485 #
 486 template(`userdom_xwindows_client_template',`
 487         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 488         gen_require(`
 489                 type $1_t, user_tmpfs_t;
 490         ')
 491
 492         dev_rw_xserver_misc($1_t)
 493         dev_rw_power_management($1_t)
 494         dev_read_input($1_t)
 495         dev_read_misc($1_t)
 496         dev_write_misc($1_t)
 497         # open office is looking for the following
 498         dev_getattr_agp_dev($1_t)
 499         dev_dontaudit_rw_dri($1_t)
 500         # GNOME checks for usb and other devices:
 501         dev_rw_usbfs($1_t)
 502         dev_rw_generic_usb_dev($1_t)
 503
 504         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 505         xserver_xsession_entry_type($1_t)
 506         xserver_dontaudit_write_log($1_t)
 507         xserver_stream_connect_xdm($1_t)
 508         # certain apps want to read xdm.pid file
 509         xserver_read_xdm_pid($1_t)
 510         # gnome-session creates socket under /tmp/.ICE-unix/
 511         xserver_create_xdm_tmp_sockets($1_t)
 512         # Needed for escd, remove if we get escd policy
 513         xserver_manage_xdm_tmp_files($1_t)
 514 ')
 515
 516 #######################################
 517 ## <summary>
 518 ##      The template for allowing the user to change passwords.
 519 ## </summary>
 520 ## <param name="userdomain_prefix">
 521 ##      <summary>
 522 ##      The prefix of the user domain (e.g., user
 523 ##      is the prefix for user_t).
 524 ##      </summary>
 525 ## </param>
 526 ## <rolebase/>
 527 #
 528 template(`userdom_change_password_template',`
 529         gen_require(`
 530                 type $1_t;
 531                 role $1_r;
 532         ')
 533
 534         optional_policy(`
 535                 usermanage_run_chfn($1_t,$1_r)
 536                 usermanage_run_passwd($1_t,$1_r)
 537         ')
 538 ')
 539
 540 #######################################
 541 ## <summary>
 542 ##      The template containing rules common to unprivileged
 543 ##      users and administrative users.
 544 ## </summary>
 545 ## <desc>
 546 ##      <p>
 547 ##      This template creates a user domain, types, and
 548 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 549 ##      </p>
 550 ## </desc>
 551 ## <param name="userdomain_prefix">
 552 ##      <summary>
 553 ##      The prefix of the user domain (e.g., user
 554 ##      is the prefix for user_t).
 555 ##      </summary>
 556 ## </param>
 557 #
 558 template(`userdom_common_user_template',`
 559         gen_require(`
 560                 attribute unpriv_userdomain;
 561         ')
 562
 563         userdom_basic_networking($1_usertype)
 564
 565         ##############################
 566         #
 567         # User domain Local policy
 568         #
 569
 570         # evolution and gnome-session try to create a netlink socket
 571         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 572         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 573         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 574         allow $1_t self:socket create_socket_perms;
 575
 576         allow $1_usertype unpriv_userdomain:fd use;
 577
 578         kernel_read_system_state($1_usertype)
 579         kernel_read_network_state($1_usertype)
 580         kernel_read_software_raid_state($1_usertype)
 581         kernel_read_net_sysctls($1_usertype)
 582         # Very permissive allowing every domain to see every type:
 583         kernel_get_sysvipc_info($1_usertype)
 584         # Find CDROM devices:
 585         kernel_read_device_sysctls($1_usertype)
 586         kernel_request_load_module($1_usertype)
 587
 588         corenet_udp_bind_generic_node($1_usertype)
 589         corenet_udp_bind_generic_port($1_usertype)
 590
 591         dev_read_rand($1_usertype)
 592         dev_write_sound($1_usertype)
 593         dev_read_sound($1_usertype)
 594         dev_read_sound_mixer($1_usertype)
 595         dev_write_sound_mixer($1_usertype)
 596
 597         files_exec_etc_files($1_usertype)
 598         files_search_locks($1_usertype)
 599         # Check to see if cdrom is mounted
 600         files_search_mnt($1_usertype)
 601         # cjp: perhaps should cut back on file reads:
 602         files_read_var_files($1_usertype)
 603         files_read_var_symlinks($1_usertype)
 604         files_read_generic_spool($1_usertype)
 605         files_read_var_lib_files($1_usertype)
 606         # Stat lost+found.
 607         files_getattr_lost_found_dirs($1_usertype)
 608         files_read_config_files($1_usertype)
 609         fs_read_noxattr_fs_files($1_usertype)
 610         fs_read_noxattr_fs_symlinks($1_usertype)
 611         fs_rw_cgroup_files($1_usertype)
 612
 613         application_getattr_socket($1_usertype)
 614
 615         logging_send_syslog_msg($1_usertype)
 616         logging_send_audit_msgs($1_usertype)
 617         selinux_get_enforce_mode($1_usertype)
 618
 619         # cjp: some of this probably can be removed
 620         selinux_get_fs_mount($1_usertype)
 621         selinux_validate_context($1_usertype)
 622         selinux_compute_access_vector($1_usertype)
 623         selinux_compute_create_context($1_usertype)
 624         selinux_compute_relabel_context($1_usertype)
 625         selinux_compute_user_contexts($1_usertype)
 626
 627         # for eject
 628         storage_getattr_fixed_disk_dev($1_usertype)
 629
 630         auth_read_login_records($1_usertype)
 631         auth_run_pam($1_t,$1_r)
 632         auth_run_utempter($1_t,$1_r)
 633
 634         init_read_utmp($1_usertype)
 635
 636         seutil_read_file_contexts($1_usertype)
 637         seutil_read_default_contexts($1_usertype)
 638         seutil_run_newrole($1_t,$1_r)
 639         seutil_exec_checkpolicy($1_t)
 640         seutil_exec_setfiles($1_usertype)
 641         # for when the network connection is killed
 642         # this is needed when a login role can change
 643         # to this one.
 644         seutil_dontaudit_signal_newrole($1_t)
 645
 646         tunable_policy(`user_direct_mouse',`
 647                 dev_read_mouse($1_usertype)
 648         ')
 649
 650         tunable_policy(`user_ttyfile_stat',`
 651                 term_getattr_all_ttys($1_t)
 652         ')
 653
 654         optional_policy(`
 655                 alsa_read_rw_config($1_usertype)
 656                 alsa_manage_home_files($1_t)
 657                 alsa_relabel_home_files($1_t)
 658         ')
 659
 660         optional_policy(`
 661                 # Allow graphical boot to check battery lifespan
 662                 apm_stream_connect($1_usertype)
 663         ')
 664
 665         optional_policy(`
 666                 canna_stream_connect($1_usertype)
 667         ')
 668
 669         optional_policy(`
 670                 chrome_role($1_r, $1_usertype)
 671         ')
 672
 673         optional_policy(`
 674                 colord_read_lib_files($1_usertype)
 675         ')
 676
 677         optional_policy(`
 678                 dbus_system_bus_client($1_usertype)
 679
 680                 allow $1_usertype $1_usertype:dbus  send_msg;
 681
 682                 optional_policy(`
 683                         avahi_dbus_chat($1_usertype)
 684                 ')
 685
 686                 optional_policy(`
 687                         policykit_dbus_chat($1_usertype)
 688                 ')
 689
 690                 optional_policy(`
 691                         bluetooth_dbus_chat($1_usertype)
 692                 ')
 693
 694                 optional_policy(`
 695                         consolekit_dbus_chat($1_usertype)
 696                         consolekit_read_log($1_usertype)
 697                 ')
 698
 699                 optional_policy(`
 700                         devicekit_dbus_chat($1_usertype)
 701                         devicekit_dbus_chat_power($1_usertype)
 702                         devicekit_dbus_chat_disk($1_usertype)
 703                 ')
 704
 705                 optional_policy(`
 706                         evolution_dbus_chat($1_usertype)
 707                         evolution_alarm_dbus_chat($1_usertype)
 708                 ')
 709
 710                 optional_policy(`
 711                         gnome_dbus_chat_gconfdefault($1_usertype)
 712                 ')
 713
 714                 optional_policy(`
 715                         hal_dbus_chat($1_usertype)
 716                 ')
 717
 718                 optional_policy(`
 719                         kde_dbus_chat_backlighthelper($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         modemmanager_dbus_chat($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         networkmanager_dbus_chat($1_usertype)
 728                         networkmanager_read_lib_files($1_usertype)
 729                 ')
 730
 731                 optional_policy(`
 732                         vpn_dbus_chat($1_usertype)
 733                 ')
 734         ')
 735
 736         optional_policy(`
 737                 git_session_role($1_r, $1_usertype)
 738         ')
 739
 740         optional_policy(`
 741                 inetd_use_fds($1_usertype)
 742                 inetd_rw_tcp_sockets($1_usertype)
 743         ')
 744
 745         optional_policy(`
 746                 inn_read_config($1_usertype)
 747                 inn_read_news_lib($1_usertype)
 748                 inn_read_news_spool($1_usertype)
 749         ')
 750
 751         optional_policy(`
 752                 lircd_stream_connect($1_usertype)
 753         ')
 754
 755         optional_policy(`
 756                 locate_read_lib_files($1_usertype)
 757         ')
 758
 759         # for running depmod as part of the kernel packaging process
 760         optional_policy(`
 761                 modutils_read_module_config($1_usertype)
 762         ')
 763
 764         optional_policy(`
 765                 mta_rw_spool($1_usertype)
 766                 mta_manage_queue($1_usertype)
 767         ')
 768
 769         optional_policy(`
 770                 nsplugin_role($1_r, $1_usertype)
 771         ')
 772
 773         optional_policy(`
 774                 tunable_policy(`allow_user_mysql_connect',`
 775                         mysql_stream_connect($1_t)
 776                 ')
 777         ')
 778
 779         optional_policy(`
 780                 oident_manage_user_content($1_t)
 781                 oident_relabel_user_content($1_t)
 782         ')
 783
 784         optional_policy(`
 785                 # to allow monitoring of pcmcia status
 786                 pcmcia_read_pid($1_usertype)
 787         ')
 788
 789         optional_policy(`
 790                 pcscd_read_pub_files($1_usertype)
 791                 pcscd_stream_connect($1_usertype)
 792         ')
 793
 794         optional_policy(`
 795                 tunable_policy(`allow_user_postgresql_connect',`
 796                         postgresql_stream_connect($1_usertype)
 797                         postgresql_tcp_connect($1_usertype)
 798                 ')
 799         ')
 800
 801         optional_policy(`
 802                 resmgr_stream_connect($1_usertype)
 803         ')
 804
 805         optional_policy(`
 806                 rpc_dontaudit_getattr_exports($1_usertype)
 807                 rpc_manage_nfs_rw_content($1_usertype)
 808         ')
 809
 810         optional_policy(`
 811                 rpcbind_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 samba_stream_connect_winbind($1_usertype)
 816         ')
 817
 818         optional_policy(`
 819                 sandbox_transition($1_usertype, $1_r)
 820         ')
 821
 822         optional_policy(`
 823                 seunshare_role_template($1, $1_r, $1_t)
 824         ')
 825
 826         optional_policy(`
 827                 slrnpull_search_spool($1_usertype)
 828         ')
 829
 830 ')
 831
 832 #######################################
 833 ## <summary>
 834 ##      The template for creating a login user.
 835 ## </summary>
 836 ## <desc>
 837 ##      <p>
 838 ##      This template creates a user domain, types, and
 839 ##      rules for the user's tty, pty, home directories,
 840 ##      tmp, and tmpfs files.
 841 ##      </p>
 842 ## </desc>
 843 ## <param name="userdomain_prefix">
 844 ##      <summary>
 845 ##      The prefix of the user domain (e.g., user
 846 ##      is the prefix for user_t).
 847 ##      </summary>
 848 ## </param>
 849 #
 850 template(`userdom_login_user_template', `
 851         gen_require(`
 852                 class context contains;
 853         ')
 854
 855         userdom_base_user_template($1)
 856
 857         userdom_manage_home_role($1_r, $1_usertype)
 858
 859         userdom_manage_tmp_role($1_r, $1_usertype)
 860         userdom_manage_tmpfs_role($1_r, $1_usertype)
 861
 862         ifelse(`$1',`unconfined',`',`
 863                 gen_tunable(allow_$1_exec_content, true)
 864
 865                 tunable_policy(`allow_$1_exec_content',`
 866                         userdom_exec_user_tmp_files($1_usertype)
 867                         userdom_exec_user_home_content_files($1_usertype)
 868                 ')
 869                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 870                         fs_exec_nfs_files($1_usertype)
 871                 ')
 872
 873                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 874                         fs_exec_cifs_files($1_usertype)
 875                 ')
 876         ')
 877
 878         userdom_change_password_template($1)
 879
 880         ##############################
 881         #
 882         # User domain Local policy
 883         #
 884
 885         allow $1_t self:capability { setgid chown fowner };
 886         dontaudit $1_t self:capability { sys_nice fsetid };
 887
 888         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 889         dontaudit $1_t self:process setrlimit;
 890         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 891
 892         allow $1_t self:context contains;
 893
 894         kernel_dontaudit_read_system_state($1_usertype)
 895         kernel_dontaudit_list_all_proc($1_usertype)
 896
 897         dev_read_sysfs($1_usertype)
 898         dev_read_urand($1_usertype)
 899
 900         domain_use_interactive_fds($1_usertype)
 901         # Command completion can fire hundreds of denials
 902         domain_dontaudit_exec_all_entry_files($1_usertype)
 903
 904         files_dontaudit_list_default($1_usertype)
 905         files_dontaudit_read_default_files($1_usertype)
 906         # Stat lost+found.
 907         files_getattr_lost_found_dirs($1_usertype)
 908
 909         fs_get_all_fs_quotas($1_usertype)
 910         fs_getattr_all_fs($1_usertype)
 911         fs_search_all($1_usertype)
 912         fs_list_inotifyfs($1_usertype)
 913         fs_rw_anon_inodefs_files($1_usertype)
 914
 915         auth_dontaudit_write_login_records($1_t)
 916         auth_rw_cache($1_t)
 917
 918         # Stop warnings about access to /dev/console
 919         init_dontaudit_use_fds($1_usertype)
 920         init_dontaudit_use_script_fds($1_usertype)
 921
 922         libs_exec_lib_files($1_usertype)
 923
 924         logging_dontaudit_getattr_all_logs($1_usertype)
 925
 926         # for running TeX programs
 927         miscfiles_read_tetex_data($1_usertype)
 928         miscfiles_exec_tetex_data($1_usertype)
 929
 930         seutil_read_config($1_usertype)
 931
 932         optional_policy(`
 933                 cups_read_config($1_usertype)
 934                 cups_stream_connect($1_usertype)
 935                 cups_stream_connect_ptal($1_usertype)
 936         ')
 937
 938         optional_policy(`
 939                 kerberos_use($1_usertype)
 940         ')
 941
 942         optional_policy(`
 943                 mta_dontaudit_read_spool_symlinks($1_usertype)
 944         ')
 945
 946         optional_policy(`
 947                 quota_dontaudit_getattr_db($1_usertype)
 948         ')
 949
 950         optional_policy(`
 951                 rpm_read_db($1_usertype)
 952                 rpm_dontaudit_manage_db($1_usertype)
 953                 rpm_read_cache($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 oddjob_run_mkhomedir($1_t, $1_r)
 958         ')
 959 ')
 960
 961 #######################################
 962 ## <summary>
 963 ##      The template for creating a unprivileged login user.
 964 ## </summary>
 965 ## <desc>
 966 ##      <p>
 967 ##      This template creates a user domain, types, and
 968 ##      rules for the user's tty, pty, home directories,
 969 ##      tmp, and tmpfs files.
 970 ##      </p>
 971 ## </desc>
 972 ## <param name="userdomain_prefix">
 973 ##      <summary>
 974 ##      The prefix of the user domain (e.g., user
 975 ##      is the prefix for user_t).
 976 ##      </summary>
 977 ## </param>
 978 #
 979 template(`userdom_restricted_user_template',`
 980         gen_require(`
 981                 attribute unpriv_userdomain;
 982         ')
 983
 984         userdom_login_user_template($1)
 985
 986         typeattribute $1_t unpriv_userdomain;
 987         domain_interactive_fd($1_t)
 988
 989         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
 990         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
 991
 992         ##############################
 993         #
 994         # Local policy
 995         #
 996
 997         optional_policy(`
 998                 loadkeys_run($1_t,$1_r)
 999         ')
1000 ')
1001
1002 #######################################
1003 ## <summary>
1004 ##      The template for creating a unprivileged xwindows login user.
1005 ## </summary>
1006 ## <desc>
1007 ##      <p>
1008 ##      The template for creating a unprivileged xwindows login user.
1009 ##      </p>
1010 ##      <p>
1011 ##      This template creates a user domain, types, and
1012 ##      rules for the user's tty, pty, home directories,
1013 ##      tmp, and tmpfs files.
1014 ##      </p>
1015 ## </desc>
1016 ## <param name="userdomain_prefix">
1017 ##      <summary>
1018 ##      The prefix of the user domain (e.g., user
1019 ##      is the prefix for user_t).
1020 ##      </summary>
1021 ## </param>
1022 #
1023 template(`userdom_restricted_xwindows_user_template',`
1024
1025         userdom_restricted_user_template($1)
1026
1027         ##############################
1028         #
1029         # Local policy
1030         #
1031
1032         auth_role($1_r, $1_t)
1033         auth_search_pam_console_data($1_usertype)
1034         auth_dontaudit_read_login_records($1_usertype)
1035
1036         dev_read_sound($1_usertype)
1037         dev_write_sound($1_usertype)
1038         # gnome keyring wants to read this.
1039         dev_dontaudit_read_rand($1_usertype)
1040         # temporarily allow since openoffice requires this
1041         dev_read_rand($1_usertype)
1042
1043         dev_read_video_dev($1_usertype)
1044         dev_write_video_dev($1_usertype)
1045         dev_rw_wireless($1_usertype)
1046
1047         libs_dontaudit_setattr_lib_files($1_usertype)
1048
1049         tunable_policy(`user_rw_noexattrfile',`
1050                 dev_rw_usbfs($1_t)
1051                 dev_rw_generic_usb_dev($1_usertype)
1052
1053                 fs_manage_noxattr_fs_files($1_usertype)
1054                 fs_manage_noxattr_fs_dirs($1_usertype)
1055                 fs_manage_dos_dirs($1_usertype)
1056                 fs_manage_dos_files($1_usertype)
1057                 storage_raw_read_removable_device($1_usertype)
1058                 storage_raw_write_removable_device($1_usertype)
1059         ')
1060
1061         logging_send_syslog_msg($1_usertype)
1062         logging_dontaudit_send_audit_msgs($1_t)
1063
1064         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1065         logging_send_audit_msgs($1_t)
1066         selinux_get_enforce_mode($1_t)
1067         seutil_exec_restorecond($1_t)
1068         seutil_read_file_contexts($1_t)
1069         seutil_read_default_contexts($1_t)
1070
1071         xserver_restricted_role($1_r, $1_t)
1072
1073         optional_policy(`
1074                 alsa_read_rw_config($1_usertype)
1075         ')
1076
1077          # cjp: needed by KDE apps
1078          # bug: #682499
1079          optional_policy(`
1080                 gnome_read_usr_config($1_usertype)
1081         ')
1082
1083         optional_policy(`
1084                 dbus_role_template($1, $1_r, $1_usertype)
1085                 dbus_system_bus_client($1_usertype)
1086                 allow $1_usertype $1_usertype:dbus send_msg;
1087
1088                 optional_policy(`
1089                         abrt_dbus_chat($1_usertype)
1090                         abrt_run_helper($1_usertype, $1_r)
1091                 ')
1092
1093                 optional_policy(`
1094                         consolekit_dontaudit_read_log($1_usertype)
1095                         consolekit_dbus_chat($1_usertype)
1096                 ')
1097
1098                 optional_policy(`
1099                         cups_dbus_chat($1_usertype)
1100                         cups_dbus_chat_config($1_usertype)
1101                 ')
1102
1103                 optional_policy(`
1104                         devicekit_dbus_chat($1_usertype)
1105                         devicekit_dbus_chat_disk($1_usertype)
1106                         devicekit_dbus_chat_power($1_usertype)
1107                 ')
1108
1109                 optional_policy(`
1110                         fprintd_dbus_chat($1_t)
1111                 ')
1112         ')
1113
1114         optional_policy(`
1115                 openoffice_role_template($1, $1_r, $1_usertype)
1116         ')
1117
1118         optional_policy(`
1119                 policykit_role($1_r, $1_usertype)
1120         ')
1121
1122         optional_policy(`
1123                 pulseaudio_role($1_r, $1_usertype)
1124         ')
1125
1126         optional_policy(`
1127                 rtkit_scheduled($1_usertype)
1128         ')
1129
1130         optional_policy(`
1131                 setroubleshoot_dontaudit_stream_connect($1_t)
1132         ')
1133
1134         optional_policy(`
1135                 udev_read_db($1_usertype)
1136         ')
1137
1138         optional_policy(`
1139                 wm_role_template($1, $1_r, $1_t)
1140         ')
1141 ')
1142
1143 #######################################
1144 ## <summary>
1145 ##      The template for creating a unprivileged user roughly
1146 ##      equivalent to a regular linux user.
1147 ## </summary>
1148 ## <desc>
1149 ##      <p>
1150 ##      The template for creating a unprivileged user roughly
1151 ##      equivalent to a regular linux user.
1152 ##      </p>
1153 ##      <p>
1154 ##      This template creates a user domain, types, and
1155 ##      rules for the user's tty, pty, home directories,
1156 ##      tmp, and tmpfs files.
1157 ##      </p>
1158 ## </desc>
1159 ## <param name="userdomain_prefix">
1160 ##      <summary>
1161 ##      The prefix of the user domain (e.g., user
1162 ##      is the prefix for user_t).
1163 ##      </summary>
1164 ## </param>
1165 #
1166 template(`userdom_unpriv_user_template', `
1167
1168         ##############################
1169         #
1170         # Declarations
1171         #
1172
1173         # Inherit rules for ordinary users.
1174         userdom_restricted_xwindows_user_template($1)
1175         userdom_common_user_template($1)
1176
1177         ##############################
1178         #
1179         # Local policy
1180         #
1181
1182         # port access is audited even if dac would not have allowed it, so dontaudit it here
1183 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1184         # Need the following rule to allow users to run vpnc
1185         corenet_tcp_bind_xserver_port($1_t)
1186         corenet_tcp_bind_generic_node($1_usertype)
1187
1188         storage_rw_fuse($1_t)
1189
1190         miscfiles_read_hwdata($1_usertype)
1191
1192         # Allow users to run TCP servers (bind to ports and accept connection from
1193         # the same domain and outside users) disabling this forces FTP passive mode
1194         # and may change other protocols
1195
1196         tunable_policy(`user_share_music',`
1197                 corenet_tcp_bind_daap_port($1_usertype)
1198         ')
1199
1200         tunable_policy(`user_tcp_server',`
1201                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1202         ')
1203
1204         tunable_policy(`user_setrlimit',`
1205                 allow $1_usertype self:process setrlimit;
1206         ')
1207
1208         optional_policy(`
1209                 cdrecord_role($1_r, $1_t)
1210         ')
1211
1212         optional_policy(`
1213                 cron_role($1_r, $1_t)
1214         ')
1215
1216         optional_policy(`
1217                 games_rw_data($1_usertype)
1218         ')
1219
1220         optional_policy(`
1221                 gpg_role($1_r, $1_usertype)
1222         ')
1223
1224         optional_policy(`
1225                 gnomeclock_dbus_chat($1_t)
1226         ')
1227
1228         optional_policy(`
1229                 gpm_stream_connect($1_usertype)
1230         ')
1231
1232         optional_policy(`
1233                 execmem_role_template($1, $1_r, $1_t)
1234         ')
1235
1236         optional_policy(`
1237                 java_role_template($1, $1_r, $1_t)
1238         ')
1239
1240         optional_policy(`
1241                 mono_role_template($1, $1_r, $1_t)
1242         ')
1243
1244         optional_policy(`
1245                 mount_run_fusermount($1_t, $1_r)
1246                 mount_read_pid_files($1_t)
1247         ')
1248
1249         optional_policy(`
1250                 wine_role_template($1, $1_r, $1_t)
1251         ')
1252
1253         optional_policy(`
1254                 postfix_run_postdrop($1_t, $1_r)
1255         ')
1256
1257         # Run pppd in pppd_t by default for user
1258         optional_policy(`
1259                 ppp_run_cond($1_t, $1_r)
1260         ')
1261 ')
1262
1263 #######################################
1264 ## <summary>
1265 ##      The template for creating an administrative user.
1266 ## </summary>
1267 ## <desc>
1268 ##      <p>
1269 ##      This template creates a user domain, types, and
1270 ##      rules for the user's tty, pty, home directories,
1271 ##      tmp, and tmpfs files.
1272 ##      </p>
1273 ##      <p>
1274 ##      The privileges given to administrative users are:
1275 ##      <ul>
1276 ##              <li>Raw disk access</li>
1277 ##              <li>Set all sysctls</li>
1278 ##              <li>All kernel ring buffer controls</li>
1279 ##              <li>Create, read, write, and delete all files but shadow</li>
1280 ##              <li>Manage source and binary format SELinux policy</li>
1281 ##              <li>Run insmod</li>
1282 ##      </ul>
1283 ##      </p>
1284 ## </desc>
1285 ## <param name="userdomain_prefix">
1286 ##      <summary>
1287 ##      The prefix of the user domain (e.g., sysadm
1288 ##      is the prefix for sysadm_t).
1289 ##      </summary>
1290 ## </param>
1291 #
1292 template(`userdom_admin_user_template',`
1293         gen_require(`
1294                 attribute admindomain;
1295                 class passwd { passwd chfn chsh rootok crontab };
1296         ')
1297
1298         ##############################
1299         #
1300         # Declarations
1301         #
1302
1303         # Inherit rules for ordinary users.
1304         userdom_login_user_template($1)
1305         userdom_common_user_template($1)
1306
1307         domain_obj_id_change_exemption($1_t)
1308         role system_r types $1_t;
1309
1310         typeattribute $1_t admindomain;
1311
1312         ifdef(`direct_sysadm_daemon',`
1313                 domain_system_change_exemption($1_t)
1314         ')
1315
1316         ##############################
1317         #
1318         # $1_t local policy
1319         #
1320
1321         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1322         allow $1_t self:capability2 syslog;
1323         allow $1_t self:process { setexec setfscreate };
1324         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1325         allow $1_t self:tun_socket create;
1326         # Set password information for other users.
1327         allow $1_t self:passwd { passwd chfn chsh };
1328         # Skip authentication when pam_rootok is specified.
1329         allow $1_t self:passwd rootok;
1330
1331         # Manipulate other users crontab.
1332         allow $1_t self:passwd crontab;
1333
1334         kernel_read_software_raid_state($1_t)
1335         kernel_getattr_core_if($1_t)
1336         kernel_getattr_message_if($1_t)
1337         kernel_change_ring_buffer_level($1_t)
1338         kernel_clear_ring_buffer($1_t)
1339         kernel_read_ring_buffer($1_t)
1340         kernel_get_sysvipc_info($1_t)
1341         kernel_rw_all_sysctls($1_t)
1342         # signal unlabeled processes:
1343         kernel_kill_unlabeled($1_t)
1344         kernel_signal_unlabeled($1_t)
1345         kernel_sigstop_unlabeled($1_t)
1346         kernel_signull_unlabeled($1_t)
1347         kernel_sigchld_unlabeled($1_t)
1348         kernel_signal($1_t)
1349
1350         corenet_tcp_bind_generic_port($1_t)
1351         # allow setting up tunnels
1352         corenet_rw_tun_tap_dev($1_t)
1353
1354         dev_getattr_generic_blk_files($1_t)
1355         dev_getattr_generic_chr_files($1_t)
1356         # for lsof
1357         dev_getattr_mtrr_dev($1_t)
1358         # Allow MAKEDEV to work
1359         dev_create_all_blk_files($1_t)
1360         dev_create_all_chr_files($1_t)
1361         dev_delete_all_blk_files($1_t)
1362         dev_delete_all_chr_files($1_t)
1363         dev_rename_all_blk_files($1_t)
1364         dev_rename_all_chr_files($1_t)
1365         dev_create_generic_symlinks($1_t)
1366         dev_rw_generic_usb_dev($1_t)
1367         dev_rw_usbfs($1_t)
1368
1369         domain_setpriority_all_domains($1_t)
1370         domain_read_all_domains_state($1_t)
1371         domain_getattr_all_domains($1_t)
1372         domain_getcap_all_domains($1_t)
1373         domain_dontaudit_ptrace_all_domains($1_t)
1374         # signal all domains:
1375         domain_kill_all_domains($1_t)
1376         domain_signal_all_domains($1_t)
1377         domain_signull_all_domains($1_t)
1378         domain_sigstop_all_domains($1_t)
1379         domain_sigstop_all_domains($1_t)
1380         domain_sigchld_all_domains($1_t)
1381         # for lsof
1382         domain_getattr_all_sockets($1_t)
1383         domain_dontaudit_getattr_all_sockets($1_t)
1384
1385         files_exec_usr_src_files($1_t)
1386
1387         fs_getattr_all_fs($1_t)
1388         fs_getattr_all_files($1_t)
1389         fs_list_all($1_t)
1390         fs_set_all_quotas($1_t)
1391         fs_exec_noxattr($1_t)
1392
1393         storage_raw_read_removable_device($1_t)
1394         storage_raw_write_removable_device($1_t)
1395         storage_dontaudit_read_fixed_disk($1_t)
1396
1397         term_use_all_inherited_terms($1_t)
1398
1399         auth_getattr_shadow($1_t)
1400         # Manage almost all files
1401         auth_manage_all_files_except_shadow($1_t)
1402         # Relabel almost all files
1403         auth_relabel_all_files_except_shadow($1_t)
1404
1405         init_telinit($1_t)
1406
1407         logging_send_syslog_msg($1_t)
1408
1409         optional_policy(`
1410                 modutils_domtrans_insmod($1_t)
1411                 modutils_domtrans_depmod($1_t)
1412         ')
1413
1414         # The following rule is temporary until such time that a complete
1415         # policy management infrastructure is in place so that an administrator
1416         # cannot directly manipulate policy files with arbitrary programs.
1417         seutil_manage_src_policy($1_t)
1418         # Violates the goal of limiting write access to checkpolicy.
1419         # But presently necessary for installing the file_contexts file.
1420         seutil_manage_bin_policy($1_t)
1421
1422         userdom_manage_user_home_content_dirs($1_t)
1423         userdom_manage_user_home_content_files($1_t)
1424         userdom_manage_user_home_content_symlinks($1_t)
1425         userdom_manage_user_home_content_pipes($1_t)
1426         userdom_manage_user_home_content_sockets($1_t)
1427         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1428
1429         tunable_policy(`user_rw_noexattrfile',`
1430                 fs_manage_noxattr_fs_files($1_t)
1431                 fs_manage_noxattr_fs_dirs($1_t)
1432         ',`
1433                 fs_read_noxattr_fs_files($1_t)
1434         ')
1435
1436         optional_policy(`
1437                 postgresql_unconfined($1_t)
1438         ')
1439
1440         optional_policy(`
1441                 userhelper_exec($1_t)
1442         ')
1443 ')
1444
1445 ########################################
1446 ## <summary>
1447 ##      Allow user to run as a secadm
1448 ## </summary>
1449 ## <desc>
1450 ##      <p>
1451 ##      Create objects in a user home directory
1452 ##      with an automatic type transition to
1453 ##      a specified private type.
1454 ##      </p>
1455 ##      <p>
1456 ##      This is a templated interface, and should only
1457 ##      be called from a per-userdomain template.
1458 ##      </p>
1459 ## </desc>
1460 ## <param name="domain">
1461 ##      <summary>
1462 ##      Domain allowed access.
1463 ##      </summary>
1464 ## </param>
1465 ## <param name="role">
1466 ##      <summary>
1467 ##      The role  of the object to create.
1468 ##      </summary>
1469 ## </param>
1470 #
1471 template(`userdom_security_admin_template',`
1472         allow $1 self:capability { dac_read_search dac_override };
1473
1474         corecmd_exec_shell($1)
1475
1476         domain_obj_id_change_exemption($1)
1477
1478         dev_relabel_all_dev_nodes($1)
1479
1480         files_create_boot_flag($1)
1481         files_create_default_dir($1)
1482         files_root_filetrans_default($1, dir)
1483
1484         # Necessary for managing /boot/efi
1485         fs_manage_dos_files($1)
1486
1487         mls_process_read_up($1)
1488         mls_file_read_all_levels($1)
1489         mls_file_upgrade($1)
1490         mls_file_downgrade($1)
1491
1492         selinux_set_enforce_mode($1)
1493         selinux_set_all_booleans($1)
1494         selinux_set_parameters($1)
1495         selinux_read_policy($1)
1496
1497         auth_relabel_all_files_except_shadow($1)
1498         auth_relabel_shadow($1)
1499
1500         init_exec($1)
1501
1502         logging_send_syslog_msg($1)
1503         logging_read_audit_log($1)
1504         logging_read_generic_logs($1)
1505         logging_read_audit_config($1)
1506
1507         seutil_manage_bin_policy($1)
1508         seutil_run_checkpolicy($1,$2)
1509         seutil_run_loadpolicy($1,$2)
1510         seutil_run_semanage($1,$2)
1511         seutil_run_setsebool($1,$2)
1512         seutil_run_setfiles($1, $2)
1513
1514         optional_policy(`
1515                 aide_run($1,$2)
1516         ')
1517
1518         optional_policy(`
1519                 consoletype_exec($1)
1520         ')
1521
1522         optional_policy(`
1523                 dmesg_exec($1)
1524         ')
1525
1526         optional_policy(`
1527                 ipsec_run_setkey($1,$2)
1528         ')
1529
1530         optional_policy(`
1531                 netlabel_run_mgmt($1,$2)
1532         ')
1533
1534         optional_policy(`
1535                 samhain_run($1, $2)
1536         ')
1537 ')
1538
1539 ########################################
1540 ## <summary>
1541 ##      Make the specified type usable in a
1542 ##      user home directory.
1543 ## </summary>
1544 ## <param name="type">
1545 ##      <summary>
1546 ##      Type to be used as a file in the
1547 ##      user home directory.
1548 ##      </summary>
1549 ## </param>
1550 #
1551 interface(`userdom_user_home_content',`
1552         gen_require(`
1553                 type user_home_t;
1554                 attribute user_home_type;
1555         ')
1556
1557         allow $1 user_home_t:filesystem associate;
1558         files_type($1)
1559         ubac_constrained($1)
1560
1561         files_poly_member($1)
1562         typeattribute $1  user_home_type;
1563 ')
1564
1565 ########################################
1566 ## <summary>
1567 ##      Make the specified type usable in a
1568 ##      generic temporary directory.
1569 ## </summary>
1570 ## <param name="type">
1571 ##      <summary>
1572 ##      Type to be used as a file in the
1573 ##      generic temporary directory.
1574 ##      </summary>
1575 ## </param>
1576 #
1577 interface(`userdom_user_tmp_content',`
1578         gen_require(`
1579                 attribute user_tmp_type;
1580         ')
1581
1582         typeattribute $1 user_tmp_type;
1583
1584         files_tmp_file($1)
1585         ubac_constrained($1)
1586 ')
1587
1588 ########################################
1589 ## <summary>
1590 ##      Allow domain to attach to TUN devices created by administrative users.
1591 ## </summary>
1592 ## <param name="domain">
1593 ##      <summary>
1594 ##      Domain allowed access.
1595 ##      </summary>
1596 ## </param>
1597 #
1598 interface(`userdom_attach_admin_tun_iface',`
1599         gen_require(`
1600                 attribute admindomain;
1601         ')
1602
1603         allow $1 admindomain:tun_socket relabelfrom;
1604         allow $1 self:tun_socket relabelto;
1605 ')
1606
1607 ########################################
1608 ## <summary>
1609 ##      Set the attributes of a user pty.
1610 ## </summary>
1611 ## <param name="domain">
1612 ##      <summary>
1613 ##      Domain allowed access.
1614 ##      </summary>
1615 ## </param>
1616 #
1617 interface(`userdom_setattr_user_ptys',`
1618         gen_require(`
1619                 type user_devpts_t;
1620         ')
1621
1622         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1623 ')
1624
1625 ########################################
1626 ## <summary>
1627 ##      Create a user pty.
1628 ## </summary>
1629 ## <param name="domain">
1630 ##      <summary>
1631 ##      Domain allowed access.
1632 ##      </summary>
1633 ## </param>
1634 #
1635 interface(`userdom_create_user_pty',`
1636         gen_require(`
1637                 type user_devpts_t;
1638         ')
1639
1640         term_create_pty($1, user_devpts_t)
1641 ')
1642
1643 ########################################
1644 ## <summary>
1645 ##      Get the attributes of user home directories.
1646 ## </summary>
1647 ## <param name="domain">
1648 ##      <summary>
1649 ##      Domain allowed access.
1650 ##      </summary>
1651 ## </param>
1652 #
1653 interface(`userdom_getattr_user_home_dirs',`
1654         gen_require(`
1655                 type user_home_dir_t;
1656         ')
1657
1658         allow $1 user_home_dir_t:dir getattr_dir_perms;
1659         files_search_home($1)
1660 ')
1661
1662 ########################################
1663 ## <summary>
1664 ##      Do not audit attempts to get the attributes of user home directories.
1665 ## </summary>
1666 ## <param name="domain">
1667 ##      <summary>
1668 ##      Domain to not audit.
1669 ##      </summary>
1670 ## </param>
1671 #
1672 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1673         gen_require(`
1674                 type user_home_dir_t;
1675         ')
1676
1677         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1678 ')
1679
1680 ########################################
1681 ## <summary>
1682 ##      Search user home directories.
1683 ## </summary>
1684 ## <param name="domain">
1685 ##      <summary>
1686 ##      Domain allowed access.
1687 ##      </summary>
1688 ## </param>
1689 #
1690 interface(`userdom_search_user_home_dirs',`
1691         gen_require(`
1692                 type user_home_dir_t;
1693         ')
1694
1695         allow $1 user_home_dir_t:dir search_dir_perms;
1696         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1697         files_search_home($1)
1698 ')
1699
1700 ########################################
1701 ## <summary>
1702 ##      Do not audit attempts to search user home directories.
1703 ## </summary>
1704 ## <desc>
1705 ##      <p>
1706 ##      Do not audit attempts to search user home directories.
1707 ##      This will supress SELinux denial messages when the specified
1708 ##      domain is denied the permission to search these directories.
1709 ##      </p>
1710 ## </desc>
1711 ## <param name="domain">
1712 ##      <summary>
1713 ##      Domain to not audit.
1714 ##      </summary>
1715 ## </param>
1716 ## <infoflow type="none"/>
1717 #
1718 interface(`userdom_dontaudit_search_user_home_dirs',`
1719         gen_require(`
1720                 type user_home_dir_t;
1721         ')
1722
1723         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1724 ')
1725
1726 ########################################
1727 ## <summary>
1728 ##      List user home directories.
1729 ## </summary>
1730 ## <param name="domain">
1731 ##      <summary>
1732 ##      Domain allowed access.
1733 ##      </summary>
1734 ## </param>
1735 #
1736 interface(`userdom_list_user_home_dirs',`
1737         gen_require(`
1738                 type user_home_dir_t;
1739         ')
1740
1741         allow $1 user_home_dir_t:dir list_dir_perms;
1742         files_search_home($1)
1743
1744         tunable_policy(`use_nfs_home_dirs',`
1745                 fs_list_nfs($1)
1746         ')
1747
1748         tunable_policy(`use_samba_home_dirs',`
1749                 fs_list_cifs($1)
1750         ')
1751 ')
1752
1753 ########################################
1754 ## <summary>
1755 ##      Do not audit attempts to list user home subdirectories.
1756 ## </summary>
1757 ## <param name="domain">
1758 ##      <summary>
1759 ##      Domain to not audit.
1760 ##      </summary>
1761 ## </param>
1762 #
1763 interface(`userdom_dontaudit_list_user_home_dirs',`
1764         gen_require(`
1765                 type user_home_dir_t;
1766                 type user_home_t;
1767         ')
1768
1769         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1770         dontaudit $1 user_home_t:dir list_dir_perms;
1771 ')
1772
1773 ########################################
1774 ## <summary>
1775 ##      Create user home directories.
1776 ## </summary>
1777 ## <param name="domain">
1778 ##      <summary>
1779 ##      Domain allowed access.
1780 ##      </summary>
1781 ## </param>
1782 #
1783 interface(`userdom_create_user_home_dirs',`
1784         gen_require(`
1785                 type user_home_dir_t;
1786         ')
1787
1788         allow $1 user_home_dir_t:dir create_dir_perms;
1789 ')
1790
1791 ########################################
1792 ## <summary>
1793 ##      Create user home directories.
1794 ## </summary>
1795 ## <param name="domain">
1796 ##      <summary>
1797 ##      Domain allowed access.
1798 ##      </summary>
1799 ## </param>
1800 #
1801 interface(`userdom_manage_user_home_dirs',`
1802         gen_require(`
1803                 type user_home_dir_t;
1804         ')
1805
1806         allow $1 user_home_dir_t:dir manage_dir_perms;
1807 ')
1808
1809 ########################################
1810 ## <summary>
1811 ##      Relabel to user home directories.
1812 ## </summary>
1813 ## <param name="domain">
1814 ##      <summary>
1815 ##      Domain allowed access.
1816 ##      </summary>
1817 ## </param>
1818 #
1819 interface(`userdom_relabelto_user_home_dirs',`
1820         gen_require(`
1821                 type user_home_dir_t;
1822         ')
1823
1824         allow $1 user_home_dir_t:dir relabelto;
1825 ')
1826
1827
1828 ########################################
1829 ## <summary>
1830 ##      Relabel to user home files.
1831 ## </summary>
1832 ## <param name="domain">
1833 ##      <summary>
1834 ##      Domain allowed access.
1835 ##      </summary>
1836 ## </param>
1837 #
1838 interface(`userdom_relabelto_user_home_files',`
1839         gen_require(`
1840                 type user_home_t;
1841         ')
1842
1843         allow $1 user_home_t:file relabelto;
1844 ')
1845 ########################################
1846 ## <summary>
1847 ##      Relabel user home files.
1848 ## </summary>
1849 ## <param name="domain">
1850 ##      <summary>
1851 ##      Domain allowed access.
1852 ##      </summary>
1853 ## </param>
1854 #
1855 interface(`userdom_relabel_user_home_files',`
1856         gen_require(`
1857                 type user_home_t;
1858         ')
1859
1860         allow $1 user_home_t:file relabel_file_perms;
1861 ')
1862
1863 ########################################
1864 ## <summary>
1865 ##      Create directories in the home dir root with
1866 ##      the user home directory type.
1867 ## </summary>
1868 ## <param name="domain">
1869 ##      <summary>
1870 ##      Domain allowed access.
1871 ##      </summary>
1872 ## </param>
1873 #
1874 interface(`userdom_home_filetrans_user_home_dir',`
1875         gen_require(`
1876                 type user_home_dir_t;
1877         ')
1878
1879         files_home_filetrans($1, user_home_dir_t, dir)
1880 ')
1881
1882 ########################################
1883 ## <summary>
1884 ##      Do a domain transition to the specified
1885 ##      domain when executing a program in the
1886 ##      user home directory.
1887 ## </summary>
1888 ## <desc>
1889 ##      <p>
1890 ##      Do a domain transition to the specified
1891 ##      domain when executing a program in the
1892 ##      user home directory.
1893 ##      </p>
1894 ##      <p>
1895 ##      No interprocess communication (signals, pipes,
1896 ##      etc.) is provided by this interface since
1897 ##      the domains are not owned by this module.
1898 ##      </p>
1899 ## </desc>
1900 ## <param name="source_domain">
1901 ##      <summary>
1902 ##      Domain allowed to transition.
1903 ##      </summary>
1904 ## </param>
1905 ## <param name="target_domain">
1906 ##      <summary>
1907 ##      Domain to transition to.
1908 ##      </summary>
1909 ## </param>
1910 #
1911 interface(`userdom_user_home_domtrans',`
1912         gen_require(`
1913                 type user_home_dir_t, user_home_t;
1914         ')
1915
1916         domain_auto_trans($1, user_home_t, $2)
1917         allow $1 user_home_dir_t:dir search_dir_perms;
1918         files_search_home($1)
1919 ')
1920
1921 ########################################
1922 ## <summary>
1923 ##      Do not audit attempts to search user home content directories.
1924 ## </summary>
1925 ## <param name="domain">
1926 ##      <summary>
1927 ##      Domain to not audit.
1928 ##      </summary>
1929 ## </param>
1930 #
1931 interface(`userdom_dontaudit_search_user_home_content',`
1932         gen_require(`
1933                 type user_home_t;
1934         ')
1935
1936         dontaudit $1 user_home_t:dir search_dir_perms;
1937         fs_dontaudit_list_nfs($1)
1938         fs_dontaudit_list_cifs($1)
1939 ')
1940
1941 ########################################
1942 ## <summary>
1943 ##      List contents of users home directory.
1944 ## </summary>
1945 ## <param name="domain">
1946 ##      <summary>
1947 ##      Domain allowed access.
1948 ##      </summary>
1949 ## </param>
1950 #
1951 interface(`userdom_list_user_home_content',`
1952         gen_require(`
1953                 type user_home_dir_t;
1954                 attribute user_home_type;
1955         ')
1956
1957         files_list_home($1)
1958         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
1959 ')
1960
1961 ########################################
1962 ## <summary>
1963 ##      Create, read, write, and delete directories
1964 ##      in a user home subdirectory.
1965 ## </summary>
1966 ## <param name="domain">
1967 ##      <summary>
1968 ##      Domain allowed access.
1969 ##      </summary>
1970 ## </param>
1971 #
1972 interface(`userdom_manage_user_home_content_dirs',`
1973         gen_require(`
1974                 type user_home_dir_t, user_home_t;
1975         ')
1976
1977         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
1978         files_search_home($1)
1979 ')
1980
1981 ########################################
1982 ## <summary>
1983 ##      Delete directories in a user home subdirectory.
1984 ## </summary>
1985 ## <param name="domain">
1986 ##      <summary>
1987 ##      Domain allowed access.
1988 ##      </summary>
1989 ## </param>
1990 #
1991 interface(`userdom_delete_user_home_content_dirs',`
1992         gen_require(`
1993                 type user_home_t;
1994         ')
1995
1996         allow $1 user_home_t:dir delete_dir_perms;
1997 ')
1998
1999 ########################################
2000 ## <summary>
2001 ##      Set the attributes of user home files.
2002 ## </summary>
2003 ## <param name="domain">
2004 ##      <summary>
2005 ##      Domain allowed access.
2006 ##      </summary>
2007 ## </param>
2008 ## <rolecap/>
2009 #
2010 interface(`userdom_setattr_user_home_content_files',`
2011         gen_require(`
2012                 type user_home_t;
2013         ')
2014
2015         allow $1 user_home_t:file setattr;
2016 ')
2017
2018 ########################################
2019 ## <summary>
2020 ##      Do not audit attempts to set the
2021 ##      attributes of user home files.
2022 ## </summary>
2023 ## <param name="domain">
2024 ##      <summary>
2025 ##      Domain to not audit.
2026 ##      </summary>
2027 ## </param>
2028 #
2029 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2030         gen_require(`
2031                 type user_home_t;
2032         ')
2033
2034         dontaudit $1 user_home_t:file setattr_file_perms;
2035 ')
2036
2037 ########################################
2038 ## <summary>
2039 ##      Mmap user home files.
2040 ## </summary>
2041 ## <param name="domain">
2042 ##      <summary>
2043 ##      Domain allowed access.
2044 ##      </summary>
2045 ## </param>
2046 #
2047 interface(`userdom_mmap_user_home_content_files',`
2048         gen_require(`
2049                 type user_home_dir_t, user_home_t;
2050         ')
2051
2052         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2053         files_search_home($1)
2054 ')
2055
2056 ########################################
2057 ## <summary>
2058 ##      Read user home files.
2059 ## </summary>
2060 ## <param name="domain">
2061 ##      <summary>
2062 ##      Domain allowed access.
2063 ##      </summary>
2064 ## </param>
2065 #
2066 interface(`userdom_read_user_home_content_files',`
2067         gen_require(`
2068                 type user_home_dir_t, user_home_t;
2069         ')
2070
2071         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2072         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2073         files_search_home($1)
2074 ')
2075
2076 ########################################
2077 ## <summary>
2078 ##      Do not audit attempts to getattr user home files.
2079 ## </summary>
2080 ## <param name="domain">
2081 ##      <summary>
2082 ##      Domain to not audit.
2083 ##      </summary>
2084 ## </param>
2085 #
2086 interface(`userdom_dontaudit_getattr_user_home_content',`
2087         gen_require(`
2088                 attribute user_home_type;
2089         ')
2090
2091         dontaudit $1 user_home_type:dir getattr;
2092         dontaudit $1 user_home_type:file getattr;
2093 ')
2094
2095 ########################################
2096 ## <summary>
2097 ##      Do not audit attempts to read user home files.
2098 ## </summary>
2099 ## <param name="domain">
2100 ##      <summary>
2101 ##      Domain to not audit.
2102 ##      </summary>
2103 ## </param>
2104 #
2105 interface(`userdom_dontaudit_read_user_home_content_files',`
2106         gen_require(`
2107                 attribute user_home_type;
2108                 type user_home_dir_t;
2109         ')
2110
2111         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2112         dontaudit $1 user_home_type:dir list_dir_perms;
2113         dontaudit $1 user_home_type:file read_file_perms;
2114         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2115 ')
2116
2117 ########################################
2118 ## <summary>
2119 ##      Do not audit attempts to append user home files.
2120 ## </summary>
2121 ## <param name="domain">
2122 ##      <summary>
2123 ##      Domain to not audit.
2124 ##      </summary>
2125 ## </param>
2126 #
2127 interface(`userdom_dontaudit_append_user_home_content_files',`
2128         gen_require(`
2129                 type user_home_t;
2130         ')
2131
2132         dontaudit $1 user_home_t:file append_file_perms;
2133 ')
2134
2135 ########################################
2136 ## <summary>
2137 ##      Do not audit attempts to write user home files.
2138 ## </summary>
2139 ## <param name="domain">
2140 ##      <summary>
2141 ##      Domain to not audit.
2142 ##      </summary>
2143 ## </param>
2144 #
2145 interface(`userdom_dontaudit_write_user_home_content_files',`
2146         gen_require(`
2147                 type user_home_t;
2148         ')
2149
2150         dontaudit $1 user_home_t:file write_file_perms;
2151 ')
2152
2153 ########################################
2154 ## <summary>
2155 ##      Delete files in a user home subdirectory.
2156 ## </summary>
2157 ## <param name="domain">
2158 ##      <summary>
2159 ##      Domain allowed access.
2160 ##      </summary>
2161 ## </param>
2162 #
2163 interface(`userdom_delete_user_home_content_files',`
2164         gen_require(`
2165                 type user_home_t;
2166         ')
2167
2168         allow $1 user_home_t:file delete_file_perms;
2169 ')
2170
2171 ########################################
2172 ## <summary>
2173 ##      Delete sock files in a user home subdirectory.
2174 ## </summary>
2175 ## <param name="domain">
2176 ##      <summary>
2177 ##      Domain allowed access.
2178 ##      </summary>
2179 ## </param>
2180 #
2181 interface(`userdom_delete_user_home_content_sock_files',`
2182         gen_require(`
2183                 type user_home_t;
2184         ')
2185
2186         allow $1 user_home_t:sock_file delete_file_perms;
2187 ')
2188
2189 ########################################
2190 ## <summary>
2191 ##      Do not audit attempts to write user home files.
2192 ## </summary>
2193 ## <param name="domain">
2194 ##      <summary>
2195 ##      Domain to not audit.
2196 ##      </summary>
2197 ## </param>
2198 #
2199 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2200         gen_require(`
2201                 type user_home_t;
2202         ')
2203
2204         dontaudit $1 user_home_t:file relabel_file_perms;
2205 ')
2206
2207 ########################################
2208 ## <summary>
2209 ##      Read user home subdirectory symbolic links.
2210 ## </summary>
2211 ## <param name="domain">
2212 ##      <summary>
2213 ##      Domain allowed access.
2214 ##      </summary>
2215 ## </param>
2216 #
2217 interface(`userdom_read_user_home_content_symlinks',`
2218         gen_require(`
2219                 type user_home_dir_t, user_home_t;
2220         ')
2221
2222         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2223 ')
2224
2225 ########################################
2226 ## <summary>
2227 ##      Execute user home files.
2228 ## </summary>
2229 ## <param name="domain">
2230 ##      <summary>
2231 ##      Domain allowed access.
2232 ##      </summary>
2233 ## </param>
2234 ## <rolecap/>
2235 #
2236 interface(`userdom_exec_user_home_content_files',`
2237         gen_require(`
2238                 type user_home_dir_t;
2239                 attribute user_home_type;
2240         ')
2241
2242         files_search_home($1)
2243         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2244         dontaudit $1 user_home_type:sock_file execute;
2245         ')
2246
2247 ########################################
2248 ## <summary>
2249 ##      Do not audit attempts to execute user home files.
2250 ## </summary>
2251 ## <param name="domain">
2252 ##      <summary>
2253 ##      Domain to not audit.
2254 ##      </summary>
2255 ## </param>
2256 #
2257 interface(`userdom_dontaudit_exec_user_home_content_files',`
2258         gen_require(`
2259                 type user_home_t;
2260         ')
2261
2262         dontaudit $1 user_home_t:file exec_file_perms;
2263 ')
2264
2265 ########################################
2266 ## <summary>
2267 ##      Create, read, write, and delete files
2268 ##      in a user home subdirectory.
2269 ## </summary>
2270 ## <param name="domain">
2271 ##      <summary>
2272 ##      Domain allowed access.
2273 ##      </summary>
2274 ## </param>
2275 #
2276 interface(`userdom_manage_user_home_content_files',`
2277         gen_require(`
2278                 type user_home_dir_t, user_home_t;
2279         ')
2280
2281         manage_files_pattern($1, user_home_t, user_home_t)
2282         allow $1 user_home_dir_t:dir search_dir_perms;
2283         files_search_home($1)
2284 ')
2285
2286 ########################################
2287 ## <summary>
2288 ##      Do not audit attempts to create, read, write, and delete directories
2289 ##      in a user home subdirectory.
2290 ## </summary>
2291 ## <param name="domain">
2292 ##      <summary>
2293 ##      Domain to not audit.
2294 ##      </summary>
2295 ## </param>
2296 #
2297 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2298         gen_require(`
2299                 type user_home_dir_t, user_home_t;
2300         ')
2301
2302         dontaudit $1 user_home_t:dir manage_dir_perms;
2303 ')
2304
2305 ########################################
2306 ## <summary>
2307 ##      Create, read, write, and delete symbolic links
2308 ##      in a user home subdirectory.
2309 ## </summary>
2310 ## <param name="domain">
2311 ##      <summary>
2312 ##      Domain allowed access.
2313 ##      </summary>
2314 ## </param>
2315 #
2316 interface(`userdom_manage_user_home_content_symlinks',`
2317         gen_require(`
2318                 type user_home_dir_t, user_home_t;
2319         ')
2320
2321         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2322         allow $1 user_home_dir_t:dir search_dir_perms;
2323         files_search_home($1)
2324 ')
2325
2326 ########################################
2327 ## <summary>
2328 ##      Delete symbolic links in a user home directory.
2329 ## </summary>
2330 ## <param name="domain">
2331 ##      <summary>
2332 ##      Domain allowed access.
2333 ##      </summary>
2334 ## </param>
2335 #
2336 interface(`userdom_delete_user_home_content_symlinks',`
2337         gen_require(`
2338                 type user_home_t;
2339         ')
2340
2341         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2342 ')
2343
2344 ########################################
2345 ## <summary>
2346 ##      Create, read, write, and delete named pipes
2347 ##      in a user home subdirectory.
2348 ## </summary>
2349 ## <param name="domain">
2350 ##      <summary>
2351 ##      Domain allowed access.
2352 ##      </summary>
2353 ## </param>
2354 #
2355 interface(`userdom_manage_user_home_content_pipes',`
2356         gen_require(`
2357                 type user_home_dir_t, user_home_t;
2358         ')
2359
2360         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2361         allow $1 user_home_dir_t:dir search_dir_perms;
2362         files_search_home($1)
2363 ')
2364
2365 ########################################
2366 ## <summary>
2367 ##      Create, read, write, and delete named sockets
2368 ##      in a user home subdirectory.
2369 ## </summary>
2370 ## <param name="domain">
2371 ##      <summary>
2372 ##      Domain allowed access.
2373 ##      </summary>
2374 ## </param>
2375 #
2376 interface(`userdom_manage_user_home_content_sockets',`
2377         gen_require(`
2378                 type user_home_dir_t, user_home_t;
2379         ')
2380
2381         allow $1 user_home_dir_t:dir search_dir_perms;
2382         manage_sock_files_pattern($1, user_home_t, user_home_t)
2383         files_search_home($1)
2384 ')
2385
2386 ########################################
2387 ## <summary>
2388 ##      Create objects in a user home directory
2389 ##      with an automatic type transition to
2390 ##      a specified private type.
2391 ## </summary>
2392 ## <param name="domain">
2393 ##      <summary>
2394 ##      Domain allowed access.
2395 ##      </summary>
2396 ## </param>
2397 ## <param name="private_type">
2398 ##      <summary>
2399 ##      The type of the object to create.
2400 ##      </summary>
2401 ## </param>
2402 ## <param name="object_class">
2403 ##      <summary>
2404 ##      The class of the object to be created.
2405 ##      </summary>
2406 ## </param>
2407 #
2408 interface(`userdom_user_home_dir_filetrans',`
2409         gen_require(`
2410                 type user_home_dir_t;
2411         ')
2412
2413         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2414         files_search_home($1)
2415 ')
2416
2417 ########################################
2418 ## <summary>
2419 ##      Create objects in a user home directory
2420 ##      with an automatic type transition to
2421 ##      a specified private type.
2422 ## </summary>
2423 ## <param name="domain">
2424 ##      <summary>
2425 ##      Domain allowed access.
2426 ##      </summary>
2427 ## </param>
2428 ## <param name="private_type">
2429 ##      <summary>
2430 ##      The type of the object to create.
2431 ##      </summary>
2432 ## </param>
2433 ## <param name="object_class">
2434 ##      <summary>
2435 ##      The class of the object to be created.
2436 ##      </summary>
2437 ## </param>
2438 #
2439 interface(`userdom_user_home_content_filetrans',`
2440         gen_require(`
2441                 type user_home_dir_t, user_home_t;
2442         ')
2443
2444         filetrans_pattern($1, user_home_t, $2, $3)
2445         allow $1 user_home_dir_t:dir search_dir_perms;
2446         files_search_home($1)
2447 ')
2448
2449 ########################################
2450 ## <summary>
2451 ##      Create objects in a user home directory
2452 ##      with an automatic type transition to
2453 ##      the user home file type.
2454 ## </summary>
2455 ## <param name="domain">
2456 ##      <summary>
2457 ##      Domain allowed access.
2458 ##      </summary>
2459 ## </param>
2460 ## <param name="object_class">
2461 ##      <summary>
2462 ##      The class of the object to be created.
2463 ##      </summary>
2464 ## </param>
2465 #
2466 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2467         gen_require(`
2468                 type user_home_dir_t, user_home_t;
2469         ')
2470
2471         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2472         files_search_home($1)
2473 ')
2474
2475 ########################################
2476 ## <summary>
2477 ##      Write to user temporary named sockets.
2478 ## </summary>
2479 ## <param name="domain">
2480 ##      <summary>
2481 ##      Domain allowed access.
2482 ##      </summary>
2483 ## </param>
2484 #
2485 interface(`userdom_write_user_tmp_sockets',`
2486         gen_require(`
2487                 type user_tmp_t;
2488         ')
2489
2490         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2491         files_search_tmp($1)
2492 ')
2493
2494 ########################################
2495 ## <summary>
2496 ##      List user temporary directories.
2497 ## </summary>
2498 ## <param name="domain">
2499 ##      <summary>
2500 ##      Domain allowed access.
2501 ##      </summary>
2502 ## </param>
2503 #
2504 interface(`userdom_list_user_tmp',`
2505         gen_require(`
2506                 type user_tmp_t;
2507         ')
2508
2509         allow $1 user_tmp_t:dir list_dir_perms;
2510         files_search_tmp($1)
2511 ')
2512
2513 ########################################
2514 ## <summary>
2515 ##      Do not audit attempts to list user
2516 ##      temporary directories.
2517 ## </summary>
2518 ## <param name="domain">
2519 ##      <summary>
2520 ##      Domain to not audit.
2521 ##      </summary>
2522 ## </param>
2523 #
2524 interface(`userdom_dontaudit_list_user_tmp',`
2525         gen_require(`
2526                 type user_tmp_t;
2527         ')
2528
2529         dontaudit $1 user_tmp_t:dir list_dir_perms;
2530 ')
2531
2532 ########################################
2533 ## <summary>
2534 ##      Do not audit attempts to manage users
2535 ##      temporary directories.
2536 ## </summary>
2537 ## <param name="domain">
2538 ##      <summary>
2539 ##      Domain to not audit.
2540 ##      </summary>
2541 ## </param>
2542 #
2543 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2544         gen_require(`
2545                 type user_tmp_t;
2546         ')
2547
2548         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2549 ')
2550
2551 ########################################
2552 ## <summary>
2553 ##      Read user temporary files.
2554 ## </summary>
2555 ## <param name="domain">
2556 ##      <summary>
2557 ##      Domain allowed access.
2558 ##      </summary>
2559 ## </param>
2560 #
2561 interface(`userdom_read_user_tmp_files',`
2562         gen_require(`
2563                 type user_tmp_t;
2564         ')
2565
2566         read_files_pattern($1, user_tmp_t, user_tmp_t)
2567         allow $1 user_tmp_t:dir list_dir_perms;
2568         files_search_tmp($1)
2569 ')
2570
2571 ########################################
2572 ## <summary>
2573 ##      Do not audit attempts to read users
2574 ##      temporary files.
2575 ## </summary>
2576 ## <param name="domain">
2577 ##      <summary>
2578 ##      Domain to not audit.
2579 ##      </summary>
2580 ## </param>
2581 #
2582 interface(`userdom_dontaudit_read_user_tmp_files',`
2583         gen_require(`
2584                 type user_tmp_t;
2585         ')
2586
2587         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2588 ')
2589
2590 ########################################
2591 ## <summary>
2592 ##      Do not audit attempts to append users
2593 ##      temporary files.
2594 ## </summary>
2595 ## <param name="domain">
2596 ##      <summary>
2597 ##      Domain to not audit.
2598 ##      </summary>
2599 ## </param>
2600 #
2601 interface(`userdom_dontaudit_append_user_tmp_files',`
2602         gen_require(`
2603                 type user_tmp_t;
2604         ')
2605
2606         dontaudit $1 user_tmp_t:file append_file_perms;
2607 ')
2608
2609 ########################################
2610 ## <summary>
2611 ##      Read and write user temporary files.
2612 ## </summary>
2613 ## <param name="domain">
2614 ##      <summary>
2615 ##      Domain allowed access.
2616 ##      </summary>
2617 ## </param>
2618 #
2619 interface(`userdom_rw_user_tmp_files',`
2620         gen_require(`
2621                 type user_tmp_t;
2622         ')
2623
2624         allow $1 user_tmp_t:dir list_dir_perms;
2625         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2626         files_search_tmp($1)
2627 ')
2628
2629 ########################################
2630 ## <summary>
2631 ##      Do not audit attempts to manage users
2632 ##      temporary files.
2633 ## </summary>
2634 ## <param name="domain">
2635 ##      <summary>
2636 ##      Domain to not audit.
2637 ##      </summary>
2638 ## </param>
2639 #
2640 interface(`userdom_dontaudit_manage_user_tmp_files',`
2641         gen_require(`
2642                 type user_tmp_t;
2643         ')
2644
2645         dontaudit $1 user_tmp_t:file manage_file_perms;
2646 ')
2647
2648 ########################################
2649 ## <summary>
2650 ##      Read user temporary symbolic links.
2651 ## </summary>
2652 ## <param name="domain">
2653 ##      <summary>
2654 ##      Domain allowed access.
2655 ##      </summary>
2656 ## </param>
2657 #
2658 interface(`userdom_read_user_tmp_symlinks',`
2659         gen_require(`
2660                 type user_tmp_t;
2661         ')
2662
2663         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2664         allow $1 user_tmp_t:dir list_dir_perms;
2665         files_search_tmp($1)
2666 ')
2667
2668 ########################################
2669 ## <summary>
2670 ##      Create, read, write, and delete user
2671 ##      temporary directories.
2672 ## </summary>
2673 ## <param name="domain">
2674 ##      <summary>
2675 ##      Domain allowed access.
2676 ##      </summary>
2677 ## </param>
2678 #
2679 interface(`userdom_manage_user_tmp_dirs',`
2680         gen_require(`
2681                 type user_tmp_t;
2682         ')
2683
2684         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2685         files_search_tmp($1)
2686 ')
2687
2688 ########################################
2689 ## <summary>
2690 ##      Create, read, write, and delete user
2691 ##      temporary files.
2692 ## </summary>
2693 ## <param name="domain">
2694 ##      <summary>
2695 ##      Domain allowed access.
2696 ##      </summary>
2697 ## </param>
2698 #
2699 interface(`userdom_manage_user_tmp_files',`
2700         gen_require(`
2701                 type user_tmp_t;
2702         ')
2703
2704         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2705         files_search_tmp($1)
2706 ')
2707
2708 ########################################
2709 ## <summary>
2710 ##      Create, read, write, and delete user
2711 ##      temporary symbolic links.
2712 ## </summary>
2713 ## <param name="domain">
2714 ##      <summary>
2715 ##      Domain allowed access.
2716 ##      </summary>
2717 ## </param>
2718 #
2719 interface(`userdom_manage_user_tmp_symlinks',`
2720         gen_require(`
2721                 type user_tmp_t;
2722         ')
2723
2724         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2725         files_search_tmp($1)
2726 ')
2727
2728 ########################################
2729 ## <summary>
2730 ##      Create, read, write, and delete user
2731 ##      temporary named pipes.
2732 ## </summary>
2733 ## <param name="domain">
2734 ##      <summary>
2735 ##      Domain allowed access.
2736 ##      </summary>
2737 ## </param>
2738 #
2739 interface(`userdom_manage_user_tmp_pipes',`
2740         gen_require(`
2741                 type user_tmp_t;
2742         ')
2743
2744         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2745         files_search_tmp($1)
2746 ')
2747
2748 ########################################
2749 ## <summary>
2750 ##      Create, read, write, and delete user
2751 ##      temporary named sockets.
2752 ## </summary>
2753 ## <param name="domain">
2754 ##      <summary>
2755 ##      Domain allowed access.
2756 ##      </summary>
2757 ## </param>
2758 #
2759 interface(`userdom_manage_user_tmp_sockets',`
2760         gen_require(`
2761                 type user_tmp_t;
2762         ')
2763
2764         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2765         files_search_tmp($1)
2766 ')
2767
2768 ########################################
2769 ## <summary>
2770 ##      Create objects in a user temporary directory
2771 ##      with an automatic type transition to
2772 ##      a specified private type.
2773 ## </summary>
2774 ## <param name="domain">
2775 ##      <summary>
2776 ##      Domain allowed access.
2777 ##      </summary>
2778 ## </param>
2779 ## <param name="private_type">
2780 ##      <summary>
2781 ##      The type of the object to create.
2782 ##      </summary>
2783 ## </param>
2784 ## <param name="object_class">
2785 ##      <summary>
2786 ##      The class of the object to be created.
2787 ##      </summary>
2788 ## </param>
2789 #
2790 interface(`userdom_user_tmp_filetrans',`
2791         gen_require(`
2792                 type user_tmp_t;
2793         ')
2794
2795         filetrans_pattern($1, user_tmp_t, $2, $3)
2796         files_search_tmp($1)
2797 ')
2798
2799 ########################################
2800 ## <summary>
2801 ##      Create objects in the temporary directory
2802 ##      with an automatic type transition to
2803 ##      the user temporary type.
2804 ## </summary>
2805 ## <param name="domain">
2806 ##      <summary>
2807 ##      Domain allowed access.
2808 ##      </summary>
2809 ## </param>
2810 ## <param name="object_class">
2811 ##      <summary>
2812 ##      The class of the object to be created.
2813 ##      </summary>
2814 ## </param>
2815 #
2816 interface(`userdom_tmp_filetrans_user_tmp',`
2817         gen_require(`
2818                 type user_tmp_t;
2819         ')
2820
2821         files_tmp_filetrans($1, user_tmp_t, $2)
2822 ')
2823
2824 ########################################
2825 ## <summary>
2826 ##      Read user tmpfs files.
2827 ## </summary>
2828 ## <param name="domain">
2829 ##      <summary>
2830 ##      Domain allowed access.
2831 ##      </summary>
2832 ## </param>
2833 #
2834 interface(`userdom_read_user_tmpfs_files',`
2835         gen_require(`
2836                 type user_tmpfs_t;
2837         ')
2838
2839         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2840         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2841         allow $1 user_tmpfs_t:dir list_dir_perms;
2842         fs_search_tmpfs($1)
2843 ')
2844
2845 ########################################
2846 ## <summary>
2847 ##      Read/Write user tmpfs files.
2848 ## </summary>
2849 ## <param name="domain">
2850 ##      <summary>
2851 ##      Domain allowed access.
2852 ##      </summary>
2853 ## </param>
2854 #
2855 interface(`userdom_rw_user_tmpfs_files',`
2856         gen_require(`
2857                 type user_tmpfs_t;
2858         ')
2859
2860         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2861         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2862         allow $1 user_tmpfs_t:dir list_dir_perms;
2863         fs_search_tmpfs($1)
2864 ')
2865
2866 ########################################
2867 ## <summary>
2868 ##      Get the attributes of a user domain tty.
2869 ## </summary>
2870 ## <param name="domain">
2871 ##      <summary>
2872 ##      Domain allowed access.
2873 ##      </summary>
2874 ## </param>
2875 #
2876 interface(`userdom_getattr_user_ttys',`
2877         gen_require(`
2878                 type user_tty_device_t;
2879         ')
2880
2881         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2882 ')
2883
2884 ########################################
2885 ## <summary>
2886 ##      Do not audit attempts to get the attributes of a user domain tty.
2887 ## </summary>
2888 ## <param name="domain">
2889 ##      <summary>
2890 ##      Domain to not audit.
2891 ##      </summary>
2892 ## </param>
2893 #
2894 interface(`userdom_dontaudit_getattr_user_ttys',`
2895         gen_require(`
2896                 type user_tty_device_t;
2897         ')
2898
2899         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
2900 ')
2901
2902 ########################################
2903 ## <summary>
2904 ##      Set the attributes of a user domain tty.
2905 ## </summary>
2906 ## <param name="domain">
2907 ##      <summary>
2908 ##      Domain allowed access.
2909 ##      </summary>
2910 ## </param>
2911 #
2912 interface(`userdom_setattr_user_ttys',`
2913         gen_require(`
2914                 type user_tty_device_t;
2915         ')
2916
2917         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2918 ')
2919
2920 ########################################
2921 ## <summary>
2922 ##      Do not audit attempts to set the attributes of a user domain tty.
2923 ## </summary>
2924 ## <param name="domain">
2925 ##      <summary>
2926 ##      Domain to not audit.
2927 ##      </summary>
2928 ## </param>
2929 #
2930 interface(`userdom_dontaudit_setattr_user_ttys',`
2931         gen_require(`
2932                 type user_tty_device_t;
2933         ')
2934
2935         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
2936 ')
2937
2938 ########################################
2939 ## <summary>
2940 ##      Read and write a user domain tty.
2941 ## </summary>
2942 ## <param name="domain">
2943 ##      <summary>
2944 ##      Domain allowed access.
2945 ##      </summary>
2946 ## </param>
2947 #
2948 interface(`userdom_use_user_ttys',`
2949         gen_require(`
2950                 type user_tty_device_t;
2951         ')
2952
2953         allow $1 user_tty_device_t:chr_file rw_term_perms;
2954 ')
2955
2956 ########################################
2957 ## <summary>
2958 ##      Read and write a inherited user domain tty.
2959 ## </summary>
2960 ## <param name="domain">
2961 ##      <summary>
2962 ##      Domain allowed access.
2963 ##      </summary>
2964 ## </param>
2965 #
2966 interface(`userdom_use_inherited_user_ttys',`
2967         gen_require(`
2968                 type user_tty_device_t;
2969         ')
2970
2971         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
2972 ')
2973
2974 ########################################
2975 ## <summary>
2976 ##      Read and write a user domain pty.
2977 ## </summary>
2978 ## <param name="domain">
2979 ##      <summary>
2980 ##      Domain allowed access.
2981 ##      </summary>
2982 ## </param>
2983 #
2984 interface(`userdom_use_user_ptys',`
2985         gen_require(`
2986                 type user_devpts_t;
2987         ')
2988
2989         allow $1 user_devpts_t:chr_file rw_term_perms;
2990 ')
2991
2992 ########################################
2993 ## <summary>
2994 ##      Read and write a inherited user domain pty.
2995 ## </summary>
2996 ## <param name="domain">
2997 ##      <summary>
2998 ##      Domain allowed access.
2999 ##      </summary>
3000 ## </param>
3001 #
3002 interface(`userdom_use_inherited_user_ptys',`
3003         gen_require(`
3004                 type user_devpts_t;
3005         ')
3006
3007         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3008 ')
3009
3010 ########################################
3011 ## <summary>
3012 ##      Read and write a inherited user TTYs and PTYs.
3013 ## </summary>
3014 ## <desc>
3015 ##      <p>
3016 ##      Allow the specified domain to read and write inherited user
3017 ##      TTYs and PTYs. This will allow the domain to
3018 ##      interact with the user via the terminal. Typically
3019 ##      all interactive applications will require this
3020 ##      access.
3021 ##      </p>
3022 ## </desc>
3023 ## <param name="domain">
3024 ##      <summary>
3025 ##      Domain allowed access.
3026 ##      </summary>
3027 ## </param>
3028 ## <infoflow type="both" weight="10"/>
3029 #
3030 interface(`userdom_use_inherited_user_terminals',`
3031         gen_require(`
3032                 type user_tty_device_t, user_devpts_t;
3033         ')
3034
3035         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3036         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3037 ')
3038
3039 #######################################
3040 ## <summary>
3041 ##  Allow attempts to read and write
3042 ##  a user domain tty and pty.
3043 ## </summary>
3044 ## <param name="domain">
3045 ##  <summary>
3046 ##  Domain to not audit.
3047 ##  </summary>
3048 ## </param>
3049 #
3050 interface(`userdom_use_user_terminals',`
3051     gen_require(`
3052         type user_tty_device_t, user_devpts_t;
3053     ')
3054
3055     allow $1 user_tty_device_t:chr_file rw_term_perms;
3056     allow $1 user_devpts_t:chr_file rw_term_perms;
3057 ')
3058
3059 ########################################
3060 ## <summary>
3061 ##      Do not audit attempts to read and write
3062 ##      a user domain tty and pty.
3063 ## </summary>
3064 ## <param name="domain">
3065 ##      <summary>
3066 ##      Domain to not audit.
3067 ##      </summary>
3068 ## </param>
3069 #
3070 interface(`userdom_dontaudit_use_user_terminals',`
3071         gen_require(`
3072                 type user_tty_device_t, user_devpts_t;
3073         ')
3074
3075         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3076         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3077 ')
3078
3079 ########################################
3080 ## <summary>
3081 ##      Execute a shell in all user domains.  This
3082 ##      is an explicit transition, requiring the
3083 ##      caller to use setexeccon().
3084 ## </summary>
3085 ## <param name="domain">
3086 ##      <summary>
3087 ##      Domain allowed to transition.
3088 ##      </summary>
3089 ## </param>
3090 #
3091 interface(`userdom_spec_domtrans_all_users',`
3092         gen_require(`
3093                 attribute userdomain;
3094         ')
3095
3096         corecmd_shell_spec_domtrans($1, userdomain)
3097         allow userdomain $1:fd use;
3098         allow userdomain $1:fifo_file rw_file_perms;
3099         allow userdomain $1:process sigchld;
3100 ')
3101
3102 ########################################
3103 ## <summary>
3104 ##      Execute an Xserver session in all unprivileged user domains.  This
3105 ##      is an explicit transition, requiring the
3106 ##      caller to use setexeccon().
3107 ## </summary>
3108 ## <param name="domain">
3109 ##      <summary>
3110 ##      Domain allowed to transition.
3111 ##      </summary>
3112 ## </param>
3113 #
3114 interface(`userdom_xsession_spec_domtrans_all_users',`
3115         gen_require(`
3116                 attribute userdomain;
3117         ')
3118
3119         xserver_xsession_spec_domtrans($1, userdomain)
3120         allow userdomain $1:fd use;
3121         allow userdomain $1:fifo_file rw_file_perms;
3122         allow userdomain $1:process sigchld;
3123 ')
3124
3125 ########################################
3126 ## <summary>
3127 ##      Execute a shell in all unprivileged user domains.  This
3128 ##      is an explicit transition, requiring the
3129 ##      caller to use setexeccon().
3130 ## </summary>
3131 ## <param name="domain">
3132 ##      <summary>
3133 ##      Domain allowed to transition.
3134 ##      </summary>
3135 ## </param>
3136 #
3137 interface(`userdom_spec_domtrans_unpriv_users',`
3138         gen_require(`
3139                 attribute unpriv_userdomain;
3140         ')
3141
3142         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3143         allow unpriv_userdomain $1:fd use;
3144         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3145         allow unpriv_userdomain $1:process sigchld;
3146 ')
3147
3148 ########################################
3149 ## <summary>
3150 ##      Execute an Xserver session in all unprivileged user domains.  This
3151 ##      is an explicit transition, requiring the
3152 ##      caller to use setexeccon().
3153 ## </summary>
3154 ## <param name="domain">
3155 ##      <summary>
3156 ##      Domain allowed to transition.
3157 ##      </summary>
3158 ## </param>
3159 #
3160 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3161         gen_require(`
3162                 attribute unpriv_userdomain;
3163         ')
3164
3165         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3166         allow unpriv_userdomain $1:fd use;
3167         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3168         allow unpriv_userdomain $1:process sigchld;
3169 ')
3170
3171 ########################################
3172 ## <summary>
3173 ##      Manage unpriviledged user SysV sempaphores.
3174 ## </summary>
3175 ## <param name="domain">
3176 ##      <summary>
3177 ##      Domain allowed access.
3178 ##      </summary>
3179 ## </param>
3180 #
3181 interface(`userdom_manage_unpriv_user_semaphores',`
3182         gen_require(`
3183                 attribute unpriv_userdomain;
3184         ')
3185
3186         allow $1 unpriv_userdomain:sem create_sem_perms;
3187 ')
3188
3189 ########################################
3190 ## <summary>
3191 ##      Manage unpriviledged user SysV shared
3192 ##      memory segments.
3193 ## </summary>
3194 ## <param name="domain">
3195 ##      <summary>
3196 ##      Domain allowed access.
3197 ##      </summary>
3198 ## </param>
3199 #
3200 interface(`userdom_manage_unpriv_user_shared_mem',`
3201         gen_require(`
3202                 attribute unpriv_userdomain;
3203         ')
3204
3205         allow $1 unpriv_userdomain:shm create_shm_perms;
3206 ')
3207
3208 ########################################
3209 ## <summary>
3210 ##      Execute bin_t in the unprivileged user domains. This
3211 ##      is an explicit transition, requiring the
3212 ##      caller to use setexeccon().
3213 ## </summary>
3214 ## <param name="domain">
3215 ##      <summary>
3216 ##      Domain allowed to transition.
3217 ##      </summary>
3218 ## </param>
3219 #
3220 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3221         gen_require(`
3222                 attribute unpriv_userdomain;
3223         ')
3224
3225         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3226         allow unpriv_userdomain $1:fd use;
3227         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3228         allow unpriv_userdomain $1:process sigchld;
3229 ')
3230
3231 ########################################
3232 ## <summary>
3233 ##      Execute all entrypoint files in unprivileged user
3234 ##      domains. This is an explicit transition, requiring the
3235 ##      caller to use setexeccon().
3236 ## </summary>
3237 ## <param name="domain">
3238 ##      <summary>
3239 ##      Domain allowed access.
3240 ##      </summary>
3241 ## </param>
3242 #
3243 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3244         gen_require(`
3245                 attribute unpriv_userdomain;
3246         ')
3247
3248         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3249         allow unpriv_userdomain $1:fd use;
3250         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3251         allow unpriv_userdomain $1:process sigchld;
3252 ')
3253
3254 ########################################
3255 ## <summary>
3256 ##      Search users home directories.
3257 ## </summary>
3258 ## <param name="domain">
3259 ##      <summary>
3260 ##      Domain allowed access.
3261 ##      </summary>
3262 ## </param>
3263 #
3264 interface(`userdom_search_user_home_content',`
3265         gen_require(`
3266                 type user_home_dir_t;
3267                 attribute user_home_type;
3268         ')
3269
3270         files_list_home($1)
3271         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3272         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3273 ')
3274
3275 ########################################
3276 ## <summary>
3277 ##      Send general signals to unprivileged user domains.
3278 ## </summary>
3279 ## <param name="domain">
3280 ##      <summary>
3281 ##      Domain allowed access.
3282 ##      </summary>
3283 ## </param>
3284 #
3285 interface(`userdom_signal_unpriv_users',`
3286         gen_require(`
3287                 attribute unpriv_userdomain;
3288         ')
3289
3290         allow $1 unpriv_userdomain:process signal;
3291 ')
3292
3293 ########################################
3294 ## <summary>
3295 ##      Inherit the file descriptors from unprivileged user domains.
3296 ## </summary>
3297 ## <param name="domain">
3298 ##      <summary>
3299 ##      Domain allowed access.
3300 ##      </summary>
3301 ## </param>
3302 #
3303 interface(`userdom_use_unpriv_users_fds',`
3304         gen_require(`
3305                 attribute unpriv_userdomain;
3306         ')
3307
3308         allow $1 unpriv_userdomain:fd use;
3309 ')
3310
3311 ########################################
3312 ## <summary>
3313 ##      Do not audit attempts to inherit the file descriptors
3314 ##      from unprivileged user domains.
3315 ## </summary>
3316 ## <desc>
3317 ##      <p>
3318 ##      Do not audit attempts to inherit the file descriptors
3319 ##      from unprivileged user domains. This will supress
3320 ##      SELinux denial messages when the specified domain is denied
3321 ##      the permission to inherit these file descriptors.
3322 ##      </p>
3323 ## </desc>
3324 ## <param name="domain">
3325 ##      <summary>
3326 ##      Domain to not audit.
3327 ##      </summary>
3328 ## </param>
3329 ## <infoflow type="none"/>
3330 #
3331 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3332         gen_require(`
3333                 attribute unpriv_userdomain;
3334         ')
3335
3336         dontaudit $1 unpriv_userdomain:fd use;
3337 ')
3338
3339 ########################################
3340 ## <summary>
3341 ##      Do not audit attempts to use user ptys.
3342 ## </summary>
3343 ## <param name="domain">
3344 ##      <summary>
3345 ##      Domain to not audit.
3346 ##      </summary>
3347 ## </param>
3348 #
3349 interface(`userdom_dontaudit_use_user_ptys',`
3350         gen_require(`
3351                 type user_devpts_t;
3352         ')
3353
3354         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3355 ')
3356
3357 ########################################
3358 ## <summary>
3359 ##      Relabel files to unprivileged user pty types.
3360 ## </summary>
3361 ## <param name="domain">
3362 ##      <summary>
3363 ##      Domain allowed access.
3364 ##      </summary>
3365 ## </param>
3366 #
3367 interface(`userdom_relabelto_user_ptys',`
3368         gen_require(`
3369                 type user_devpts_t;
3370         ')
3371
3372         allow $1 user_devpts_t:chr_file relabelto;
3373 ')
3374
3375 ########################################
3376 ## <summary>
3377 ##      Do not audit attempts to relabel files from
3378 ##      user pty types.
3379 ## </summary>
3380 ## <param name="domain">
3381 ##      <summary>
3382 ##      Domain to not audit.
3383 ##      </summary>
3384 ## </param>
3385 #
3386 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3387         gen_require(`
3388                 type user_devpts_t;
3389         ')
3390
3391         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3392 ')
3393
3394 ########################################
3395 ## <summary>
3396 ##      Write all users files in /tmp
3397 ## </summary>
3398 ## <param name="domain">
3399 ##      <summary>
3400 ##      Domain allowed access.
3401 ##      </summary>
3402 ## </param>
3403 #
3404 interface(`userdom_write_user_tmp_files',`
3405         gen_require(`
3406                 type user_tmp_t;
3407         ')
3408
3409         write_files_pattern($1, user_tmp_t, user_tmp_t)
3410 ')
3411
3412 ########################################
3413 ## <summary>
3414 ##      Do not audit attempts to write users
3415 ##      temporary files.
3416 ## </summary>
3417 ## <param name="domain">
3418 ##      <summary>
3419 ##      Domain to not audit.
3420 ##      </summary>
3421 ## </param>
3422 #
3423 interface(`userdom_dontaudit_write_user_tmp_files',`
3424         gen_require(`
3425                 type user_tmp_t;
3426         ')
3427
3428         dontaudit $1 user_tmp_t:file write;
3429 ')
3430
3431 ########################################
3432 ## <summary>
3433 ##      Do not audit attempts to read/write users
3434 ##      temporary fifo files.
3435 ## </summary>
3436 ## <param name="domain">
3437 ##      <summary>
3438 ##      Domain to not audit.
3439 ##      </summary>
3440 ## </param>
3441 #
3442 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3443         gen_require(`
3444                 type user_tmp_t;
3445         ')
3446
3447         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3448 ')
3449
3450 ########################################
3451 ## <summary>
3452 ##      Do not audit attempts to use user ttys.
3453 ## </summary>
3454 ## <param name="domain">
3455 ##      <summary>
3456 ##      Domain to not audit.
3457 ##      </summary>
3458 ## </param>
3459 #
3460 interface(`userdom_dontaudit_use_user_ttys',`
3461         gen_require(`
3462                 type user_tty_device_t;
3463         ')
3464
3465         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3466 ')
3467
3468 ########################################
3469 ## <summary>
3470 ##      Read the process state of all user domains.
3471 ## </summary>
3472 ## <param name="domain">
3473 ##      <summary>
3474 ##      Domain allowed access.
3475 ##      </summary>
3476 ## </param>
3477 #
3478 interface(`userdom_read_all_users_state',`
3479         gen_require(`
3480                 attribute userdomain;
3481         ')
3482
3483         read_files_pattern($1, userdomain, userdomain)
3484         read_lnk_files_pattern($1,userdomain,userdomain)
3485         kernel_search_proc($1)
3486 ')
3487
3488 ########################################
3489 ## <summary>
3490 ##      Get the attributes of all user domains.
3491 ## </summary>
3492 ## <param name="domain">
3493 ##      <summary>
3494 ##      Domain allowed access.
3495 ##      </summary>
3496 ## </param>
3497 #
3498 interface(`userdom_getattr_all_users',`
3499         gen_require(`
3500                 attribute userdomain;
3501         ')
3502
3503         allow $1 userdomain:process getattr;
3504 ')
3505
3506 ########################################
3507 ## <summary>
3508 ##      Inherit the file descriptors from all user domains
3509 ## </summary>
3510 ## <param name="domain">
3511 ##      <summary>
3512 ##      Domain allowed access.
3513 ##      </summary>
3514 ## </param>
3515 #
3516 interface(`userdom_use_all_users_fds',`
3517         gen_require(`
3518                 attribute userdomain;
3519         ')
3520
3521         allow $1 userdomain:fd use;
3522 ')
3523
3524 ########################################
3525 ## <summary>
3526 ##      Do not audit attempts to inherit the file
3527 ##      descriptors from any user domains.
3528 ## </summary>
3529 ## <param name="domain">
3530 ##      <summary>
3531 ##      Domain to not audit.
3532 ##      </summary>
3533 ## </param>
3534 #
3535 interface(`userdom_dontaudit_use_all_users_fds',`
3536         gen_require(`
3537                 attribute userdomain;
3538         ')
3539
3540         dontaudit $1 userdomain:fd use;
3541 ')
3542
3543 ########################################
3544 ## <summary>
3545 ##      Send general signals to all user domains.
3546 ## </summary>
3547 ## <param name="domain">
3548 ##      <summary>
3549 ##      Domain allowed access.
3550 ##      </summary>
3551 ## </param>
3552 #
3553 interface(`userdom_signal_all_users',`
3554         gen_require(`
3555                 attribute userdomain;
3556         ')
3557
3558         allow $1 userdomain:process signal;
3559 ')
3560
3561 ########################################
3562 ## <summary>
3563 ##      Send kill signals to all user domains.
3564 ## </summary>
3565 ## <param name="domain">
3566 ##      <summary>
3567 ##      Domain allowed access.
3568 ##      </summary>
3569 ## </param>
3570 #
3571 interface(`userdom_kill_all_users',`
3572         gen_require(`
3573                 attribute userdomain;
3574         ')
3575
3576         allow $1 userdomain:process sigkill;
3577 ')
3578
3579 ########################################
3580 ## <summary>
3581 ##      Send a SIGCHLD signal to all user domains.
3582 ## </summary>
3583 ## <param name="domain">
3584 ##      <summary>
3585 ##      Domain allowed access.
3586 ##      </summary>
3587 ## </param>
3588 #
3589 interface(`userdom_sigchld_all_users',`
3590         gen_require(`
3591                 attribute userdomain;
3592         ')
3593
3594         allow $1 userdomain:process sigchld;
3595 ')
3596
3597 ########################################
3598 ## <summary>
3599 ##      Create keys for all user domains.
3600 ## </summary>
3601 ## <param name="domain">
3602 ##      <summary>
3603 ##      Domain allowed access.
3604 ##      </summary>
3605 ## </param>
3606 #
3607 interface(`userdom_create_all_users_keys',`
3608         gen_require(`
3609                 attribute userdomain;
3610         ')
3611
3612         allow $1 userdomain:key create;
3613 ')
3614
3615 ########################################
3616 ## <summary>
3617 ##      Send a dbus message to all user domains.
3618 ## </summary>
3619 ## <param name="domain">
3620 ##      <summary>
3621 ##      Domain allowed access.
3622 ##      </summary>
3623 ## </param>
3624 #
3625 interface(`userdom_dbus_send_all_users',`
3626         gen_require(`
3627                 attribute userdomain;
3628                 class dbus send_msg;
3629         ')
3630
3631         allow $1 userdomain:dbus send_msg;
3632 ')
3633
3634 ########################################
3635 ## <summary>
3636 ##      Allow apps to set rlimits on userdomain
3637 ## </summary>
3638 ## <param name="domain">
3639 ##      <summary>
3640 ##      Domain allowed access.
3641 ##      </summary>
3642 ## </param>
3643 #
3644 interface(`userdom_set_rlimitnh',`
3645         gen_require(`
3646                 attribute userdomain;
3647         ')
3648
3649         allow $1 userdomain:process rlimitinh;
3650 ')
3651
3652 ########################################
3653 ## <summary>
3654 ##      Define this type as a Allow apps to set rlimits on userdomain
3655 ## </summary>
3656 ## <param name="domain">
3657 ##      <summary>
3658 ##      Domain allowed access.
3659 ##      </summary>
3660 ## </param>
3661 ## <param name="userdomain_prefix">
3662 ##      <summary>
3663 ##      The prefix of the user domain (e.g., user
3664 ##      is the prefix for user_t).
3665 ## </summary>
3666 ## </param>
3667 ## <param name="domain">
3668 ##      <summary>
3669 ##      Domain allowed access.
3670 ##      </summary>
3671 ## </param>
3672 #
3673 template(`userdom_unpriv_usertype',`
3674         gen_require(`
3675                 attribute unpriv_userdomain, userdomain;
3676                 attribute $1_usertype;
3677         ')
3678         typeattribute $2  $1_usertype;
3679         typeattribute $2  unpriv_userdomain;
3680         typeattribute $2  userdomain;
3681
3682         ubac_constrained($2)
3683 ')
3684
3685 ########################################
3686 ## <summary>
3687 ##      Connect to users over an unix stream socket.
3688 ## </summary>
3689 ## <param name="domain">
3690 ##      <summary>
3691 ##      Domain allowed access.
3692 ##      </summary>
3693 ## </param>
3694 #
3695 interface(`userdom_stream_connect',`
3696         gen_require(`
3697                 type user_tmp_t;
3698                 attribute userdomain;
3699         ')
3700
3701         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3702 ')
3703
3704 ########################################
3705 ## <summary>
3706 ##      Ptrace user domains.
3707 ## </summary>
3708 ## <param name="domain">
3709 ##      <summary>
3710 ##      Domain allowed access.
3711 ##      </summary>
3712 ## </param>
3713 #
3714 interface(`userdom_ptrace_all_users',`
3715         gen_require(`
3716                 attribute userdomain;
3717         ')
3718
3719         allow $1 userdomain:process ptrace;
3720 ')
3721
3722 ########################################
3723 ## <summary>
3724 ##      dontaudit Search /root
3725 ## </summary>
3726 ## <param name="domain">
3727 ##      <summary>
3728 ##      Domain allowed access.
3729 ##      </summary>
3730 ## </param>
3731 #
3732 interface(`userdom_dontaudit_search_admin_dir',`
3733         gen_require(`
3734                 type admin_home_t;
3735         ')
3736
3737         dontaudit $1 admin_home_t:dir search_dir_perms;
3738 ')
3739
3740 ########################################
3741 ## <summary>
3742 ##      dontaudit list /root
3743 ## </summary>
3744 ## <param name="domain">
3745 ##      <summary>
3746 ##      Domain allowed access.
3747 ##      </summary>
3748 ## </param>
3749 #
3750 interface(`userdom_dontaudit_list_admin_dir',`
3751         gen_require(`
3752                 type admin_home_t;
3753         ')
3754
3755         dontaudit $1 admin_home_t:dir list_dir_perms;
3756 ')
3757
3758 ########################################
3759 ## <summary>
3760 ##      Allow domain to  list /root
3761 ## </summary>
3762 ## <param name="domain">
3763 ##      <summary>
3764 ##      Domain allowed access.
3765 ##      </summary>
3766 ## </param>
3767 #
3768 interface(`userdom_list_admin_dir',`
3769         gen_require(`
3770                 type admin_home_t;
3771         ')
3772
3773         allow $1 admin_home_t:dir list_dir_perms;
3774 ')
3775
3776 ########################################
3777 ## <summary>
3778 ##      Allow Search /root
3779 ## </summary>
3780 ## <param name="domain">
3781 ##      <summary>
3782 ##      Domain allowed access.
3783 ##      </summary>
3784 ## </param>
3785 #
3786 interface(`userdom_search_admin_dir',`
3787         gen_require(`
3788                 type admin_home_t;
3789         ')
3790
3791         allow $1 admin_home_t:dir search_dir_perms;
3792 ')
3793
3794 ########################################
3795 ## <summary>
3796 ##      RW unpriviledged user SysV sempaphores.
3797 ## </summary>
3798 ## <param name="domain">
3799 ##      <summary>
3800 ##      Domain allowed access.
3801 ##      </summary>
3802 ## </param>
3803 #
3804 interface(`userdom_rw_semaphores',`
3805         gen_require(`
3806                 attribute unpriv_userdomain;
3807         ')
3808
3809         allow $1 unpriv_userdomain:sem rw_sem_perms;
3810 ')
3811
3812 ########################################
3813 ## <summary>
3814 ##      Send a message to unpriv users over a unix domain
3815 ##      datagram socket.
3816 ## </summary>
3817 ## <param name="domain">
3818 ##      <summary>
3819 ##      Domain allowed access.
3820 ##      </summary>
3821 ## </param>
3822 #
3823 interface(`userdom_dgram_send',`
3824         gen_require(`
3825                 attribute unpriv_userdomain;
3826         ')
3827
3828         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
3829 ')
3830
3831 ######################################
3832 ## <summary>
3833 ##      Send a message to users over a unix domain
3834 ##      datagram socket.
3835 ## </summary>
3836 ## <param name="domain">
3837 ##      <summary>
3838 ##      Domain allowed access.
3839 ##      </summary>
3840 ## </param>
3841 #
3842 interface(`userdom_users_dgram_send',`
3843         gen_require(`
3844                  attribute userdomain;
3845       ')
3846
3847        allow $1 userdomain:unix_dgram_socket sendto;
3848 ')
3849
3850 #######################################
3851 ## <summary>
3852 ##      Allow execmod on files in homedirectory
3853 ## </summary>
3854 ## <param name="domain">
3855 ##      <summary>
3856 ##      Domain allowed access.
3857 ##      </summary>
3858 ## </param>
3859 ## <rolebase/>
3860 #
3861 interface(`userdom_execmod_user_home_files',`
3862         gen_require(`
3863                 type user_home_type;
3864         ')
3865
3866         allow $1 user_home_type:file execmod;
3867 ')
3868
3869 ########################################
3870 ## <summary>
3871 ##      Read admin home files.
3872 ## </summary>
3873 ## <param name="domain">
3874 ##      <summary>
3875 ##      Domain allowed access.
3876 ##      </summary>
3877 ## </param>
3878 ## <rolecap/>
3879 #
3880 interface(`userdom_read_admin_home_files',`
3881         gen_require(`
3882                 type admin_home_t;
3883         ')
3884
3885         read_files_pattern($1, admin_home_t, admin_home_t)
3886 ')
3887
3888 ########################################
3889 ## <summary>
3890 ##      Execute admin home files.
3891 ## </summary>
3892 ## <param name="domain">
3893 ##      <summary>
3894 ##      Domain allowed access.
3895 ##      </summary>
3896 ## </param>
3897 ## <rolecap/>
3898 #
3899 interface(`userdom_exec_admin_home_files',`
3900         gen_require(`
3901                 type admin_home_t;
3902         ')
3903
3904         exec_files_pattern($1, admin_home_t, admin_home_t)
3905 ')
3906
3907 ########################################
3908 ## <summary>
3909 ##      Append files inherited
3910 ##      in the /root directory.
3911 ## </summary>
3912 ## <param name="domain">
3913 ##      <summary>
3914 ##      Domain allowed access.
3915 ##      </summary>
3916 ## </param>
3917 #
3918 interface(`userdom_inherit_append_admin_home_files',`
3919         gen_require(`
3920                 type admin_home_t;
3921         ')
3922
3923         allow $1 admin_home_t:file { getattr append };
3924 ')
3925
3926
3927 #######################################
3928 ## <summary>
3929 ##      Manage all files/directories in the homedir
3930 ## </summary>
3931 ## <param name="userdomain">
3932 ##      <summary>
3933 ##      The user domain
3934 ##      </summary>
3935 ## </param>
3936 ## <rolebase/>
3937 #
3938 interface(`userdom_manage_user_home_content',`
3939         gen_require(`
3940                 type user_home_dir_t, user_home_t;
3941                 attribute user_home_type;
3942         ')
3943
3944         files_list_home($1)
3945         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3946         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3947         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3948         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3949         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
3950         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
3951
3952 ')
3953
3954
3955 ########################################
3956 ## <summary>
3957 ##      Create objects in a user home directory
3958 ##      with an automatic type transition to
3959 ##      the user home file type.
3960 ## </summary>
3961 ## <param name="domain">
3962 ##      <summary>
3963 ##      Domain allowed access.
3964 ##      </summary>
3965 ## </param>
3966 ## <param name="object_class">
3967 ##      <summary>
3968 ##      The class of the object to be created.
3969 ##      </summary>
3970 ## </param>
3971 #
3972 interface(`userdom_user_home_dir_filetrans_pattern',`
3973         gen_require(`
3974                 type user_home_dir_t, user_home_t;
3975         ')
3976
3977         type_transition $1 user_home_dir_t:$2 user_home_t;
3978 ')
3979
3980 ########################################
3981 ## <summary>
3982 ##      Create objects in the /root directory
3983 ##      with an automatic type transition to
3984 ##      a specified private type.
3985 ## </summary>
3986 ## <param name="domain">
3987 ##      <summary>
3988 ##      Domain allowed access.
3989 ##      </summary>
3990 ## </param>
3991 ## <param name="private_type">
3992 ##      <summary>
3993 ##      The type of the object to create.
3994 ##      </summary>
3995 ## </param>
3996 ## <param name="object_class">
3997 ##      <summary>
3998 ##      The class of the object to be created.
3999 ##      </summary>
4000 ## </param>
4001 #
4002 interface(`userdom_admin_home_dir_filetrans',`
4003         gen_require(`
4004                 type admin_home_t;
4005         ')
4006
4007         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4008 ')
4009
4010 ########################################
4011 ## <summary>
4012 ##      Send signull to unprivileged user domains.
4013 ## </summary>
4014 ## <param name="domain">
4015 ##      <summary>
4016 ##      Domain allowed access.
4017 ##      </summary>
4018 ## </param>
4019 #
4020 interface(`userdom_signull_unpriv_users',`
4021         gen_require(`
4022                 attribute unpriv_userdomain;
4023         ')
4024
4025         allow $1 unpriv_userdomain:process signull;
4026 ')
4027
4028 ########################################
4029 ## <summary>
4030 ##      Write all users files in /tmp
4031 ## </summary>
4032 ## <param name="domain">
4033 ##      <summary>
4034 ##      Domain allowed access.
4035 ##      </summary>
4036 ## </param>
4037 #
4038 interface(`userdom_write_user_tmp_dirs',`
4039         gen_require(`
4040                 type user_tmp_t;
4041         ')
4042
4043         write_files_pattern($1, user_tmp_t, user_tmp_t)
4044 ')
4045
4046 ########################################
4047 ## <summary>
4048 ##      Manage keys for all user domains.
4049 ## </summary>
4050 ## <param name="domain">
4051 ##      <summary>
4052 ##      Domain allowed access.
4053 ##      </summary>
4054 ## </param>
4055 #
4056 interface(`userdom_manage_all_users_keys',`
4057         gen_require(`
4058                 attribute userdomain;
4059         ')
4060
4061         allow $1 userdomain:key manage_key_perms;
4062 ')
4063
4064
4065 ########################################
4066 ## <summary>
4067 ##      Do not audit attempts to read and write
4068 ##      unserdomain stream.
4069 ## </summary>
4070 ## <param name="domain">
4071 ##      <summary>
4072 ##      Domain to not audit.
4073 ##      </summary>
4074 ## </param>
4075 #
4076 interface(`userdom_dontaudit_rw_stream',`
4077         gen_require(`
4078                 attribute userdomain;
4079         ')
4080
4081         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4082 ')
4083
4084 ########################################
4085 ## <summary>
4086 ##      Do not audit attempts to read and write
4087 ##      unserdomain datagram socket.
4088 ## </summary>
4089 ## <param name="domain">
4090 ##      <summary>
4091 ##      Domain to not audit.
4092 ##      </summary>
4093 ## </param>
4094 #
4095 interface(`userdom_dontaudit_rw_dgram_socket',`
4096         gen_require(`
4097                 attribute userdomain;
4098         ')
4099
4100         dontaudit $1 userdomain:unix_dgram_socket { read write };
4101 ')
4102
4103 ########################################
4104 ## <summary>
4105 ##      Append files
4106 ##      in a user home subdirectory.
4107 ## </summary>
4108 ## <param name="domain">
4109 ##      <summary>
4110 ##      Domain allowed access.
4111 ##      </summary>
4112 ## </param>
4113 #
4114 interface(`userdom_append_user_home_content_files',`
4115         gen_require(`
4116                 type user_home_dir_t, user_home_t;
4117         ')
4118
4119         append_files_pattern($1, user_home_t, user_home_t)
4120         allow $1 user_home_dir_t:dir search_dir_perms;
4121         files_search_home($1)
4122 ')
4123
4124 ########################################
4125 ## <summary>
4126 ##      Read files inherited
4127 ##      in a user home subdirectory.
4128 ## </summary>
4129 ## <param name="domain">
4130 ##      <summary>
4131 ##      Domain allowed access.
4132 ##      </summary>
4133 ## </param>
4134 #
4135 interface(`userdom_read_inherited_user_home_content_files',`
4136         gen_require(`
4137                 attribute user_home_type;
4138         ')
4139
4140         allow $1 user_home_type:file { getattr read };
4141 ')
4142
4143 ########################################
4144 ## <summary>
4145 ##      Append files inherited
4146 ##      in a user home subdirectory.
4147 ## </summary>
4148 ## <param name="domain">
4149 ##      <summary>
4150 ##      Domain allowed access.
4151 ##      </summary>
4152 ## </param>
4153 #
4154 interface(`userdom_inherit_append_user_home_content_files',`
4155         gen_require(`
4156                 type user_home_t;
4157         ')
4158
4159         allow $1 user_home_t:file { getattr append };
4160 ')
4161
4162 ########################################
4163 ## <summary>
4164 ##      Append files inherited
4165 ##      in a user tmp files.
4166 ## </summary>
4167 ## <param name="domain">
4168 ##      <summary>
4169 ##      Domain allowed access.
4170 ##      </summary>
4171 ## </param>
4172 #
4173 interface(`userdom_inherit_append_user_tmp_files',`
4174         gen_require(`
4175                 type user_tmp_t;
4176         ')
4177
4178         allow $1 user_tmp_t:file { getattr append };
4179 ')
4180
4181 ######################################
4182 ## <summary>
4183 ##      Read audio files in the users homedir.
4184 ## </summary>
4185 ## <param name="domain">
4186 ##      <summary>
4187 ##      Domain allowed access.
4188 ##      </summary>
4189 ## </param>
4190 ## <rolecap/>
4191 #
4192 interface(`userdom_read_home_audio_files',`
4193         gen_require(`
4194                 type audio_home_t;
4195         ')
4196
4197         userdom_search_user_home_dirs($1)
4198         allow $1 audio_home_t:dir list_dir_perms;
4199         read_files_pattern($1, audio_home_t, audio_home_t)
4200         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4201 ')
4202
4203 ########################################
4204 ## <summary>
4205 ##      Do not audit attempts to write all user home content files.
4206 ## </summary>
4207 ## <param name="domain">
4208 ##      <summary>
4209 ##      Domain to not audit.
4210 ##      </summary>
4211 ## </param>
4212 #
4213 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4214         gen_require(`
4215                 attribute user_home_type;
4216         ')
4217
4218         dontaudit $1 user_home_type:file write_file_perms;
4219 ')
4220
4221 ########################################
4222 ## <summary>
4223 ##      Do not audit attempts to write all user tmp content files.
4224 ## </summary>
4225 ## <param name="domain">
4226 ##      <summary>
4227 ##      Domain to not audit.
4228 ##      </summary>
4229 ## </param>
4230 #
4231 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4232         gen_require(`
4233                 attribute user_tmp_type;
4234         ')
4235
4236         dontaudit $1 user_tmp_type:file write_file_perms;
4237 ')
4238
4239 ########################################
4240 ## <summary>
4241 ##      Manage all user temporary content.
4242 ## </summary>
4243 ## <param name="domain">
4244 ##      <summary>
4245 ##      Domain allowed access.
4246 ##      </summary>
4247 ## </param>
4248 #
4249 interface(`userdom_manage_all_user_tmp_content',`
4250         gen_require(`
4251                 attribute user_tmp_type;
4252         ')
4253
4254         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4255         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4256         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4257         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4258         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4259         files_search_tmp($1)
4260 ')
4261
4262 ########################################
4263 ## <summary>
4264 ##      List all user temporary content.
4265 ## </summary>
4266 ## <param name="domain">
4267 ##      <summary>
4268 ##      Domain allowed access.
4269 ##      </summary>
4270 ## </param>
4271 #
4272 interface(`userdom_list_all_user_tmp_content',`
4273         gen_require(`
4274                 attribute user_tmp_type;
4275         ')
4276
4277         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4278         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4279         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4280         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4281         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4282         files_search_var($1)
4283         files_search_tmp($1)
4284 ')
4285
4286 ########################################
4287 ## <summary>
4288 ##      Manage all user tmpfs content.
4289 ## </summary>
4290 ## <param name="domain">
4291 ##      <summary>
4292 ##      Domain allowed access.
4293 ##      </summary>
4294 ## </param>
4295 #
4296 interface(`userdom_manage_all_user_tmpfs_content',`
4297         gen_require(`
4298                 attribute user_tmpfs_type;
4299         ')
4300
4301         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4302         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4303         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4304         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4305         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4306         fs_search_tmpfs($1)
4307 ')
4308
4309 ########################################
4310 ## <summary>
4311 ##      Delete all user temporary content.
4312 ## </summary>
4313 ## <param name="domain">
4314 ##      <summary>
4315 ##      Domain allowed access.
4316 ##      </summary>
4317 ## </param>
4318 #
4319 interface(`userdom_delete_all_user_tmp_content',`
4320         gen_require(`
4321                 attribute user_tmp_type;
4322         ')
4323
4324         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4325         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4326         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4327         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4328         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4329         # /var/tmp
4330         files_search_var($1)
4331         files_delete_tmp_dir_entry($1)
4332 ')
4333
4334 ########################################
4335 ## <summary>
4336 ##      Read system SSL certificates in the users homedir.
4337 ## </summary>
4338 ## <param name="domain">
4339 ##      <summary>
4340 ##      Domain allowed access.
4341 ##      </summary>
4342 ## </param>
4343 #
4344 interface(`userdom_read_home_certs',`
4345         gen_require(`
4346                 type home_cert_t;
4347         ')
4348
4349         userdom_search_user_home_content($1)
4350         allow $1 home_cert_t:dir list_dir_perms;
4351         read_files_pattern($1, home_cert_t, home_cert_t)
4352         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4353 ')
4354
4355 #######################################
4356 ## <summary>
4357 ##  Dontaudit Write system SSL certificates in the users homedir.
4358 ## </summary>
4359 ## <param name="domain">
4360 ##  <summary>
4361 ##  Domain allowed access.
4362 ##  </summary>
4363 ## </param>
4364 #
4365 interface(`userdom_dontaudit_write_home_certs',`
4366     gen_require(`
4367         type home_cert_t;
4368     ')
4369
4370     dontaudit $1 home_cert_t:file write;
4371 ')
4372
4373 ########################################
4374 ## <summary>
4375 ##      dontaudit Search getatrr /root files
4376 ## </summary>
4377 ## <param name="domain">
4378 ##      <summary>
4379 ##      Domain allowed access.
4380 ##      </summary>
4381 ## </param>
4382 #
4383 interface(`userdom_dontaudit_getattr_admin_home_files',`
4384         gen_require(`
4385                 type admin_home_t;
4386         ')
4387
4388         dontaudit $1 admin_home_t:file getattr;
4389 ')
4390
4391 ########################################
4392 ## <summary>
4393 ##      dontaudit read /root lnk files
4394 ## </summary>
4395 ## <param name="domain">
4396 ##      <summary>
4397 ##      Domain allowed access.
4398 ##      </summary>
4399 ## </param>
4400 #
4401 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4402         gen_require(`
4403                 type admin_home_t;
4404         ')
4405
4406         dontaudit $1 admin_home_t:lnk_file read;
4407 ')
4408
4409 ########################################
4410 ## <summary>
4411 ##      dontaudit read /root files
4412 ## </summary>
4413 ## <param name="domain">
4414 ##      <summary>
4415 ##      Domain allowed access.
4416 ##      </summary>
4417 ## </param>
4418 #
4419 interface(`userdom_dontaudit_read_admin_home_files',`
4420         gen_require(`
4421                 type admin_home_t;
4422         ')
4423
4424         dontaudit $1 admin_home_t:file read_file_perms;
4425 ')
4426
4427 ########################################
4428 ## <summary>
4429 ##      Create, read, write, and delete user
4430 ##      temporary chr files.
4431 ## </summary>
4432 ## <param name="domain">
4433 ##      <summary>
4434 ##      Domain allowed access.
4435 ##      </summary>
4436 ## </param>
4437 #
4438 interface(`userdom_manage_user_tmp_chr_files',`
4439         gen_require(`
4440                 type user_tmp_t;
4441         ')
4442
4443         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4444         files_search_tmp($1)
4445 ')
4446
4447 ########################################
4448 ## <summary>
4449 ##      Create, read, write, and delete user
4450 ##      temporary blk files.
4451 ## </summary>
4452 ## <param name="domain">
4453 ##      <summary>
4454 ##      Domain allowed access.
4455 ##      </summary>
4456 ## </param>
4457 #
4458 interface(`userdom_manage_user_tmp_blk_files',`
4459         gen_require(`
4460                 type user_tmp_t;
4461         ')
4462
4463         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4464         files_search_tmp($1)
4465 ')
4466
4467 ########################################
4468 ## <summary>
4469 ##      Dontaudit attempt to set attributes on  user temporary directories.
4470 ## </summary>
4471 ## <param name="domain">
4472 ##      <summary>
4473 ##      Domain allowed access.
4474 ##      </summary>
4475 ## </param>
4476 #
4477 interface(`userdom_dontaudit_setattr_user_tmp',`
4478         gen_require(`
4479                 type user_tmp_t;
4480         ')
4481
4482         dontaudit $1 user_tmp_t:dir setattr;
4483 ')
4484
4485 ########################################
4486 ## <summary>
4487 ##      Write all inherited users files in /tmp
4488 ## </summary>
4489 ## <param name="domain">
4490 ##      <summary>
4491 ##      Domain allowed access.
4492 ##      </summary>
4493 ## </param>
4494 #
4495 interface(`userdom_write_inherited_user_tmp_files',`
4496         gen_require(`
4497                 type user_tmp_t;
4498         ')
4499
4500         allow $1 user_tmp_t:file write;
4501 ')
4502
4503 ########################################
4504 ## <summary>
4505 ##      Delete all users files in /tmp
4506 ## </summary>
4507 ## <param name="domain">
4508 ##      <summary>
4509 ##      Domain allowed access.
4510 ##      </summary>
4511 ## </param>
4512 #
4513 interface(`userdom_delete_user_tmp_files',`
4514         gen_require(`
4515                 type user_tmp_t;
4516         ')
4517
4518         allow $1 user_tmp_t:file delete_file_perms;
4519 ')
4520
4521 ########################################
4522 ## <summary>
4523 ##      Delete user tmpfs files.
4524 ## </summary>
4525 ## <param name="domain">
4526 ##      <summary>
4527 ##      Domain allowed access.
4528 ##      </summary>
4529 ## </param>
4530 #
4531 interface(`userdom_delete_user_tmpfs_files',`
4532         gen_require(`
4533                 type user_tmpfs_t;
4534         ')
4535
4536         allow $1 user_tmpfs_t:file delete_file_perms;
4537 ')
4538
4539 ########################################
4540 ## <summary>
4541 ##      Read/Write unpriviledged user SysV shared
4542 ##      memory segments.
4543 ## </summary>
4544 ## <param name="domain">
4545 ##      <summary>
4546 ##      Domain allowed access.
4547 ##      </summary>
4548 ## </param>
4549 #
4550 interface(`userdom_rw_unpriv_user_shared_mem',`
4551         gen_require(`
4552                 attribute unpriv_userdomain;
4553         ')
4554
4555         allow $1 unpriv_userdomain:shm rw_shm_perms;
4556 ')
4557
4558 ########################################
4559 ## <summary>
4560 ##      Do not audit attempts to search user
4561 ##      temporary directories.
4562 ## </summary>
4563 ## <param name="domain">
4564 ##      <summary>
4565 ##      Domain to not audit.
4566 ##      </summary>
4567 ## </param>
4568 #
4569 interface(`userdom_dontaudit_search_user_tmp',`
4570         gen_require(`
4571                 type user_tmp_t;
4572         ')
4573
4574         dontaudit $1 user_tmp_t:dir search_dir_perms;
4575 ')
4576
4577 ########################################
4578 ## <summary>
4579 ##      Execute a file in a user home directory
4580 ##      in the specified domain.
4581 ## </summary>
4582 ## <desc>
4583 ##      <p>
4584 ##      Execute a file in a user home directory
4585 ##      in the specified domain.
4586 ##      </p>
4587 ##      <p>
4588 ##      No interprocess communication (signals, pipes,
4589 ##      etc.) is provided by this interface since
4590 ##      the domains are not owned by this module.
4591 ##      </p>
4592 ## </desc>
4593 ## <param name="domain">
4594 ##      <summary>
4595 ##      Domain allowed access.
4596 ##      </summary>
4597 ## </param>
4598 ## <param name="target_domain">
4599 ##      <summary>
4600 ##      The type of the new process.
4601 ##      </summary>
4602 ## </param>
4603 #
4604 interface(`userdom_domtrans_user_home',`
4605         gen_require(`
4606                 type user_home_t;
4607         ')
4608
4609         read_lnk_files_pattern($1, user_home_t, user_home_t)
4610         domain_transition_pattern($1, user_home_t, $2)
4611         type_transition $1 user_home_t:process $2;
4612 ')
4613
4614 ########################################
4615 ## <summary>
4616 ##      Execute a file in a user tmp directory
4617 ##      in the specified domain.
4618 ## </summary>
4619 ## <desc>
4620 ##      <p>
4621 ##      Execute a file in a user tmp directory
4622 ##      in the specified domain.
4623 ##      </p>
4624 ##      <p>
4625 ##      No interprocess communication (signals, pipes,
4626 ##      etc.) is provided by this interface since
4627 ##      the domains are not owned by this module.
4628 ##      </p>
4629 ## </desc>
4630 ## <param name="domain">
4631 ##      <summary>
4632 ##      Domain allowed access.
4633 ##      </summary>
4634 ## </param>
4635 ## <param name="target_domain">
4636 ##      <summary>
4637 ##      The type of the new process.
4638 ##      </summary>
4639 ## </param>
4640 #
4641 interface(`userdom_domtrans_user_tmp',`
4642         gen_require(`
4643                 type user_tmp_t;
4644         ')
4645
4646         files_search_tmp($1)
4647         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4648         domain_transition_pattern($1, user_tmp_t, $2)
4649         type_transition $1 user_tmp_t:process $2;
4650 ')
4651
4652 ########################################
4653 ## <summary>
4654 ##      Do not audit attempts to read all user home content files.
4655 ## </summary>
4656 ## <param name="domain">
4657 ##      <summary>
4658 ##      Domain to not audit.
4659 ##      </summary>
4660 ## </param>
4661 #
4662 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4663         gen_require(`
4664                 attribute user_home_type;
4665         ')
4666
4667         dontaudit $1 user_home_type:file read_file_perms;
4668 ')
4669
4670 ########################################
4671 ## <summary>
4672 ##      Do not audit attempts to read all user tmp content files.
4673 ## </summary>
4674 ## <param name="domain">
4675 ##      <summary>
4676 ##      Domain to not audit.
4677 ##      </summary>
4678 ## </param>
4679 #
4680 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4681         gen_require(`
4682                 attribute user_tmp_type;
4683         ')
4684
4685         dontaudit $1 user_tmp_type:file read_file_perms;
4686 ')
4687