policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         role $1_r;
  38         corecmd_shell_entry_type($1_t)
  39         corecmd_bin_entry_type($1_t)
  40         domain_user_exemption_target($1_t)
  41         ubac_constrained($1_t)
  42         role $1_r types $1_t;
  43         allow system_r $1_r;
  44
  45         term_user_pty($1_t, user_devpts_t)
  46
  47         term_user_tty($1_t, user_tty_device_t)
  48         term_dontaudit_getattr_generic_ptys($1_t)
  49
  50         allow $1_usertype $1_usertype:process { signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  51         tunable_policy(`deny_ptrace',`',`
  52                 allow $1_usertype $1_usertype:process ptrace;
  53         ')
  54         allow $1_usertype $1_usertype:fd use;
  55         allow $1_usertype $1_t:key { create view read write search link setattr };
  56
  57         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  58         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  59         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  60         allow $1_usertype $1_usertype:shm create_shm_perms;
  61         allow $1_usertype $1_usertype:sem create_sem_perms;
  62         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  63         allow $1_usertype $1_usertype:msg { send receive };
  64         allow $1_usertype $1_usertype:context contains;
  65         dontaudit $1_usertype $1_usertype:socket create;
  66
  67         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  68         term_create_pty($1_usertype, user_devpts_t)
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  71
  72         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  73         # avoid annoying messages on terminal hangup on role change
  74         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  75
  76         application_exec_all($1_usertype)
  77
  78         kernel_read_kernel_sysctls($1_usertype)
  79         kernel_read_all_sysctls($1_usertype)
  80         kernel_dontaudit_list_unlabeled($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  83         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  84         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  85         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  86         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  87         kernel_dontaudit_list_proc($1_usertype)
  88
  89         dev_dontaudit_getattr_all_blk_files($1_usertype)
  90         dev_dontaudit_getattr_all_chr_files($1_usertype)
  91         dev_getattr_mtrr_dev($1_t)
  92
  93         # When the user domain runs ps, there will be a number of access
  94         # denials when ps tries to search /proc. Do not audit these denials.
  95         domain_dontaudit_read_all_domains_state($1_usertype)
  96         domain_dontaudit_getattr_all_domains($1_usertype)
  97         domain_dontaudit_getsession_all_domains($1_usertype)
  98         dev_dontaudit_all_access_check($1_usertype)
  99
 100         files_read_etc_files($1_usertype)
 101         files_list_mnt($1_usertype)
 102         files_list_var($1_usertype)
 103         files_read_mnt_files($1_usertype)
 104         files_dontaudit_access_check_mnt($1_usertype)
 105         files_read_etc_runtime_files($1_usertype)
 106         files_read_usr_files($1_usertype)
 107         files_read_usr_src_files($1_usertype)
 108         # Read directories and files with the readable_t type.
 109         # This type is a general type for "world"-readable files.
 110         files_list_world_readable($1_usertype)
 111         files_read_world_readable_files($1_usertype)
 112         files_read_world_readable_symlinks($1_usertype)
 113         files_read_world_readable_pipes($1_usertype)
 114         files_read_world_readable_sockets($1_usertype)
 115         # old broswer_domain():
 116         files_dontaudit_getattr_all_dirs($1_usertype)
 117         files_dontaudit_list_non_security($1_usertype)
 118         files_dontaudit_getattr_all_files($1_usertype)
 119         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 120         files_dontaudit_getattr_non_security_pipes($1_usertype)
 121         files_dontaudit_getattr_non_security_sockets($1_usertype)
 122         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 123
 124         files_exec_usr_files($1_t)
 125
 126         fs_list_cgroup_dirs($1_usertype)
 127         fs_dontaudit_rw_cgroup_files($1_usertype)
 128
 129         storage_rw_fuse($1_usertype)
 130
 131         auth_use_nsswitch($1_t)
 132
 133         init_stream_connect($1_usertype)
 134         # The library functions always try to open read-write first,
 135         # then fall back to read-only if it fails.
 136         init_dontaudit_rw_utmp($1_usertype)
 137
 138         libs_exec_ld_so($1_usertype)
 139
 140         logging_send_audit_msgs($1_t)
 141
 142         miscfiles_read_localization($1_t)
 143         miscfiles_read_generic_certs($1_t)
 144
 145         miscfiles_read_all_certs($1_usertype)
 146         miscfiles_read_localization($1_usertype)
 147         miscfiles_read_man_pages($1_usertype)
 148         miscfiles_read_public_files($1_usertype)
 149
 150         systemd_dbus_chat_logind($1_usertype)
 151
 152         tunable_policy(`deny_execmem',`', `
 153                 # Allow loading DSOs that require executable stack.
 154                 allow $1_t self:process execmem;
 155         ')
 156
 157         tunable_policy(`allow_execstack',`
 158                 # Allow making the stack executable via mprotect.
 159                 allow $1_t self:process execstack;
 160         ')
 161
 162         optional_policy(`
 163                 abrt_stream_connect($1_usertype)
 164         ')
 165
 166         optional_policy(`
 167                 fs_list_cgroup_dirs($1_usertype)
 168         ')
 169
 170         optional_policy(`
 171                 ssh_rw_stream_sockets($1_usertype)
 172                 ssh_delete_tmp($1_t)
 173                 ssh_signal($1_t)
 174         ')
 175 ')
 176
 177 #######################################
 178 ## <summary>
 179 ##      Allow a home directory for which the
 180 ##      role has read-only access.
 181 ## </summary>
 182 ## <desc>
 183 ##      <p>
 184 ##      Allow a home directory for which the
 185 ##      role has read-only access.
 186 ##      </p>
 187 ##      <p>
 188 ##      This does not allow execute access.
 189 ##      </p>
 190 ## </desc>
 191 ## <param name="role">
 192 ##      <summary>
 193 ##      The user role
 194 ##      </summary>
 195 ## </param>
 196 ## <param name="userdomain">
 197 ##      <summary>
 198 ##      The user domain
 199 ##      </summary>
 200 ## </param>
 201 ## <rolebase/>
 202 #
 203 interface(`userdom_ro_home_role',`
 204         gen_require(`
 205                 type user_home_t, user_home_dir_t;
 206         ')
 207
 208         role $1 types { user_home_t user_home_dir_t };
 209
 210         ##############################
 211         #
 212         # Domain access to home dir
 213         #
 214
 215         type_member $2 user_home_dir_t:dir user_home_dir_t;
 216
 217         # read-only home directory
 218         allow $2 user_home_dir_t:dir list_dir_perms;
 219         allow $2 user_home_t:dir list_dir_perms;
 220         allow $2 user_home_t:file entrypoint;
 221         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 222         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 223         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 224         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 225         files_list_home($2)
 226
 227 ')
 228
 229 #######################################
 230 ## <summary>
 231 ##      Allow a home directory for which the
 232 ##      role has full access.
 233 ## </summary>
 234 ## <desc>
 235 ##      <p>
 236 ##      Allow a home directory for which the
 237 ##      role has full access.
 238 ##      </p>
 239 ##      <p>
 240 ##      This does not allow execute access.
 241 ##      </p>
 242 ## </desc>
 243 ## <param name="role">
 244 ##      <summary>
 245 ##      The user role
 246 ##      </summary>
 247 ## </param>
 248 ## <param name="userdomain">
 249 ##      <summary>
 250 ##      The user domain
 251 ##      </summary>
 252 ## </param>
 253 ## <rolebase/>
 254 #
 255 interface(`userdom_manage_home_role',`
 256         gen_require(`
 257                 type user_home_t, user_home_dir_t;
 258                 attribute user_home_type;
 259         ')
 260
 261         role $1 types { user_home_type user_home_dir_t };
 262
 263         ##############################
 264         #
 265         # Domain access to home dir
 266         #
 267
 268         type_member $2 user_home_dir_t:dir user_home_dir_t;
 269
 270         # full control of the home directory
 271         allow $2 user_home_t:dir mounton;
 272         allow $2 user_home_t:file entrypoint;
 273
 274         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 275         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 276         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 280         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 281         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 282         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 283         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 284         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 285         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 286         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 287         userdom_filetrans_home_content($2)
 288
 289         files_list_home($2)
 290
 291         # cjp: this should probably be removed:
 292         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 293
 294         tunable_policy(`use_nfs_home_dirs',`
 295                 fs_mount_nfs($2)
 296                 fs_mounton_nfs($2)
 297                 fs_manage_nfs_dirs($2)
 298                 fs_manage_nfs_files($2)
 299                 fs_manage_nfs_symlinks($2)
 300                 fs_manage_nfs_named_sockets($2)
 301                 fs_manage_nfs_named_pipes($2)
 302         ')
 303
 304         tunable_policy(`use_samba_home_dirs',`
 305                 fs_mount_cifs($2)
 306                 fs_mounton_cifs($2)
 307                 fs_manage_cifs_dirs($2)
 308                 fs_manage_cifs_files($2)
 309                 fs_manage_cifs_symlinks($2)
 310                 fs_manage_cifs_named_sockets($2)
 311                 fs_manage_cifs_named_pipes($2)
 312         ')
 313 ')
 314
 315 #######################################
 316 ## <summary>
 317 ##      Manage user temporary files
 318 ## </summary>
 319 ## <param name="role">
 320 ##      <summary>
 321 ##      Role allowed access.
 322 ##      </summary>
 323 ## </param>
 324 ## <param name="domain">
 325 ##      <summary>
 326 ##      Domain allowed access.
 327 ##      </summary>
 328 ## </param>
 329 ## <rolebase/>
 330 #
 331 interface(`userdom_manage_tmp_role',`
 332         gen_require(`
 333                 attribute user_tmp_type;
 334                 type user_tmp_t;
 335         ')
 336
 337         role $1 types user_tmp_t;
 338
 339         files_poly_member_tmp($2, user_tmp_t)
 340
 341         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 342         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 343         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 344         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 345         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 346         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 347         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 348         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 349         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 350         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 351         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 352 ')
 353
 354 #######################################
 355 ## <summary>
 356 ##      Dontaudit search of user bin dirs.
 357 ## </summary>
 358 ## <param name="domain">
 359 ##      <summary>
 360 ##      Domain to not audit.
 361 ##      </summary>
 362 ## </param>
 363 #
 364 interface(`userdom_dontaudit_search_user_bin_dirs',`
 365         gen_require(`
 366                 type home_bin_t;
 367         ')
 368
 369         dontaudit $1 home_bin_t:dir search_dir_perms;
 370 ')
 371
 372 #######################################
 373 ## <summary>
 374 ##      Execute user bin files.
 375 ## </summary>
 376 ## <param name="domain">
 377 ##      <summary>
 378 ##      Domain allowed access.
 379 ##      </summary>
 380 ## </param>
 381 #
 382 interface(`userdom_exec_user_bin_files',`
 383         gen_require(`
 384                 attribute user_home_type;
 385                 type home_bin_t, user_home_dir_t;
 386         ')
 387
 388         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 389         files_search_home($1)
 390 ')
 391
 392 #######################################
 393 ## <summary>
 394 ##      The execute access user temporary files.
 395 ## </summary>
 396 ## <param name="domain">
 397 ##      <summary>
 398 ##      Domain allowed access.
 399 ##      </summary>
 400 ## </param>
 401 ## <rolebase/>
 402 #
 403 interface(`userdom_exec_user_tmp_files',`
 404         gen_require(`
 405                 type user_tmp_t;
 406         ')
 407
 408         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 409         dontaudit $1 user_tmp_t:sock_file execute;
 410         files_search_tmp($1)
 411 ')
 412
 413 #######################################
 414 ## <summary>
 415 ##      Role access for the user tmpfs type
 416 ##      that the user has full access.
 417 ## </summary>
 418 ## <desc>
 419 ##      <p>
 420 ##      Role access for the user tmpfs type
 421 ##      that the user has full access.
 422 ##      </p>
 423 ##      <p>
 424 ##      This does not allow execute access.
 425 ##      </p>
 426 ## </desc>
 427 ## <param name="role">
 428 ##      <summary>
 429 ##      Role allowed access.
 430 ##      </summary>
 431 ## </param>
 432 ## <param name="domain">
 433 ##      <summary>
 434 ##      Domain allowed access.
 435 ##      </summary>
 436 ## </param>
 437 ## <rolecap/>
 438 #
 439 interface(`userdom_manage_tmpfs_role',`
 440         gen_require(`
 441                 attribute user_tmpfs_type;
 442                 type user_tmpfs_t;
 443         ')
 444
 445         role $1 types user_tmpfs_t;
 446
 447         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 450         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 451         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 452         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 453         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 454         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 455         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 456         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 457         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 458 ')
 459
 460 #######################################
 461 ## <summary>
 462 ##      The interface allowing the user basic
 463 ##      network permissions
 464 ## </summary>
 465 ## <param name="userdomain">
 466 ##      <summary>
 467 ##      The user domain
 468 ##      </summary>
 469 ## </param>
 470 ## <rolebase/>
 471 #
 472 interface(`userdom_basic_networking',`
 473
 474         allow $1 self:tcp_socket create_stream_socket_perms;
 475         allow $1 self:udp_socket create_socket_perms;
 476
 477         corenet_all_recvfrom_unlabeled($1)
 478         corenet_all_recvfrom_netlabel($1)
 479         corenet_tcp_sendrecv_generic_if($1)
 480         corenet_udp_sendrecv_generic_if($1)
 481         corenet_tcp_sendrecv_generic_node($1)
 482         corenet_udp_sendrecv_generic_node($1)
 483         corenet_tcp_sendrecv_all_ports($1)
 484         corenet_udp_sendrecv_all_ports($1)
 485         corenet_tcp_connect_all_ports($1)
 486         corenet_sendrecv_all_client_packets($1)
 487
 488         optional_policy(`
 489                 init_tcp_recvfrom_all_daemons($1)
 490                 init_udp_recvfrom_all_daemons($1)
 491         ')
 492
 493         optional_policy(`
 494                 ipsec_match_default_spd($1)
 495         ')
 496
 497 ')
 498
 499 #######################################
 500 ## <summary>
 501 ##      The template for creating a user xwindows client.  (Deprecated)
 502 ## </summary>
 503 ## <param name="userdomain_prefix">
 504 ##      <summary>
 505 ##      The prefix of the user domain (e.g., user
 506 ##      is the prefix for user_t).
 507 ##      </summary>
 508 ## </param>
 509 ## <rolebase/>
 510 #
 511 template(`userdom_xwindows_client_template',`
 512         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 513         gen_require(`
 514                 type $1_t, user_tmpfs_t;
 515         ')
 516
 517         dev_rw_xserver_misc($1_t)
 518         dev_rw_power_management($1_t)
 519         dev_read_input($1_t)
 520         dev_read_misc($1_t)
 521         dev_write_misc($1_t)
 522         # open office is looking for the following
 523         dev_getattr_agp_dev($1_t)
 524         dev_dontaudit_rw_dri($1_t)
 525         # GNOME checks for usb and other devices:
 526         dev_rw_usbfs($1_t)
 527         dev_rw_generic_usb_dev($1_t)
 528
 529         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 530         xserver_xsession_entry_type($1_t)
 531         xserver_dontaudit_write_log($1_t)
 532         xserver_stream_connect_xdm($1_t)
 533         # certain apps want to read xdm.pid file
 534         xserver_read_xdm_pid($1_t)
 535         # gnome-session creates socket under /tmp/.ICE-unix/
 536         xserver_create_xdm_tmp_sockets($1_t)
 537         # Needed for escd, remove if we get escd policy
 538         xserver_manage_xdm_tmp_files($1_t)
 539 ')
 540
 541 #######################################
 542 ## <summary>
 543 ##      The template for allowing the user to change passwords.
 544 ## </summary>
 545 ## <param name="userdomain_prefix">
 546 ##      <summary>
 547 ##      The prefix of the user domain (e.g., user
 548 ##      is the prefix for user_t).
 549 ##      </summary>
 550 ## </param>
 551 ## <rolebase/>
 552 #
 553 template(`userdom_change_password_template',`
 554         gen_require(`
 555                 type $1_t;
 556                 role $1_r;
 557         ')
 558
 559         optional_policy(`
 560                 usermanage_run_chfn($1_t,$1_r)
 561                 usermanage_run_passwd($1_t,$1_r)
 562         ')
 563 ')
 564
 565 #######################################
 566 ## <summary>
 567 ##      The template containing rules common to unprivileged
 568 ##      users and administrative users.
 569 ## </summary>
 570 ## <desc>
 571 ##      <p>
 572 ##      This template creates a user domain, types, and
 573 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 574 ##      </p>
 575 ## </desc>
 576 ## <param name="userdomain_prefix">
 577 ##      <summary>
 578 ##      The prefix of the user domain (e.g., user
 579 ##      is the prefix for user_t).
 580 ##      </summary>
 581 ## </param>
 582 #
 583 template(`userdom_common_user_template',`
 584         gen_require(`
 585                 attribute unpriv_userdomain;
 586         ')
 587
 588         userdom_basic_networking($1_usertype)
 589
 590         ##############################
 591         #
 592         # User domain Local policy
 593         #
 594
 595         # evolution and gnome-session try to create a netlink socket
 596         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 597         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 598         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 599         allow $1_t self:socket create_socket_perms;
 600
 601         allow $1_usertype unpriv_userdomain:fd use;
 602
 603         kernel_read_system_state($1_usertype)
 604         kernel_read_network_state($1_usertype)
 605         kernel_read_software_raid_state($1_usertype)
 606         kernel_read_net_sysctls($1_usertype)
 607         # Very permissive allowing every domain to see every type:
 608         kernel_get_sysvipc_info($1_usertype)
 609         # Find CDROM devices:
 610         kernel_read_device_sysctls($1_usertype)
 611         kernel_request_load_module($1_usertype)
 612
 613         corenet_udp_bind_generic_node($1_usertype)
 614         corenet_udp_bind_generic_port($1_usertype)
 615
 616         dev_read_rand($1_usertype)
 617         dev_write_sound($1_usertype)
 618         dev_read_sound($1_usertype)
 619         dev_read_sound_mixer($1_usertype)
 620         dev_write_sound_mixer($1_usertype)
 621
 622         files_exec_etc_files($1_usertype)
 623         files_search_locks($1_usertype)
 624         # Check to see if cdrom is mounted
 625         files_search_mnt($1_usertype)
 626         # cjp: perhaps should cut back on file reads:
 627         files_read_var_files($1_usertype)
 628         files_read_var_symlinks($1_usertype)
 629         files_read_generic_spool($1_usertype)
 630         files_read_var_lib_files($1_usertype)
 631         # Stat lost+found.
 632         files_getattr_lost_found_dirs($1_usertype)
 633         files_read_config_files($1_usertype)
 634         fs_read_noxattr_fs_files($1_usertype)
 635         fs_read_noxattr_fs_symlinks($1_usertype)
 636         fs_rw_cgroup_files($1_usertype)
 637
 638         application_getattr_socket($1_usertype)
 639
 640         logging_send_syslog_msg($1_usertype)
 641         logging_send_audit_msgs($1_usertype)
 642         selinux_get_enforce_mode($1_usertype)
 643
 644         # cjp: some of this probably can be removed
 645         selinux_get_fs_mount($1_usertype)
 646         selinux_validate_context($1_usertype)
 647         selinux_compute_access_vector($1_usertype)
 648         selinux_compute_create_context($1_usertype)
 649         selinux_compute_relabel_context($1_usertype)
 650         selinux_compute_user_contexts($1_usertype)
 651
 652         # for eject
 653         storage_getattr_fixed_disk_dev($1_usertype)
 654
 655         auth_read_login_records($1_usertype)
 656         auth_run_pam($1_t,$1_r)
 657         auth_run_utempter($1_t,$1_r)
 658         auth_filetrans_admin_home_content($1_t)
 659         auth_filetrans_home_content($1_t)
 660
 661         init_read_utmp($1_usertype)
 662
 663         seutil_read_file_contexts($1_usertype)
 664         seutil_read_default_contexts($1_usertype)
 665         seutil_run_newrole($1_t,$1_r)
 666         seutil_exec_checkpolicy($1_t)
 667         seutil_exec_setfiles($1_usertype)
 668         # for when the network connection is killed
 669         # this is needed when a login role can change
 670         # to this one.
 671         seutil_dontaudit_signal_newrole($1_t)
 672
 673         tunable_policy(`user_direct_mouse',`
 674                 dev_read_mouse($1_usertype)
 675         ')
 676
 677         tunable_policy(`user_ttyfile_stat',`
 678                 term_getattr_all_ttys($1_t)
 679         ')
 680
 681         optional_policy(`
 682                 # Allow graphical boot to check battery lifespan
 683                 apm_stream_connect($1_usertype)
 684         ')
 685
 686         optional_policy(`
 687                 canna_stream_connect($1_usertype)
 688         ')
 689
 690         optional_policy(`
 691                 colord_read_lib_files($1_usertype)
 692         ')
 693
 694         optional_policy(`
 695                 dbus_system_bus_client($1_usertype)
 696
 697                 allow $1_usertype $1_usertype:dbus  send_msg;
 698
 699                 optional_policy(`
 700                         avahi_dbus_chat($1_usertype)
 701                 ')
 702
 703                 optional_policy(`
 704                         policykit_dbus_chat($1_usertype)
 705                 ')
 706
 707                 optional_policy(`
 708                         bluetooth_dbus_chat($1_usertype)
 709                 ')
 710
 711                 optional_policy(`
 712                         consolekit_dbus_chat($1_usertype)
 713                         consolekit_read_log($1_usertype)
 714                 ')
 715
 716                 optional_policy(`
 717                         devicekit_dbus_chat($1_usertype)
 718                         devicekit_dbus_chat_power($1_usertype)
 719                         devicekit_dbus_chat_disk($1_usertype)
 720                 ')
 721
 722                 optional_policy(`
 723                         gnome_dbus_chat_gconfdefault($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         hal_dbus_chat($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         kde_dbus_chat_backlighthelper($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         modemmanager_dbus_chat($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         networkmanager_dbus_chat($1_usertype)
 740                         networkmanager_read_lib_files($1_usertype)
 741                 ')
 742
 743                 optional_policy(`
 744                         vpn_dbus_chat($1_usertype)
 745                 ')
 746         ')
 747
 748         optional_policy(`
 749                 git_session_role($1_r, $1_usertype)
 750         ')
 751
 752         optional_policy(`
 753                 inetd_use_fds($1_usertype)
 754                 inetd_rw_tcp_sockets($1_usertype)
 755         ')
 756
 757         optional_policy(`
 758                 inn_read_config($1_usertype)
 759                 inn_read_news_lib($1_usertype)
 760                 inn_read_news_spool($1_usertype)
 761         ')
 762
 763         optional_policy(`
 764                 lircd_stream_connect($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 locate_read_lib_files($1_usertype)
 769         ')
 770
 771         # for running depmod as part of the kernel packaging process
 772         optional_policy(`
 773                 modutils_read_module_config($1_usertype)
 774         ')
 775
 776         optional_policy(`
 777                 mta_rw_spool($1_usertype)
 778                 mta_manage_queue($1_usertype)
 779                 mta_filetrans_home_content($1_usertype)
 780         ')
 781
 782         optional_policy(`
 783                 tunable_policy(`allow_user_mysql_connect',`
 784                         mysql_stream_connect($1_t)
 785                 ')
 786         ')
 787
 788         optional_policy(`
 789                 oident_manage_user_content($1_t)
 790                 oident_relabel_user_content($1_t)
 791         ')
 792
 793         optional_policy(`
 794                 # to allow monitoring of pcmcia status
 795                 pcmcia_read_pid($1_usertype)
 796         ')
 797
 798         optional_policy(`
 799                 pcscd_read_pub_files($1_usertype)
 800                 pcscd_stream_connect($1_usertype)
 801         ')
 802
 803         optional_policy(`
 804                 tunable_policy(`allow_user_postgresql_connect',`
 805                         postgresql_stream_connect($1_usertype)
 806                         postgresql_tcp_connect($1_usertype)
 807                 ')
 808         ')
 809
 810         optional_policy(`
 811                 resmgr_stream_connect($1_usertype)
 812         ')
 813
 814         optional_policy(`
 815                 rpc_dontaudit_getattr_exports($1_usertype)
 816                 rpc_manage_nfs_rw_content($1_usertype)
 817         ')
 818
 819         optional_policy(`
 820                 rpcbind_stream_connect($1_usertype)
 821         ')
 822
 823         optional_policy(`
 824                 samba_stream_connect_winbind($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 sandbox_transition($1_usertype, $1_r)
 829         ')
 830
 831         optional_policy(`
 832                 seunshare_role_template($1, $1_r, $1_t)
 833         ')
 834
 835         optional_policy(`
 836                 slrnpull_search_spool($1_usertype)
 837         ')
 838 ')
 839
 840 #######################################
 841 ## <summary>
 842 ##      The template for creating a login user.
 843 ## </summary>
 844 ## <desc>
 845 ##      <p>
 846 ##      This template creates a user domain, types, and
 847 ##      rules for the user's tty, pty, home directories,
 848 ##      tmp, and tmpfs files.
 849 ##      </p>
 850 ## </desc>
 851 ## <param name="userdomain_prefix">
 852 ##      <summary>
 853 ##      The prefix of the user domain (e.g., user
 854 ##      is the prefix for user_t).
 855 ##      </summary>
 856 ## </param>
 857 #
 858 template(`userdom_login_user_template', `
 859         gen_require(`
 860                 class context contains;
 861         ')
 862
 863         userdom_base_user_template($1)
 864
 865         userdom_manage_home_role($1_r, $1_usertype)
 866
 867         userdom_manage_tmp_role($1_r, $1_usertype)
 868         userdom_manage_tmpfs_role($1_r, $1_usertype)
 869
 870         ifelse(`$1',`unconfined',`',`
 871                 gen_tunable(allow_$1_exec_content, true)
 872
 873                 tunable_policy(`allow_$1_exec_content',`
 874                         userdom_exec_user_tmp_files($1_usertype)
 875                         userdom_exec_user_home_content_files($1_usertype)
 876                 ')
 877                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 878                         fs_exec_nfs_files($1_usertype)
 879                 ')
 880
 881                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 882                         fs_exec_cifs_files($1_usertype)
 883                 ')
 884         ')
 885
 886         userdom_change_password_template($1)
 887
 888         ##############################
 889         #
 890         # User domain Local policy
 891         #
 892
 893         allow $1_t self:capability { setgid chown fowner };
 894         dontaudit $1_t self:capability { sys_nice fsetid };
 895
 896         allow $1_t self:process ~{ ptrace setcurrent setexec setrlimit execmem execstack execheap };
 897         dontaudit $1_t self:process setrlimit;
 898         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 899
 900         allow $1_t self:context contains;
 901
 902         kernel_dontaudit_read_system_state($1_usertype)
 903         kernel_dontaudit_list_all_proc($1_usertype)
 904
 905         dev_read_sysfs($1_usertype)
 906         dev_read_urand($1_usertype)
 907
 908         domain_use_interactive_fds($1_usertype)
 909         # Command completion can fire hundreds of denials
 910         domain_dontaudit_exec_all_entry_files($1_usertype)
 911
 912         files_dontaudit_list_default($1_usertype)
 913         files_dontaudit_read_default_files($1_usertype)
 914         # Stat lost+found.
 915         files_getattr_lost_found_dirs($1_usertype)
 916
 917         fs_get_all_fs_quotas($1_usertype)
 918         fs_getattr_all_fs($1_usertype)
 919         fs_search_all($1_usertype)
 920         fs_list_inotifyfs($1_usertype)
 921         fs_rw_anon_inodefs_files($1_usertype)
 922
 923         auth_dontaudit_write_login_records($1_t)
 924         auth_rw_cache($1_t)
 925
 926         application_exec_all($1_t)
 927         # The library functions always try to open read-write first,
 928         # then fall back to read-only if it fails.
 929         init_dontaudit_rw_utmp($1_t)
 930
 931         # Stop warnings about access to /dev/console
 932         init_dontaudit_use_fds($1_usertype)
 933         init_dontaudit_use_script_fds($1_usertype)
 934
 935         libs_exec_lib_files($1_usertype)
 936
 937         logging_dontaudit_getattr_all_logs($1_usertype)
 938
 939         # for running TeX programs
 940         miscfiles_read_tetex_data($1_usertype)
 941         miscfiles_exec_tetex_data($1_usertype)
 942
 943         seutil_read_config($1_usertype)
 944
 945         optional_policy(`
 946                 cups_read_config($1_usertype)
 947                 cups_stream_connect($1_usertype)
 948                 cups_stream_connect_ptal($1_usertype)
 949         ')
 950
 951         optional_policy(`
 952                 kerberos_use($1_usertype)
 953                 kerberos_filetrans_home_content($1_usertype)
 954         ')
 955
 956         optional_policy(`
 957                 mta_dontaudit_read_spool_symlinks($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 quota_dontaudit_getattr_db($1_usertype)
 962         ')
 963
 964         optional_policy(`
 965                 rpm_read_db($1_usertype)
 966                 rpm_dontaudit_manage_db($1_usertype)
 967                 rpm_read_cache($1_usertype)
 968         ')
 969
 970         optional_policy(`
 971                 oddjob_run_mkhomedir($1_t, $1_r)
 972         ')
 973 ')
 974
 975 #######################################
 976 ## <summary>
 977 ##      The template for creating a unprivileged login user.
 978 ## </summary>
 979 ## <desc>
 980 ##      <p>
 981 ##      This template creates a user domain, types, and
 982 ##      rules for the user's tty, pty, home directories,
 983 ##      tmp, and tmpfs files.
 984 ##      </p>
 985 ## </desc>
 986 ## <param name="userdomain_prefix">
 987 ##      <summary>
 988 ##      The prefix of the user domain (e.g., user
 989 ##      is the prefix for user_t).
 990 ##      </summary>
 991 ## </param>
 992 #
 993 template(`userdom_restricted_user_template',`
 994         gen_require(`
 995                 attribute unpriv_userdomain;
 996         ')
 997
 998         userdom_login_user_template($1)
 999
1000         typeattribute $1_t unpriv_userdomain;
1001         domain_interactive_fd($1_t)
1002
1003         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1004         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1005
1006         ##############################
1007         #
1008         # Local policy
1009         #
1010
1011         optional_policy(`
1012                 loadkeys_run($1_t, $1_r)
1013         ')
1014 ')
1015
1016 #######################################
1017 ## <summary>
1018 ##      The template for creating a unprivileged xwindows login user.
1019 ## </summary>
1020 ## <desc>
1021 ##      <p>
1022 ##      The template for creating a unprivileged xwindows login user.
1023 ##      </p>
1024 ##      <p>
1025 ##      This template creates a user domain, types, and
1026 ##      rules for the user's tty, pty, home directories,
1027 ##      tmp, and tmpfs files.
1028 ##      </p>
1029 ## </desc>
1030 ## <param name="userdomain_prefix">
1031 ##      <summary>
1032 ##      The prefix of the user domain (e.g., user
1033 ##      is the prefix for user_t).
1034 ##      </summary>
1035 ## </param>
1036 #
1037 template(`userdom_restricted_xwindows_user_template',`
1038
1039         userdom_restricted_user_template($1)
1040
1041         ##############################
1042         #
1043         # Local policy
1044         #
1045
1046         auth_role($1_r, $1_t)
1047         auth_search_pam_console_data($1_usertype)
1048         auth_dontaudit_read_login_records($1_usertype)
1049
1050         dev_read_sound($1_usertype)
1051         dev_write_sound($1_usertype)
1052         # gnome keyring wants to read this.
1053         dev_dontaudit_read_rand($1_usertype)
1054         # temporarily allow since openoffice requires this
1055         dev_read_rand($1_usertype)
1056
1057         dev_read_video_dev($1_usertype)
1058         dev_write_video_dev($1_usertype)
1059         dev_rw_wireless($1_usertype)
1060
1061         libs_dontaudit_setattr_lib_files($1_usertype)
1062
1063         tunable_policy(`user_rw_noexattrfile',`
1064                 dev_rw_usbfs($1_t)
1065                 dev_rw_generic_usb_dev($1_usertype)
1066
1067                 fs_manage_noxattr_fs_files($1_usertype)
1068                 fs_manage_noxattr_fs_dirs($1_usertype)
1069                 fs_manage_dos_dirs($1_usertype)
1070                 fs_manage_dos_files($1_usertype)
1071                 storage_raw_read_removable_device($1_usertype)
1072                 storage_raw_write_removable_device($1_usertype)
1073         ')
1074
1075         logging_send_syslog_msg($1_usertype)
1076         logging_dontaudit_send_audit_msgs($1_t)
1077
1078         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1079         logging_send_audit_msgs($1_t)
1080         selinux_get_enforce_mode($1_t)
1081         seutil_exec_restorecond($1_t)
1082         seutil_read_file_contexts($1_t)
1083         seutil_read_default_contexts($1_t)
1084
1085         xserver_restricted_role($1_r, $1_t)
1086
1087         optional_policy(`
1088                 alsa_read_rw_config($1_usertype)
1089         ')
1090
1091          # cjp: needed by KDE apps
1092          # bug: #682499
1093          optional_policy(`
1094                 gnome_read_usr_config($1_usertype)
1095                 gnome_role_gkeyringd($1, $1_r, $1_usertype)
1096         ')
1097
1098         optional_policy(`
1099                 dbus_role_template($1, $1_r, $1_usertype)
1100                 dbus_system_bus_client($1_usertype)
1101                 allow $1_usertype $1_usertype:dbus send_msg;
1102
1103                 optional_policy(`
1104                         abrt_dbus_chat($1_usertype)
1105                         abrt_run_helper($1_usertype, $1_r)
1106                 ')
1107
1108                 optional_policy(`
1109                         consolekit_dontaudit_read_log($1_usertype)
1110                         consolekit_dbus_chat($1_usertype)
1111                 ')
1112
1113                 optional_policy(`
1114                         cups_dbus_chat($1_usertype)
1115                         cups_dbus_chat_config($1_usertype)
1116                 ')
1117
1118                 optional_policy(`
1119                         devicekit_dbus_chat($1_usertype)
1120                         devicekit_dbus_chat_disk($1_usertype)
1121                         devicekit_dbus_chat_power($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         fprintd_dbus_chat($1_t)
1126                 ')
1127         ')
1128
1129         optional_policy(`
1130                 policykit_role($1_r, $1_usertype)
1131         ')
1132
1133         optional_policy(`
1134                 pulseaudio_role($1_r, $1_usertype)
1135                 pulseaudio_filetrans_admin_home_content($1_usertype)
1136                 pulseaudio_filetrans_home_content($1_usertype)
1137         ')
1138
1139         optional_policy(`
1140                 rtkit_scheduled($1_usertype)
1141         ')
1142
1143         optional_policy(`
1144                 setroubleshoot_dontaudit_stream_connect($1_t)
1145         ')
1146
1147         optional_policy(`
1148                 udev_read_db($1_usertype)
1149         ')
1150
1151         optional_policy(`
1152                 wm_role_template($1, $1_r, $1_t)
1153         ')
1154 ')
1155
1156 #######################################
1157 ## <summary>
1158 ##      The template for creating a unprivileged user roughly
1159 ##      equivalent to a regular linux user.
1160 ## </summary>
1161 ## <desc>
1162 ##      <p>
1163 ##      The template for creating a unprivileged user roughly
1164 ##      equivalent to a regular linux user.
1165 ##      </p>
1166 ##      <p>
1167 ##      This template creates a user domain, types, and
1168 ##      rules for the user's tty, pty, home directories,
1169 ##      tmp, and tmpfs files.
1170 ##      </p>
1171 ## </desc>
1172 ## <param name="userdomain_prefix">
1173 ##      <summary>
1174 ##      The prefix of the user domain (e.g., user
1175 ##      is the prefix for user_t).
1176 ##      </summary>
1177 ## </param>
1178 #
1179 template(`userdom_unpriv_user_template', `
1180
1181         ##############################
1182         #
1183         # Declarations
1184         #
1185
1186         # Inherit rules for ordinary users.
1187         userdom_restricted_xwindows_user_template($1)
1188         userdom_common_user_template($1)
1189
1190         ##############################
1191         #
1192         # Local policy
1193         #
1194
1195         # port access is audited even if dac would not have allowed it, so dontaudit it here
1196 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1197         # Need the following rule to allow users to run vpnc
1198         corenet_tcp_bind_xserver_port($1_t)
1199         corenet_tcp_bind_generic_node($1_usertype)
1200
1201         storage_rw_fuse($1_t)
1202
1203         files_exec_usr_files($1_t)
1204    # cjp: why?
1205         files_read_kernel_symbol_table($1_t)
1206
1207         ifndef(`enable_mls',`
1208                 fs_exec_noxattr($1_t)
1209
1210                 tunable_policy(`user_rw_noexattrfile',`
1211                         fs_manage_noxattr_fs_files($1_t)
1212                         fs_manage_noxattr_fs_dirs($1_t)
1213                         # Write floppies
1214                         storage_raw_read_removable_device($1_t)
1215                         storage_raw_write_removable_device($1_t)
1216                 ',`
1217                         storage_raw_read_removable_device($1_t)
1218                 ')
1219         ')
1220
1221         miscfiles_read_hwdata($1_usertype)
1222
1223         # Allow users to run TCP servers (bind to ports and accept connection from
1224         # the same domain and outside users) disabling this forces FTP passive mode
1225         # and may change other protocols
1226
1227         tunable_policy(`user_share_music',`
1228                 corenet_tcp_bind_daap_port($1_usertype)
1229         ')
1230
1231         tunable_policy(`user_tcp_server',`
1232                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1233         ')
1234
1235         tunable_policy(`user_setrlimit',`
1236                 allow $1_usertype self:process setrlimit;
1237         ')
1238
1239         optional_policy(`
1240                 cdrecord_role($1_r, $1_t)
1241         ')
1242
1243         optional_policy(`
1244                 cron_role($1_r, $1_t)
1245         ')
1246
1247         optional_policy(`
1248                 gpg_role($1_r, $1_usertype)
1249         ')
1250
1251         optional_policy(`
1252                 gnomeclock_dbus_chat($1_t)
1253         ')
1254
1255         optional_policy(`
1256                 gpm_stream_connect($1_usertype)
1257         ')
1258
1259         optional_policy(`
1260                 mount_run_fusermount($1_t, $1_r)
1261                 mount_read_pid_files($1_t)
1262         ')
1263
1264         optional_policy(`
1265                 wine_role_template($1, $1_r, $1_t)
1266         ')
1267
1268         optional_policy(`
1269                 postfix_run_postdrop($1_t, $1_r)
1270                 postfix_search_spool($1_t)
1271         ')
1272
1273         # Run pppd in pppd_t by default for user
1274         optional_policy(`
1275                 ppp_run_cond($1_t, $1_r)
1276         ')
1277
1278         optional_policy(`
1279                 vdagent_getattr_log($1_t)
1280                 vdagent_getattr_exec($1_t)
1281                 vdagent_stream_connect($1_t)
1282         ')
1283 ')
1284
1285 #######################################
1286 ## <summary>
1287 ##      The template for creating an administrative user.
1288 ## </summary>
1289 ## <desc>
1290 ##      <p>
1291 ##      This template creates a user domain, types, and
1292 ##      rules for the user's tty, pty, home directories,
1293 ##      tmp, and tmpfs files.
1294 ##      </p>
1295 ##      <p>
1296 ##      The privileges given to administrative users are:
1297 ##      <ul>
1298 ##              <li>Raw disk access</li>
1299 ##              <li>Set all sysctls</li>
1300 ##              <li>All kernel ring buffer controls</li>
1301 ##              <li>Create, read, write, and delete all files but shadow</li>
1302 ##              <li>Manage source and binary format SELinux policy</li>
1303 ##              <li>Run insmod</li>
1304 ##      </ul>
1305 ##      </p>
1306 ## </desc>
1307 ## <param name="userdomain_prefix">
1308 ##      <summary>
1309 ##      The prefix of the user domain (e.g., sysadm
1310 ##      is the prefix for sysadm_t).
1311 ##      </summary>
1312 ## </param>
1313 #
1314 template(`userdom_admin_user_template',`
1315         gen_require(`
1316                 attribute admindomain;
1317                 class passwd { passwd chfn chsh rootok crontab };
1318         ')
1319
1320         ##############################
1321         #
1322         # Declarations
1323         #
1324
1325         # Inherit rules for ordinary users.
1326         userdom_login_user_template($1)
1327         userdom_common_user_template($1)
1328
1329         domain_obj_id_change_exemption($1_t)
1330         role system_r types $1_t;
1331
1332         typeattribute $1_t admindomain;
1333
1334         ifdef(`direct_sysadm_daemon',`
1335                 domain_system_change_exemption($1_t)
1336         ')
1337
1338         ##############################
1339         #
1340         # $1_t local policy
1341         #
1342
1343         allow $1_t self:capability ~{ sys_ptrace sys_module audit_control audit_write };
1344         tunable_policy(`deny_ptrace',`',`
1345                 allow $1_t self:capability sys_ptrace;
1346         ')
1347         allow $1_t self:capability2 syslog;
1348         allow $1_t self:process { setexec setfscreate };
1349         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1350         allow $1_t self:tun_socket create;
1351         # Set password information for other users.
1352         allow $1_t self:passwd { passwd chfn chsh };
1353         # Skip authentication when pam_rootok is specified.
1354         allow $1_t self:passwd rootok;
1355
1356         # Manipulate other users crontab.
1357         allow $1_t self:passwd crontab;
1358
1359         kernel_read_software_raid_state($1_t)
1360         kernel_getattr_core_if($1_t)
1361         kernel_getattr_message_if($1_t)
1362         kernel_change_ring_buffer_level($1_t)
1363         kernel_clear_ring_buffer($1_t)
1364         kernel_read_ring_buffer($1_t)
1365         kernel_get_sysvipc_info($1_t)
1366         kernel_rw_all_sysctls($1_t)
1367         # signal unlabeled processes:
1368         kernel_kill_unlabeled($1_t)
1369         kernel_signal_unlabeled($1_t)
1370         kernel_sigstop_unlabeled($1_t)
1371         kernel_signull_unlabeled($1_t)
1372         kernel_sigchld_unlabeled($1_t)
1373         kernel_signal($1_t)
1374
1375         corenet_tcp_bind_generic_port($1_t)
1376         # allow setting up tunnels
1377         corenet_rw_tun_tap_dev($1_t)
1378
1379         dev_getattr_generic_blk_files($1_t)
1380         dev_getattr_generic_chr_files($1_t)
1381         # for lsof
1382         dev_getattr_mtrr_dev($1_t)
1383         # Allow MAKEDEV to work
1384         dev_create_all_blk_files($1_t)
1385         dev_create_all_chr_files($1_t)
1386         dev_delete_all_blk_files($1_t)
1387         dev_delete_all_chr_files($1_t)
1388         dev_rename_all_blk_files($1_t)
1389         dev_rename_all_chr_files($1_t)
1390         dev_create_generic_symlinks($1_t)
1391         dev_rw_generic_usb_dev($1_t)
1392         dev_rw_usbfs($1_t)
1393
1394         domain_setpriority_all_domains($1_t)
1395         domain_read_all_domains_state($1_t)
1396         domain_getattr_all_domains($1_t)
1397         domain_getcap_all_domains($1_t)
1398         domain_dontaudit_ptrace_all_domains($1_t)
1399         # signal all domains:
1400         domain_kill_all_domains($1_t)
1401         domain_signal_all_domains($1_t)
1402         domain_signull_all_domains($1_t)
1403         domain_sigstop_all_domains($1_t)
1404         domain_sigstop_all_domains($1_t)
1405         domain_sigchld_all_domains($1_t)
1406         # for lsof
1407         domain_getattr_all_sockets($1_t)
1408         domain_dontaudit_getattr_all_sockets($1_t)
1409
1410         files_exec_usr_src_files($1_t)
1411
1412         fs_getattr_all_fs($1_t)
1413         fs_getattr_all_files($1_t)
1414         fs_list_all($1_t)
1415         fs_set_all_quotas($1_t)
1416         fs_exec_noxattr($1_t)
1417
1418         storage_raw_read_removable_device($1_t)
1419         storage_raw_write_removable_device($1_t)
1420         storage_dontaudit_read_fixed_disk($1_t)
1421
1422         term_use_all_inherited_terms($1_t)
1423         term_use_unallocated_ttys($1_t)
1424
1425         auth_getattr_shadow($1_t)
1426         # Manage almost all files
1427         files_manage_non_security_dirs($1_t)
1428         files_manage_non_security_files($1_t)
1429         # Relabel almost all files
1430         files_relabel_non_security_files($1_t)
1431
1432         init_telinit($1_t)
1433
1434         logging_send_syslog_msg($1_t)
1435
1436         optional_policy(`
1437                 modutils_domtrans_insmod($1_t)
1438                 modutils_domtrans_depmod($1_t)
1439         ')
1440
1441         # The following rule is temporary until such time that a complete
1442         # policy management infrastructure is in place so that an administrator
1443         # cannot directly manipulate policy files with arbitrary programs.
1444         seutil_manage_src_policy($1_t)
1445         # Violates the goal of limiting write access to checkpolicy.
1446         # But presently necessary for installing the file_contexts file.
1447         seutil_manage_bin_policy($1_t)
1448
1449         systemd_config_all_services($1_t)
1450
1451         userdom_manage_user_home_content_dirs($1_t)
1452         userdom_manage_user_home_content_files($1_t)
1453         userdom_manage_user_home_content_symlinks($1_t)
1454         userdom_manage_user_home_content_pipes($1_t)
1455         userdom_manage_user_home_content_sockets($1_t)
1456         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1457
1458         tunable_policy(`user_rw_noexattrfile',`
1459                 fs_manage_noxattr_fs_files($1_t)
1460                 fs_manage_noxattr_fs_dirs($1_t)
1461         ',`
1462                 fs_read_noxattr_fs_files($1_t)
1463         ')
1464
1465         optional_policy(`
1466                 postgresql_unconfined($1_t)
1467         ')
1468
1469         optional_policy(`
1470                 userhelper_exec($1_t)
1471         ')
1472 ')
1473
1474 ########################################
1475 ## <summary>
1476 ##      Allow user to run as a secadm
1477 ## </summary>
1478 ## <desc>
1479 ##      <p>
1480 ##      Create objects in a user home directory
1481 ##      with an automatic type transition to
1482 ##      a specified private type.
1483 ##      </p>
1484 ##      <p>
1485 ##      This is a templated interface, and should only
1486 ##      be called from a per-userdomain template.
1487 ##      </p>
1488 ## </desc>
1489 ## <param name="domain">
1490 ##      <summary>
1491 ##      Domain allowed access.
1492 ##      </summary>
1493 ## </param>
1494 ## <param name="role">
1495 ##      <summary>
1496 ##      The role  of the object to create.
1497 ##      </summary>
1498 ## </param>
1499 #
1500 template(`userdom_security_admin_template',`
1501         allow $1 self:capability { dac_read_search dac_override };
1502
1503         corecmd_exec_shell($1)
1504
1505         domain_obj_id_change_exemption($1)
1506
1507         dev_relabel_all_dev_nodes($1)
1508
1509         files_create_boot_flag($1)
1510         files_create_default_dir($1)
1511         files_root_filetrans_default($1, dir)
1512
1513         # Necessary for managing /boot/efi
1514         fs_manage_dos_files($1)
1515
1516         mls_process_read_up($1)
1517         mls_file_read_all_levels($1)
1518         mls_file_upgrade($1)
1519         mls_file_downgrade($1)
1520
1521         selinux_set_enforce_mode($1)
1522         selinux_set_all_booleans($1)
1523         selinux_set_parameters($1)
1524         selinux_read_policy($1)
1525
1526         files_relabel_all_files($1)
1527         auth_relabel_shadow($1)
1528
1529         init_exec($1)
1530
1531         logging_send_syslog_msg($1)
1532         logging_read_audit_log($1)
1533         logging_read_generic_logs($1)
1534         logging_read_audit_config($1)
1535
1536         seutil_manage_bin_policy($1)
1537         seutil_manage_default_contexts($1)
1538         seutil_manage_file_contexts($1)
1539         seutil_manage_module_store($1)
1540         seutil_manage_config($1)
1541         seutil_run_checkpolicy($1,$2)
1542         seutil_run_loadpolicy($1,$2)
1543         seutil_run_semanage($1,$2)
1544         seutil_run_setsebool($1,$2)
1545         seutil_run_setfiles($1, $2)
1546
1547         seutil_manage_bin_policy($1)
1548     seutil_manage_default_contexts($1)
1549     seutil_manage_file_contexts($1)
1550     seutil_manage_module_store($1)
1551     seutil_manage_config($1)
1552
1553         optional_policy(`
1554                 aide_run($1,$2)
1555         ')
1556
1557         optional_policy(`
1558                 consoletype_exec($1)
1559         ')
1560
1561         optional_policy(`
1562                 dmesg_exec($1)
1563         ')
1564
1565         optional_policy(`
1566                 ipsec_run_setkey($1,$2)
1567         ')
1568
1569         optional_policy(`
1570                 netlabel_run_mgmt($1,$2)
1571         ')
1572
1573         optional_policy(`
1574                 samhain_run($1, $2)
1575         ')
1576 ')
1577
1578 ########################################
1579 ## <summary>
1580 ##      Make the specified type usable in a
1581 ##      user home directory.
1582 ## </summary>
1583 ## <param name="type">
1584 ##      <summary>
1585 ##      Type to be used as a file in the
1586 ##      user home directory.
1587 ##      </summary>
1588 ## </param>
1589 #
1590 interface(`userdom_user_home_content',`
1591         gen_require(`
1592                 type user_home_t;
1593                 attribute user_home_type;
1594         ')
1595
1596         allow $1 user_home_t:filesystem associate;
1597         files_type($1)
1598         ubac_constrained($1)
1599
1600         files_poly_member($1)
1601         typeattribute $1  user_home_type;
1602 ')
1603
1604 ########################################
1605 ## <summary>
1606 ##      Make the specified type usable in a
1607 ##      generic temporary directory.
1608 ## </summary>
1609 ## <param name="type">
1610 ##      <summary>
1611 ##      Type to be used as a file in the
1612 ##      generic temporary directory.
1613 ##      </summary>
1614 ## </param>
1615 #
1616 interface(`userdom_user_tmp_content',`
1617         gen_require(`
1618                 attribute user_tmp_type;
1619         ')
1620
1621         typeattribute $1 user_tmp_type;
1622
1623         files_tmp_file($1)
1624         ubac_constrained($1)
1625 ')
1626
1627 ########################################
1628 ## <summary>
1629 ##      Make the specified type usable in a
1630 ##      generic tmpfs_t directory.
1631 ## </summary>
1632 ## <param name="type">
1633 ##      <summary>
1634 ##      Type to be used as a file in the
1635 ##      generic temporary directory.
1636 ##      </summary>
1637 ## </param>
1638 #
1639 interface(`userdom_user_tmpfs_content',`
1640         gen_require(`
1641                 attribute user_tmpfs_type;
1642         ')
1643
1644         typeattribute $1 user_tmpfs_type;
1645
1646         files_tmpfs_file($1)
1647         ubac_constrained($1)
1648 ')
1649
1650 ########################################
1651 ## <summary>
1652 ##      Allow domain to attach to TUN devices created by administrative users.
1653 ## </summary>
1654 ## <param name="domain">
1655 ##      <summary>
1656 ##      Domain allowed access.
1657 ##      </summary>
1658 ## </param>
1659 #
1660 interface(`userdom_attach_admin_tun_iface',`
1661         gen_require(`
1662                 attribute admindomain;
1663         ')
1664
1665         allow $1 admindomain:tun_socket relabelfrom;
1666         allow $1 self:tun_socket relabelto;
1667 ')
1668
1669 ########################################
1670 ## <summary>
1671 ##      Set the attributes of a user pty.
1672 ## </summary>
1673 ## <param name="domain">
1674 ##      <summary>
1675 ##      Domain allowed access.
1676 ##      </summary>
1677 ## </param>
1678 #
1679 interface(`userdom_setattr_user_ptys',`
1680         gen_require(`
1681                 type user_devpts_t;
1682         ')
1683
1684         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1685 ')
1686
1687 ########################################
1688 ## <summary>
1689 ##      Create a user pty.
1690 ## </summary>
1691 ## <param name="domain">
1692 ##      <summary>
1693 ##      Domain allowed access.
1694 ##      </summary>
1695 ## </param>
1696 #
1697 interface(`userdom_create_user_pty',`
1698         gen_require(`
1699                 type user_devpts_t;
1700         ')
1701
1702         term_create_pty($1, user_devpts_t)
1703 ')
1704
1705 ########################################
1706 ## <summary>
1707 ##      Get the attributes of user home directories.
1708 ## </summary>
1709 ## <param name="domain">
1710 ##      <summary>
1711 ##      Domain allowed access.
1712 ##      </summary>
1713 ## </param>
1714 #
1715 interface(`userdom_getattr_user_home_dirs',`
1716         gen_require(`
1717                 type user_home_dir_t;
1718         ')
1719
1720         allow $1 user_home_dir_t:dir getattr_dir_perms;
1721         files_search_home($1)
1722 ')
1723
1724 ########################################
1725 ## <summary>
1726 ##      Do not audit attempts to get the attributes of user home directories.
1727 ## </summary>
1728 ## <param name="domain">
1729 ##      <summary>
1730 ##      Domain to not audit.
1731 ##      </summary>
1732 ## </param>
1733 #
1734 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1735         gen_require(`
1736                 type user_home_dir_t;
1737         ')
1738
1739         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1740 ')
1741
1742 ########################################
1743 ## <summary>
1744 ##      Search user home directories.
1745 ## </summary>
1746 ## <param name="domain">
1747 ##      <summary>
1748 ##      Domain allowed access.
1749 ##      </summary>
1750 ## </param>
1751 #
1752 interface(`userdom_search_user_home_dirs',`
1753         gen_require(`
1754                 type user_home_dir_t;
1755         ')
1756
1757         allow $1 user_home_dir_t:dir search_dir_perms;
1758         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1759         files_search_home($1)
1760 ')
1761
1762 ########################################
1763 ## <summary>
1764 ##      Do not audit attempts to search user home directories.
1765 ## </summary>
1766 ## <desc>
1767 ##      <p>
1768 ##      Do not audit attempts to search user home directories.
1769 ##      This will supress SELinux denial messages when the specified
1770 ##      domain is denied the permission to search these directories.
1771 ##      </p>
1772 ## </desc>
1773 ## <param name="domain">
1774 ##      <summary>
1775 ##      Domain to not audit.
1776 ##      </summary>
1777 ## </param>
1778 ## <infoflow type="none"/>
1779 #
1780 interface(`userdom_dontaudit_search_user_home_dirs',`
1781         gen_require(`
1782                 type user_home_dir_t;
1783         ')
1784
1785         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1786 ')
1787
1788 ########################################
1789 ## <summary>
1790 ##      List user home directories.
1791 ## </summary>
1792 ## <param name="domain">
1793 ##      <summary>
1794 ##      Domain allowed access.
1795 ##      </summary>
1796 ## </param>
1797 #
1798 interface(`userdom_list_user_home_dirs',`
1799         gen_require(`
1800                 type user_home_dir_t;
1801         ')
1802
1803         allow $1 user_home_dir_t:dir list_dir_perms;
1804         files_search_home($1)
1805
1806         tunable_policy(`use_nfs_home_dirs',`
1807                 fs_list_nfs($1)
1808         ')
1809
1810         tunable_policy(`use_samba_home_dirs',`
1811                 fs_list_cifs($1)
1812         ')
1813 ')
1814
1815 ########################################
1816 ## <summary>
1817 ##      Do not audit attempts to list user home subdirectories.
1818 ## </summary>
1819 ## <param name="domain">
1820 ##      <summary>
1821 ##      Domain to not audit.
1822 ##      </summary>
1823 ## </param>
1824 #
1825 interface(`userdom_dontaudit_list_user_home_dirs',`
1826         gen_require(`
1827                 type user_home_dir_t;
1828                 type user_home_t;
1829         ')
1830
1831         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1832         dontaudit $1 user_home_t:dir list_dir_perms;
1833 ')
1834
1835 ########################################
1836 ## <summary>
1837 ##      Create user home directories.
1838 ## </summary>
1839 ## <param name="domain">
1840 ##      <summary>
1841 ##      Domain allowed access.
1842 ##      </summary>
1843 ## </param>
1844 #
1845 interface(`userdom_create_user_home_dirs',`
1846         gen_require(`
1847                 type user_home_dir_t;
1848         ')
1849
1850         allow $1 user_home_dir_t:dir create_dir_perms;
1851 ')
1852
1853 ########################################
1854 ## <summary>
1855 ##      Create user home directories.
1856 ## </summary>
1857 ## <param name="domain">
1858 ##      <summary>
1859 ##      Domain allowed access.
1860 ##      </summary>
1861 ## </param>
1862 #
1863 interface(`userdom_manage_user_home_dirs',`
1864         gen_require(`
1865                 type user_home_dir_t;
1866         ')
1867
1868         allow $1 user_home_dir_t:dir manage_dir_perms;
1869 ')
1870
1871 ########################################
1872 ## <summary>
1873 ##      Relabel to user home directories.
1874 ## </summary>
1875 ## <param name="domain">
1876 ##      <summary>
1877 ##      Domain allowed access.
1878 ##      </summary>
1879 ## </param>
1880 #
1881 interface(`userdom_relabelto_user_home_dirs',`
1882         gen_require(`
1883                 type user_home_dir_t;
1884         ')
1885
1886         allow $1 user_home_dir_t:dir relabelto;
1887 ')
1888
1889
1890 ########################################
1891 ## <summary>
1892 ##      Relabel to user home files.
1893 ## </summary>
1894 ## <param name="domain">
1895 ##      <summary>
1896 ##      Domain allowed access.
1897 ##      </summary>
1898 ## </param>
1899 #
1900 interface(`userdom_relabelto_user_home_files',`
1901         gen_require(`
1902                 type user_home_t;
1903         ')
1904
1905         allow $1 user_home_t:file relabelto;
1906 ')
1907 ########################################
1908 ## <summary>
1909 ##      Relabel user home files.
1910 ## </summary>
1911 ## <param name="domain">
1912 ##      <summary>
1913 ##      Domain allowed access.
1914 ##      </summary>
1915 ## </param>
1916 #
1917 interface(`userdom_relabel_user_home_files',`
1918         gen_require(`
1919                 type user_home_t;
1920         ')
1921
1922         allow $1 user_home_t:file relabel_file_perms;
1923 ')
1924
1925 ########################################
1926 ## <summary>
1927 ##      Create directories in the home dir root with
1928 ##      the user home directory type.
1929 ## </summary>
1930 ## <param name="domain">
1931 ##      <summary>
1932 ##      Domain allowed access.
1933 ##      </summary>
1934 ## </param>
1935 #
1936 interface(`userdom_home_filetrans_user_home_dir',`
1937         gen_require(`
1938                 type user_home_dir_t;
1939         ')
1940
1941         files_home_filetrans($1, user_home_dir_t, dir)
1942 ')
1943
1944 ########################################
1945 ## <summary>
1946 ##      Do a domain transition to the specified
1947 ##      domain when executing a program in the
1948 ##      user home directory.
1949 ## </summary>
1950 ## <desc>
1951 ##      <p>
1952 ##      Do a domain transition to the specified
1953 ##      domain when executing a program in the
1954 ##      user home directory.
1955 ##      </p>
1956 ##      <p>
1957 ##      No interprocess communication (signals, pipes,
1958 ##      etc.) is provided by this interface since
1959 ##      the domains are not owned by this module.
1960 ##      </p>
1961 ## </desc>
1962 ## <param name="source_domain">
1963 ##      <summary>
1964 ##      Domain allowed to transition.
1965 ##      </summary>
1966 ## </param>
1967 ## <param name="target_domain">
1968 ##      <summary>
1969 ##      Domain to transition to.
1970 ##      </summary>
1971 ## </param>
1972 #
1973 interface(`userdom_user_home_domtrans',`
1974         gen_require(`
1975                 type user_home_dir_t, user_home_t;
1976         ')
1977
1978         domain_auto_trans($1, user_home_t, $2)
1979         allow $1 user_home_dir_t:dir search_dir_perms;
1980         files_search_home($1)
1981 ')
1982
1983 ########################################
1984 ## <summary>
1985 ##      Do not audit attempts to search user home content directories.
1986 ## </summary>
1987 ## <param name="domain">
1988 ##      <summary>
1989 ##      Domain to not audit.
1990 ##      </summary>
1991 ## </param>
1992 #
1993 interface(`userdom_dontaudit_search_user_home_content',`
1994         gen_require(`
1995                 type user_home_t;
1996         ')
1997
1998         dontaudit $1 user_home_t:dir search_dir_perms;
1999         fs_dontaudit_list_nfs($1)
2000         fs_dontaudit_list_cifs($1)
2001 ')
2002
2003 ########################################
2004 ## <summary>
2005 ##      List contents of users home directory.
2006 ## </summary>
2007 ## <param name="domain">
2008 ##      <summary>
2009 ##      Domain allowed access.
2010 ##      </summary>
2011 ## </param>
2012 #
2013 interface(`userdom_list_user_home_content',`
2014         gen_require(`
2015                 type user_home_dir_t;
2016                 attribute user_home_type;
2017         ')
2018
2019         files_list_home($1)
2020         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2021 ')
2022
2023 ########################################
2024 ## <summary>
2025 ##      Create, read, write, and delete directories
2026 ##      in a user home subdirectory.
2027 ## </summary>
2028 ## <param name="domain">
2029 ##      <summary>
2030 ##      Domain allowed access.
2031 ##      </summary>
2032 ## </param>
2033 #
2034 interface(`userdom_manage_user_home_content_dirs',`
2035         gen_require(`
2036                 type user_home_dir_t, user_home_t;
2037         ')
2038
2039         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2040         files_search_home($1)
2041 ')
2042
2043 ########################################
2044 ## <summary>
2045 ##      Delete directories in a user home subdirectory.
2046 ## </summary>
2047 ## <param name="domain">
2048 ##      <summary>
2049 ##      Domain allowed access.
2050 ##      </summary>
2051 ## </param>
2052 #
2053 interface(`userdom_delete_user_home_content_dirs',`
2054         gen_require(`
2055                 type user_home_t;
2056         ')
2057
2058         allow $1 user_home_t:dir delete_dir_perms;
2059 ')
2060
2061 ########################################
2062 ## <summary>
2063 ##      Delete all directories in a user home subdirectory.
2064 ## </summary>
2065 ## <param name="domain">
2066 ##      <summary>
2067 ##      Domain allowed access.
2068 ##      </summary>
2069 ## </param>
2070 #
2071 interface(`userdom_delete_all_user_home_content_dirs',`
2072         gen_require(`
2073                 attribute user_home_type;
2074         ')
2075
2076         allow $1 user_home_type:dir delete_dir_perms;
2077 ')
2078
2079 ########################################
2080 ## <summary>
2081 ##      Set the attributes of user home files.
2082 ## </summary>
2083 ## <param name="domain">
2084 ##      <summary>
2085 ##      Domain allowed access.
2086 ##      </summary>
2087 ## </param>
2088 ## <rolecap/>
2089 #
2090 interface(`userdom_setattr_user_home_content_files',`
2091         gen_require(`
2092                 type user_home_t;
2093         ')
2094
2095         allow $1 user_home_t:file setattr;
2096 ')
2097
2098 ########################################
2099 ## <summary>
2100 ##      Do not audit attempts to set the
2101 ##      attributes of user home files.
2102 ## </summary>
2103 ## <param name="domain">
2104 ##      <summary>
2105 ##      Domain to not audit.
2106 ##      </summary>
2107 ## </param>
2108 #
2109 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2110         gen_require(`
2111                 type user_home_t;
2112         ')
2113
2114         dontaudit $1 user_home_t:file setattr_file_perms;
2115 ')
2116
2117 ########################################
2118 ## <summary>
2119 ##      Set the attributes of all user home directories.
2120 ## </summary>
2121 ## <param name="domain">
2122 ##      <summary>
2123 ##      Domain allowed access.
2124 ##      </summary>
2125 ## </param>
2126 ## <rolecap/>
2127 #
2128 interface(`userdom_setattr_all_user_home_content_dirs',`
2129         gen_require(`
2130                 attribute user_home_type;
2131         ')
2132
2133         allow $1 user_home_type:dir setattr_dir_perms;
2134 ')
2135
2136 ########################################
2137 ## <summary>
2138 ##      Mmap user home files.
2139 ## </summary>
2140 ## <param name="domain">
2141 ##      <summary>
2142 ##      Domain allowed access.
2143 ##      </summary>
2144 ## </param>
2145 #
2146 interface(`userdom_mmap_user_home_content_files',`
2147         gen_require(`
2148                 type user_home_dir_t, user_home_t;
2149         ')
2150
2151         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2152         files_search_home($1)
2153 ')
2154
2155 ########################################
2156 ## <summary>
2157 ##      Read user home files.
2158 ## </summary>
2159 ## <param name="domain">
2160 ##      <summary>
2161 ##      Domain allowed access.
2162 ##      </summary>
2163 ## </param>
2164 #
2165 interface(`userdom_read_user_home_content_files',`
2166         gen_require(`
2167                 type user_home_dir_t, user_home_t;
2168         ')
2169
2170         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2171         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2172         files_search_home($1)
2173 ')
2174
2175 ########################################
2176 ## <summary>
2177 ##      Do not audit attempts to getattr user home files.
2178 ## </summary>
2179 ## <param name="domain">
2180 ##      <summary>
2181 ##      Domain to not audit.
2182 ##      </summary>
2183 ## </param>
2184 #
2185 interface(`userdom_dontaudit_getattr_user_home_content',`
2186         gen_require(`
2187                 attribute user_home_type;
2188         ')
2189
2190         dontaudit $1 user_home_type:dir getattr;
2191         dontaudit $1 user_home_type:file getattr;
2192 ')
2193
2194 ########################################
2195 ## <summary>
2196 ##      Do not audit attempts to read user home files.
2197 ## </summary>
2198 ## <param name="domain">
2199 ##      <summary>
2200 ##      Domain to not audit.
2201 ##      </summary>
2202 ## </param>
2203 #
2204 interface(`userdom_dontaudit_read_user_home_content_files',`
2205         gen_require(`
2206                 attribute user_home_type;
2207                 type user_home_dir_t;
2208         ')
2209
2210         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2211         dontaudit $1 user_home_type:dir list_dir_perms;
2212         dontaudit $1 user_home_type:file read_file_perms;
2213         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2214 ')
2215
2216 ########################################
2217 ## <summary>
2218 ##      Do not audit attempts to append user home files.
2219 ## </summary>
2220 ## <param name="domain">
2221 ##      <summary>
2222 ##      Domain to not audit.
2223 ##      </summary>
2224 ## </param>
2225 #
2226 interface(`userdom_dontaudit_append_user_home_content_files',`
2227         gen_require(`
2228                 type user_home_t;
2229         ')
2230
2231         dontaudit $1 user_home_t:file append_file_perms;
2232 ')
2233
2234 ########################################
2235 ## <summary>
2236 ##      Do not audit attempts to write user home files.
2237 ## </summary>
2238 ## <param name="domain">
2239 ##      <summary>
2240 ##      Domain to not audit.
2241 ##      </summary>
2242 ## </param>
2243 #
2244 interface(`userdom_dontaudit_write_user_home_content_files',`
2245         gen_require(`
2246                 type user_home_t;
2247         ')
2248
2249         dontaudit $1 user_home_t:file write_file_perms;
2250 ')
2251
2252 ########################################
2253 ## <summary>
2254 ##      Delete files in a user home subdirectory.
2255 ## </summary>
2256 ## <param name="domain">
2257 ##      <summary>
2258 ##      Domain allowed access.
2259 ##      </summary>
2260 ## </param>
2261 #
2262 interface(`userdom_delete_user_home_content_files',`
2263         gen_require(`
2264                 type user_home_t;
2265         ')
2266
2267         allow $1 user_home_t:file delete_file_perms;
2268 ')
2269
2270 ########################################
2271 ## <summary>
2272 ##      Delete all files in a user home subdirectory.
2273 ## </summary>
2274 ## <param name="domain">
2275 ##      <summary>
2276 ##      Domain allowed access.
2277 ##      </summary>
2278 ## </param>
2279 #
2280 interface(`userdom_delete_all_user_home_content_files',`
2281         gen_require(`
2282                 attribute user_home_type;
2283         ')
2284
2285         allow $1 user_home_type:file delete_file_perms;
2286 ')
2287
2288 ########################################
2289 ## <summary>
2290 ##      Delete sock files in a user home subdirectory.
2291 ## </summary>
2292 ## <param name="domain">
2293 ##      <summary>
2294 ##      Domain allowed access.
2295 ##      </summary>
2296 ## </param>
2297 #
2298 interface(`userdom_delete_user_home_content_sock_files',`
2299         gen_require(`
2300                 type user_home_t;
2301         ')
2302
2303         allow $1 user_home_t:sock_file delete_file_perms;
2304 ')
2305
2306 ########################################
2307 ## <summary>
2308 ##      Delete all sock files in a user home subdirectory.
2309 ## </summary>
2310 ## <param name="domain">
2311 ##      <summary>
2312 ##      Domain allowed access.
2313 ##      </summary>
2314 ## </param>
2315 #
2316 interface(`userdom_delete_all_user_home_content_sock_files',`
2317         gen_require(`
2318                 attribute user_home_type;
2319         ')
2320
2321         allow $1 user_home_type:sock_file delete_file_perms;
2322 ')
2323
2324 ########################################
2325 ## <summary>
2326 ##      Do not audit attempts to write user home files.
2327 ## </summary>
2328 ## <param name="domain">
2329 ##      <summary>
2330 ##      Domain to not audit.
2331 ##      </summary>
2332 ## </param>
2333 #
2334 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2335         gen_require(`
2336                 type user_home_t;
2337         ')
2338
2339         dontaudit $1 user_home_t:file relabel_file_perms;
2340 ')
2341
2342 ########################################
2343 ## <summary>
2344 ##      Read user home subdirectory symbolic links.
2345 ## </summary>
2346 ## <param name="domain">
2347 ##      <summary>
2348 ##      Domain allowed access.
2349 ##      </summary>
2350 ## </param>
2351 #
2352 interface(`userdom_read_user_home_content_symlinks',`
2353         gen_require(`
2354                 type user_home_dir_t, user_home_t;
2355         ')
2356
2357         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2358 ')
2359
2360 ########################################
2361 ## <summary>
2362 ##      Execute user home files.
2363 ## </summary>
2364 ## <param name="domain">
2365 ##      <summary>
2366 ##      Domain allowed access.
2367 ##      </summary>
2368 ## </param>
2369 ## <rolecap/>
2370 #
2371 interface(`userdom_exec_user_home_content_files',`
2372         gen_require(`
2373                 type user_home_dir_t;
2374                 attribute user_home_type;
2375         ')
2376
2377         files_search_home($1)
2378         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2379         dontaudit $1 user_home_type:sock_file execute;
2380         ')
2381
2382 ########################################
2383 ## <summary>
2384 ##      Do not audit attempts to execute user home files.
2385 ## </summary>
2386 ## <param name="domain">
2387 ##      <summary>
2388 ##      Domain to not audit.
2389 ##      </summary>
2390 ## </param>
2391 #
2392 interface(`userdom_dontaudit_exec_user_home_content_files',`
2393         gen_require(`
2394                 type user_home_t;
2395         ')
2396
2397         dontaudit $1 user_home_t:file exec_file_perms;
2398 ')
2399
2400 ########################################
2401 ## <summary>
2402 ##      Create, read, write, and delete files
2403 ##      in a user home subdirectory.
2404 ## </summary>
2405 ## <param name="domain">
2406 ##      <summary>
2407 ##      Domain allowed access.
2408 ##      </summary>
2409 ## </param>
2410 #
2411 interface(`userdom_manage_user_home_content_files',`
2412         gen_require(`
2413                 type user_home_dir_t, user_home_t;
2414         ')
2415
2416         manage_files_pattern($1, user_home_t, user_home_t)
2417         allow $1 user_home_dir_t:dir search_dir_perms;
2418         files_search_home($1)
2419 ')
2420
2421 ########################################
2422 ## <summary>
2423 ##      Do not audit attempts to create, read, write, and delete directories
2424 ##      in a user home subdirectory.
2425 ## </summary>
2426 ## <param name="domain">
2427 ##      <summary>
2428 ##      Domain to not audit.
2429 ##      </summary>
2430 ## </param>
2431 #
2432 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2433         gen_require(`
2434                 type user_home_dir_t, user_home_t;
2435         ')
2436
2437         dontaudit $1 user_home_t:dir manage_dir_perms;
2438 ')
2439
2440 ########################################
2441 ## <summary>
2442 ##      Create, read, write, and delete symbolic links
2443 ##      in a user home subdirectory.
2444 ## </summary>
2445 ## <param name="domain">
2446 ##      <summary>
2447 ##      Domain allowed access.
2448 ##      </summary>
2449 ## </param>
2450 #
2451 interface(`userdom_manage_user_home_content_symlinks',`
2452         gen_require(`
2453                 type user_home_dir_t, user_home_t;
2454         ')
2455
2456         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2457         allow $1 user_home_dir_t:dir search_dir_perms;
2458         files_search_home($1)
2459 ')
2460
2461 ########################################
2462 ## <summary>
2463 ##      Delete symbolic links in a user home directory.
2464 ## </summary>
2465 ## <param name="domain">
2466 ##      <summary>
2467 ##      Domain allowed access.
2468 ##      </summary>
2469 ## </param>
2470 #
2471 interface(`userdom_delete_user_home_content_symlinks',`
2472         gen_require(`
2473                 type user_home_t;
2474         ')
2475
2476         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2477 ')
2478
2479 ########################################
2480 ## <summary>
2481 ##      Delete all symbolic links in a user home directory.
2482 ## </summary>
2483 ## <param name="domain">
2484 ##      <summary>
2485 ##      Domain allowed access.
2486 ##      </summary>
2487 ## </param>
2488 #
2489 interface(`userdom_delete_all_user_home_content_symlinks',`
2490         gen_require(`
2491                 attribute user_home_type;
2492         ')
2493
2494         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2495 ')
2496
2497 ########################################
2498 ## <summary>
2499 ##      Create, read, write, and delete named pipes
2500 ##      in a user home subdirectory.
2501 ## </summary>
2502 ## <param name="domain">
2503 ##      <summary>
2504 ##      Domain allowed access.
2505 ##      </summary>
2506 ## </param>
2507 #
2508 interface(`userdom_manage_user_home_content_pipes',`
2509         gen_require(`
2510                 type user_home_dir_t, user_home_t;
2511         ')
2512
2513         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2514         allow $1 user_home_dir_t:dir search_dir_perms;
2515         files_search_home($1)
2516 ')
2517
2518 ########################################
2519 ## <summary>
2520 ##      Create, read, write, and delete named sockets
2521 ##      in a user home subdirectory.
2522 ## </summary>
2523 ## <param name="domain">
2524 ##      <summary>
2525 ##      Domain allowed access.
2526 ##      </summary>
2527 ## </param>
2528 #
2529 interface(`userdom_manage_user_home_content_sockets',`
2530         gen_require(`
2531                 type user_home_dir_t, user_home_t;
2532         ')
2533
2534         allow $1 user_home_dir_t:dir search_dir_perms;
2535         manage_sock_files_pattern($1, user_home_t, user_home_t)
2536         files_search_home($1)
2537 ')
2538
2539 ########################################
2540 ## <summary>
2541 ##      Create objects in a user home directory
2542 ##      with an automatic type transition to
2543 ##      a specified private type.
2544 ## </summary>
2545 ## <param name="domain">
2546 ##      <summary>
2547 ##      Domain allowed access.
2548 ##      </summary>
2549 ## </param>
2550 ## <param name="private_type">
2551 ##      <summary>
2552 ##      The type of the object to create.
2553 ##      </summary>
2554 ## </param>
2555 ## <param name="object_class">
2556 ##      <summary>
2557 ##      The class of the object to be created.
2558 ##      </summary>
2559 ## </param>
2560 #
2561 interface(`userdom_user_home_dir_filetrans',`
2562         gen_require(`
2563                 type user_home_dir_t;
2564         ')
2565
2566         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2567         files_search_home($1)
2568 ')
2569
2570 ########################################
2571 ## <summary>
2572 ##      Create objects in a user home directory
2573 ##      with an automatic type transition to
2574 ##      a specified private type.
2575 ## </summary>
2576 ## <param name="domain">
2577 ##      <summary>
2578 ##      Domain allowed access.
2579 ##      </summary>
2580 ## </param>
2581 ## <param name="private_type">
2582 ##      <summary>
2583 ##      The type of the object to create.
2584 ##      </summary>
2585 ## </param>
2586 ## <param name="object_class">
2587 ##      <summary>
2588 ##      The class of the object to be created.
2589 ##      </summary>
2590 ## </param>
2591 #
2592 interface(`userdom_user_home_content_filetrans',`
2593         gen_require(`
2594                 type user_home_dir_t, user_home_t;
2595         ')
2596
2597         filetrans_pattern($1, user_home_t, $2, $3, $4)
2598         allow $1 user_home_dir_t:dir search_dir_perms;
2599         files_search_home($1)
2600 ')
2601
2602 ########################################
2603 ## <summary>
2604 ##      Create objects in a user home directory
2605 ##      with an automatic type transition to
2606 ##      the user home file type.
2607 ## </summary>
2608 ## <param name="domain">
2609 ##      <summary>
2610 ##      Domain allowed access.
2611 ##      </summary>
2612 ## </param>
2613 ## <param name="object_class">
2614 ##      <summary>
2615 ##      The class of the object to be created.
2616 ##      </summary>
2617 ## </param>
2618 #
2619 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2620         gen_require(`
2621                 type user_home_dir_t, user_home_t;
2622         ')
2623
2624         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2625         files_search_home($1)
2626 ')
2627
2628 ########################################
2629 ## <summary>
2630 ##      Write to user temporary named sockets.
2631 ## </summary>
2632 ## <param name="domain">
2633 ##      <summary>
2634 ##      Domain allowed access.
2635 ##      </summary>
2636 ## </param>
2637 #
2638 interface(`userdom_write_user_tmp_sockets',`
2639         gen_require(`
2640                 type user_tmp_t;
2641         ')
2642
2643         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2644         files_search_tmp($1)
2645 ')
2646
2647 ########################################
2648 ## <summary>
2649 ##      List user temporary directories.
2650 ## </summary>
2651 ## <param name="domain">
2652 ##      <summary>
2653 ##      Domain allowed access.
2654 ##      </summary>
2655 ## </param>
2656 #
2657 interface(`userdom_list_user_tmp',`
2658         gen_require(`
2659                 type user_tmp_t;
2660         ')
2661
2662         allow $1 user_tmp_t:dir list_dir_perms;
2663         files_search_tmp($1)
2664 ')
2665
2666 ########################################
2667 ## <summary>
2668 ##      Do not audit attempts to list user
2669 ##      temporary directories.
2670 ## </summary>
2671 ## <param name="domain">
2672 ##      <summary>
2673 ##      Domain to not audit.
2674 ##      </summary>
2675 ## </param>
2676 #
2677 interface(`userdom_dontaudit_list_user_tmp',`
2678         gen_require(`
2679                 type user_tmp_t;
2680         ')
2681
2682         dontaudit $1 user_tmp_t:dir list_dir_perms;
2683 ')
2684
2685 ########################################
2686 ## <summary>
2687 ##      Do not audit attempts to manage users
2688 ##      temporary directories.
2689 ## </summary>
2690 ## <param name="domain">
2691 ##      <summary>
2692 ##      Domain to not audit.
2693 ##      </summary>
2694 ## </param>
2695 #
2696 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2697         gen_require(`
2698                 type user_tmp_t;
2699         ')
2700
2701         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2702 ')
2703
2704 ########################################
2705 ## <summary>
2706 ##      Read user temporary files.
2707 ## </summary>
2708 ## <param name="domain">
2709 ##      <summary>
2710 ##      Domain allowed access.
2711 ##      </summary>
2712 ## </param>
2713 #
2714 interface(`userdom_read_user_tmp_files',`
2715         gen_require(`
2716                 type user_tmp_t;
2717         ')
2718
2719         read_files_pattern($1, user_tmp_t, user_tmp_t)
2720         allow $1 user_tmp_t:dir list_dir_perms;
2721         files_search_tmp($1)
2722 ')
2723
2724 ########################################
2725 ## <summary>
2726 ##      Do not audit attempts to read users
2727 ##      temporary files.
2728 ## </summary>
2729 ## <param name="domain">
2730 ##      <summary>
2731 ##      Domain to not audit.
2732 ##      </summary>
2733 ## </param>
2734 #
2735 interface(`userdom_dontaudit_read_user_tmp_files',`
2736         gen_require(`
2737                 type user_tmp_t;
2738         ')
2739
2740         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2741 ')
2742
2743 ########################################
2744 ## <summary>
2745 ##      Do not audit attempts to append users
2746 ##      temporary files.
2747 ## </summary>
2748 ## <param name="domain">
2749 ##      <summary>
2750 ##      Domain to not audit.
2751 ##      </summary>
2752 ## </param>
2753 #
2754 interface(`userdom_dontaudit_append_user_tmp_files',`
2755         gen_require(`
2756                 type user_tmp_t;
2757         ')
2758
2759         dontaudit $1 user_tmp_t:file append_file_perms;
2760 ')
2761
2762 ########################################
2763 ## <summary>
2764 ##      Read and write user temporary files.
2765 ## </summary>
2766 ## <param name="domain">
2767 ##      <summary>
2768 ##      Domain allowed access.
2769 ##      </summary>
2770 ## </param>
2771 #
2772 interface(`userdom_rw_user_tmp_files',`
2773         gen_require(`
2774                 type user_tmp_t;
2775         ')
2776
2777         allow $1 user_tmp_t:dir list_dir_perms;
2778         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2779         files_search_tmp($1)
2780 ')
2781
2782 ########################################
2783 ## <summary>
2784 ##      Do not audit attempts to manage users
2785 ##      temporary files.
2786 ## </summary>
2787 ## <param name="domain">
2788 ##      <summary>
2789 ##      Domain to not audit.
2790 ##      </summary>
2791 ## </param>
2792 #
2793 interface(`userdom_dontaudit_manage_user_tmp_files',`
2794         gen_require(`
2795                 type user_tmp_t;
2796         ')
2797
2798         dontaudit $1 user_tmp_t:file manage_file_perms;
2799 ')
2800
2801 ########################################
2802 ## <summary>
2803 ##      Read user temporary symbolic links.
2804 ## </summary>
2805 ## <param name="domain">
2806 ##      <summary>
2807 ##      Domain allowed access.
2808 ##      </summary>
2809 ## </param>
2810 #
2811 interface(`userdom_read_user_tmp_symlinks',`
2812         gen_require(`
2813                 type user_tmp_t;
2814         ')
2815
2816         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2817         allow $1 user_tmp_t:dir list_dir_perms;
2818         files_search_tmp($1)
2819 ')
2820
2821 ########################################
2822 ## <summary>
2823 ##      Create, read, write, and delete user
2824 ##      temporary directories.
2825 ## </summary>
2826 ## <param name="domain">
2827 ##      <summary>
2828 ##      Domain allowed access.
2829 ##      </summary>
2830 ## </param>
2831 #
2832 interface(`userdom_manage_user_tmp_dirs',`
2833         gen_require(`
2834                 type user_tmp_t;
2835         ')
2836
2837         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2838         files_search_tmp($1)
2839 ')
2840
2841 ########################################
2842 ## <summary>
2843 ##      Create, read, write, and delete user
2844 ##      temporary files.
2845 ## </summary>
2846 ## <param name="domain">
2847 ##      <summary>
2848 ##      Domain allowed access.
2849 ##      </summary>
2850 ## </param>
2851 #
2852 interface(`userdom_manage_user_tmp_files',`
2853         gen_require(`
2854                 type user_tmp_t;
2855         ')
2856
2857         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2858         files_search_tmp($1)
2859 ')
2860
2861 ########################################
2862 ## <summary>
2863 ##      Create, read, write, and delete user
2864 ##      temporary symbolic links.
2865 ## </summary>
2866 ## <param name="domain">
2867 ##      <summary>
2868 ##      Domain allowed access.
2869 ##      </summary>
2870 ## </param>
2871 #
2872 interface(`userdom_manage_user_tmp_symlinks',`
2873         gen_require(`
2874                 type user_tmp_t;
2875         ')
2876
2877         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2878         files_search_tmp($1)
2879 ')
2880
2881 ########################################
2882 ## <summary>
2883 ##      Create, read, write, and delete user
2884 ##      temporary named pipes.
2885 ## </summary>
2886 ## <param name="domain">
2887 ##      <summary>
2888 ##      Domain allowed access.
2889 ##      </summary>
2890 ## </param>
2891 #
2892 interface(`userdom_manage_user_tmp_pipes',`
2893         gen_require(`
2894                 type user_tmp_t;
2895         ')
2896
2897         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2898         files_search_tmp($1)
2899 ')
2900
2901 ########################################
2902 ## <summary>
2903 ##      Create, read, write, and delete user
2904 ##      temporary named sockets.
2905 ## </summary>
2906 ## <param name="domain">
2907 ##      <summary>
2908 ##      Domain allowed access.
2909 ##      </summary>
2910 ## </param>
2911 #
2912 interface(`userdom_manage_user_tmp_sockets',`
2913         gen_require(`
2914                 type user_tmp_t;
2915         ')
2916
2917         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2918         files_search_tmp($1)
2919 ')
2920
2921 ########################################
2922 ## <summary>
2923 ##      Create objects in a user temporary directory
2924 ##      with an automatic type transition to
2925 ##      a specified private type.
2926 ## </summary>
2927 ## <param name="domain">
2928 ##      <summary>
2929 ##      Domain allowed access.
2930 ##      </summary>
2931 ## </param>
2932 ## <param name="private_type">
2933 ##      <summary>
2934 ##      The type of the object to create.
2935 ##      </summary>
2936 ## </param>
2937 ## <param name="object_class">
2938 ##      <summary>
2939 ##      The class of the object to be created.
2940 ##      </summary>
2941 ## </param>
2942 #
2943 interface(`userdom_user_tmp_filetrans',`
2944         gen_require(`
2945                 type user_tmp_t;
2946         ')
2947
2948         filetrans_pattern($1, user_tmp_t, $2, $3, $4)
2949         files_search_tmp($1)
2950 ')
2951
2952 ########################################
2953 ## <summary>
2954 ##      Create objects in the temporary directory
2955 ##      with an automatic type transition to
2956 ##      the user temporary type.
2957 ## </summary>
2958 ## <param name="domain">
2959 ##      <summary>
2960 ##      Domain allowed access.
2961 ##      </summary>
2962 ## </param>
2963 ## <param name="object_class">
2964 ##      <summary>
2965 ##      The class of the object to be created.
2966 ##      </summary>
2967 ## </param>
2968 #
2969 interface(`userdom_tmp_filetrans_user_tmp',`
2970         gen_require(`
2971                 type user_tmp_t;
2972         ')
2973
2974         files_tmp_filetrans($1, user_tmp_t, $2)
2975 ')
2976
2977 #######################################
2978 ## <summary>
2979 ##  Getattr user tmpfs files.
2980 ## </summary>
2981 ## <param name="domain">
2982 ##  <summary>
2983 ##  Domain allowed access.
2984 ##  </summary>
2985 ## </param>
2986 #
2987 interface(`userdom_getattr_user_tmpfs_files',`
2988     gen_require(`
2989         type user_tmpfs_t;
2990     ')
2991
2992     getattr_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
2993     fs_search_tmpfs($1)
2994 ')
2995
2996 ########################################
2997 ## <summary>
2998 ##      Read user tmpfs files.
2999 ## </summary>
3000 ## <param name="domain">
3001 ##      <summary>
3002 ##      Domain allowed access.
3003 ##      </summary>
3004 ## </param>
3005 #
3006 interface(`userdom_read_user_tmpfs_files',`
3007         gen_require(`
3008                 type user_tmpfs_t;
3009         ')
3010
3011         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3012         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3013         allow $1 user_tmpfs_t:dir list_dir_perms;
3014         fs_search_tmpfs($1)
3015 ')
3016
3017 ########################################
3018 ## <summary>
3019 ##      Read/Write user tmpfs files.
3020 ## </summary>
3021 ## <param name="domain">
3022 ##      <summary>
3023 ##      Domain allowed access.
3024 ##      </summary>
3025 ## </param>
3026 #
3027 interface(`userdom_rw_user_tmpfs_files',`
3028         gen_require(`
3029                 type user_tmpfs_t;
3030         ')
3031
3032         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3033         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3034         allow $1 user_tmpfs_t:dir list_dir_perms;
3035         fs_search_tmpfs($1)
3036 ')
3037
3038 ########################################
3039 ## <summary>
3040 ##      Read/Write inherited user tmpfs files.
3041 ## </summary>
3042 ## <param name="domain">
3043 ##      <summary>
3044 ##      Domain allowed access.
3045 ##      </summary>
3046 ## </param>
3047 #
3048 interface(`userdom_rw_inherited_user_tmpfs_files',`
3049         gen_require(`
3050                 type user_tmpfs_t;
3051         ')
3052
3053         allow $1 user_tmpfs_t:file rw_inherited_file_perms;
3054 ')
3055
3056 ########################################
3057 ## <summary>
3058 ##      Execute user tmpfs files.
3059 ## </summary>
3060 ## <param name="domain">
3061 ##      <summary>
3062 ##      Domain allowed access.
3063 ##      </summary>
3064 ## </param>
3065 #
3066 interface(`userdom_execute_user_tmpfs_files',`
3067         gen_require(`
3068                 type user_tmpfs_t;
3069         ')
3070
3071         allow $1 user_tmpfs_t:file execute;
3072 ')
3073
3074 ########################################
3075 ## <summary>
3076 ##      Get the attributes of a user domain tty.
3077 ## </summary>
3078 ## <param name="domain">
3079 ##      <summary>
3080 ##      Domain allowed access.
3081 ##      </summary>
3082 ## </param>
3083 #
3084 interface(`userdom_getattr_user_ttys',`
3085         gen_require(`
3086                 type user_tty_device_t;
3087         ')
3088
3089         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3090 ')
3091
3092 ########################################
3093 ## <summary>
3094 ##      Do not audit attempts to get the attributes of a user domain tty.
3095 ## </summary>
3096 ## <param name="domain">
3097 ##      <summary>
3098 ##      Domain to not audit.
3099 ##      </summary>
3100 ## </param>
3101 #
3102 interface(`userdom_dontaudit_getattr_user_ttys',`
3103         gen_require(`
3104                 type user_tty_device_t;
3105         ')
3106
3107         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3108 ')
3109
3110 ########################################
3111 ## <summary>
3112 ##      Set the attributes of a user domain tty.
3113 ## </summary>
3114 ## <param name="domain">
3115 ##      <summary>
3116 ##      Domain allowed access.
3117 ##      </summary>
3118 ## </param>
3119 #
3120 interface(`userdom_setattr_user_ttys',`
3121         gen_require(`
3122                 type user_tty_device_t;
3123         ')
3124
3125         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3126 ')
3127
3128 ########################################
3129 ## <summary>
3130 ##      Do not audit attempts to set the attributes of a user domain tty.
3131 ## </summary>
3132 ## <param name="domain">
3133 ##      <summary>
3134 ##      Domain to not audit.
3135 ##      </summary>
3136 ## </param>
3137 #
3138 interface(`userdom_dontaudit_setattr_user_ttys',`
3139         gen_require(`
3140                 type user_tty_device_t;
3141         ')
3142
3143         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3144 ')
3145
3146 ########################################
3147 ## <summary>
3148 ##      Read and write a user domain tty.
3149 ## </summary>
3150 ## <param name="domain">
3151 ##      <summary>
3152 ##      Domain allowed access.
3153 ##      </summary>
3154 ## </param>
3155 #
3156 interface(`userdom_use_user_ttys',`
3157         gen_require(`
3158                 type user_tty_device_t;
3159         ')
3160
3161         allow $1 user_tty_device_t:chr_file rw_term_perms;
3162 ')
3163
3164 ########################################
3165 ## <summary>
3166 ##      Read and write a inherited user domain tty.
3167 ## </summary>
3168 ## <param name="domain">
3169 ##      <summary>
3170 ##      Domain allowed access.
3171 ##      </summary>
3172 ## </param>
3173 #
3174 interface(`userdom_use_inherited_user_ttys',`
3175         gen_require(`
3176                 type user_tty_device_t;
3177         ')
3178
3179         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3180 ')
3181
3182 ########################################
3183 ## <summary>
3184 ##      Read and write a user domain pty.
3185 ## </summary>
3186 ## <param name="domain">
3187 ##      <summary>
3188 ##      Domain allowed access.
3189 ##      </summary>
3190 ## </param>
3191 #
3192 interface(`userdom_use_user_ptys',`
3193         gen_require(`
3194                 type user_devpts_t;
3195         ')
3196
3197         allow $1 user_devpts_t:chr_file rw_term_perms;
3198 ')
3199
3200 ########################################
3201 ## <summary>
3202 ##      Read and write a inherited user domain pty.
3203 ## </summary>
3204 ## <param name="domain">
3205 ##      <summary>
3206 ##      Domain allowed access.
3207 ##      </summary>
3208 ## </param>
3209 #
3210 interface(`userdom_use_inherited_user_ptys',`
3211         gen_require(`
3212                 type user_devpts_t;
3213         ')
3214
3215         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3216 ')
3217
3218 ########################################
3219 ## <summary>
3220 ##      Read and write a inherited user TTYs and PTYs.
3221 ## </summary>
3222 ## <desc>
3223 ##      <p>
3224 ##      Allow the specified domain to read and write inherited user
3225 ##      TTYs and PTYs. This will allow the domain to
3226 ##      interact with the user via the terminal. Typically
3227 ##      all interactive applications will require this
3228 ##      access.
3229 ##      </p>
3230 ## </desc>
3231 ## <param name="domain">
3232 ##      <summary>
3233 ##      Domain allowed access.
3234 ##      </summary>
3235 ## </param>
3236 ## <infoflow type="both" weight="10"/>
3237 #
3238 interface(`userdom_use_inherited_user_terminals',`
3239         gen_require(`
3240                 type user_tty_device_t, user_devpts_t;
3241         ')
3242
3243         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3244         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3245 ')
3246
3247 #######################################
3248 ## <summary>
3249 ##  Allow attempts to read and write
3250 ##  a user domain tty and pty.
3251 ## </summary>
3252 ## <param name="domain">
3253 ##  <summary>
3254 ##  Domain to not audit.
3255 ##  </summary>
3256 ## </param>
3257 #
3258 interface(`userdom_use_user_terminals',`
3259     gen_require(`
3260         type user_tty_device_t, user_devpts_t;
3261     ')
3262
3263     allow $1 user_tty_device_t:chr_file rw_term_perms;
3264     allow $1 user_devpts_t:chr_file rw_term_perms;
3265 ')
3266
3267 ########################################
3268 ## <summary>
3269 ##      Do not audit attempts to read and write
3270 ##      a user domain tty and pty.
3271 ## </summary>
3272 ## <param name="domain">
3273 ##      <summary>
3274 ##      Domain to not audit.
3275 ##      </summary>
3276 ## </param>
3277 #
3278 interface(`userdom_dontaudit_use_user_terminals',`
3279         gen_require(`
3280                 type user_tty_device_t, user_devpts_t;
3281         ')
3282
3283         dontaudit $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3284         dontaudit $1 user_devpts_t:chr_file rw_inherited_term_perms;
3285 ')
3286
3287
3288 ########################################
3289 ## <summary>
3290 ##      Get attributes of user domain tty and pty.
3291 ## </summary>
3292 ## <param name="domain">
3293 ##      <summary>
3294 ##      Domain allowed access.
3295 ##      </summary>
3296 ## </param>
3297 #
3298 interface(`userdom_getattr_user_terminals',`
3299         gen_require(`
3300                 type user_tty_device_t, user_devpts_t;
3301         ')
3302
3303         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3304 ')
3305
3306 ########################################
3307 ## <summary>
3308 ##      Execute a shell in all user domains.  This
3309 ##      is an explicit transition, requiring the
3310 ##      caller to use setexeccon().
3311 ## </summary>
3312 ## <param name="domain">
3313 ##      <summary>
3314 ##      Domain allowed to transition.
3315 ##      </summary>
3316 ## </param>
3317 #
3318 interface(`userdom_spec_domtrans_all_users',`
3319         gen_require(`
3320                 attribute userdomain;
3321         ')
3322
3323         corecmd_shell_spec_domtrans($1, userdomain)
3324         allow userdomain $1:fd use;
3325         allow userdomain $1:fifo_file rw_file_perms;
3326         allow userdomain $1:process sigchld;
3327 ')
3328
3329 ########################################
3330 ## <summary>
3331 ##      Execute an Xserver session in all unprivileged user domains.  This
3332 ##      is an explicit transition, requiring the
3333 ##      caller to use setexeccon().
3334 ## </summary>
3335 ## <param name="domain">
3336 ##      <summary>
3337 ##      Domain allowed to transition.
3338 ##      </summary>
3339 ## </param>
3340 #
3341 interface(`userdom_xsession_spec_domtrans_all_users',`
3342         gen_require(`
3343                 attribute userdomain;
3344         ')
3345
3346         xserver_xsession_spec_domtrans($1, userdomain)
3347         allow userdomain $1:fd use;
3348         allow userdomain $1:fifo_file rw_file_perms;
3349         allow userdomain $1:process sigchld;
3350 ')
3351
3352 ########################################
3353 ## <summary>
3354 ##      Execute a shell in all unprivileged user domains.  This
3355 ##      is an explicit transition, requiring the
3356 ##      caller to use setexeccon().
3357 ## </summary>
3358 ## <param name="domain">
3359 ##      <summary>
3360 ##      Domain allowed to transition.
3361 ##      </summary>
3362 ## </param>
3363 #
3364 interface(`userdom_spec_domtrans_unpriv_users',`
3365         gen_require(`
3366                 attribute unpriv_userdomain;
3367         ')
3368
3369         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3370         allow unpriv_userdomain $1:fd use;
3371         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3372         allow unpriv_userdomain $1:process sigchld;
3373 ')
3374
3375 #####################################
3376 ## <summary>
3377 ##  Allow domain dyntrans to unpriv userdomain.
3378 ## </summary>
3379 ## <param name="domain">
3380 ##  <summary>
3381 ##  Domain allowed access.
3382 ##  </summary>
3383 ## </param>
3384 #
3385 interface(`userdom_dyntransition_unpriv_users',`
3386     gen_require(`
3387         attribute unpriv_userdomain;
3388     ')
3389
3390     allow $1 unpriv_userdomain:process dyntransition;
3391 ')
3392
3393 ########################################
3394 ## <summary>
3395 ##      Execute an Xserver session in all unprivileged user domains.  This
3396 ##      is an explicit transition, requiring the
3397 ##      caller to use setexeccon().
3398 ## </summary>
3399 ## <param name="domain">
3400 ##      <summary>
3401 ##      Domain allowed to transition.
3402 ##      </summary>
3403 ## </param>
3404 #
3405 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3406         gen_require(`
3407                 attribute unpriv_userdomain;
3408         ')
3409
3410         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3411         allow unpriv_userdomain $1:fd use;
3412         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3413         allow unpriv_userdomain $1:process sigchld;
3414 ')
3415
3416 ########################################
3417 ## <summary>
3418 ##      Manage unpriviledged user SysV sempaphores.
3419 ## </summary>
3420 ## <param name="domain">
3421 ##      <summary>
3422 ##      Domain allowed access.
3423 ##      </summary>
3424 ## </param>
3425 #
3426 interface(`userdom_manage_unpriv_user_semaphores',`
3427         gen_require(`
3428                 attribute unpriv_userdomain;
3429         ')
3430
3431         allow $1 unpriv_userdomain:sem create_sem_perms;
3432 ')
3433
3434 ########################################
3435 ## <summary>
3436 ##      Manage unpriviledged user SysV shared
3437 ##      memory segments.
3438 ## </summary>
3439 ## <param name="domain">
3440 ##      <summary>
3441 ##      Domain allowed access.
3442 ##      </summary>
3443 ## </param>
3444 #
3445 interface(`userdom_manage_unpriv_user_shared_mem',`
3446         gen_require(`
3447                 attribute unpriv_userdomain;
3448         ')
3449
3450         allow $1 unpriv_userdomain:shm create_shm_perms;
3451 ')
3452
3453 ########################################
3454 ## <summary>
3455 ##      Execute bin_t in the unprivileged user domains. This
3456 ##      is an explicit transition, requiring the
3457 ##      caller to use setexeccon().
3458 ## </summary>
3459 ## <param name="domain">
3460 ##      <summary>
3461 ##      Domain allowed to transition.
3462 ##      </summary>
3463 ## </param>
3464 #
3465 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3466         gen_require(`
3467                 attribute unpriv_userdomain;
3468         ')
3469
3470         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3471         allow unpriv_userdomain $1:fd use;
3472         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3473         allow unpriv_userdomain $1:process sigchld;
3474 ')
3475
3476 ########################################
3477 ## <summary>
3478 ##      Execute all entrypoint files in unprivileged user
3479 ##      domains. This is an explicit transition, requiring the
3480 ##      caller to use setexeccon().
3481 ## </summary>
3482 ## <param name="domain">
3483 ##      <summary>
3484 ##      Domain allowed access.
3485 ##      </summary>
3486 ## </param>
3487 #
3488 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3489         gen_require(`
3490                 attribute unpriv_userdomain;
3491         ')
3492
3493         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3494         allow unpriv_userdomain $1:fd use;
3495         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3496         allow unpriv_userdomain $1:process sigchld;
3497 ')
3498
3499 ########################################
3500 ## <summary>
3501 ##      Search users home directories.
3502 ## </summary>
3503 ## <param name="domain">
3504 ##      <summary>
3505 ##      Domain allowed access.
3506 ##      </summary>
3507 ## </param>
3508 #
3509 interface(`userdom_search_user_home_content',`
3510         gen_require(`
3511                 type user_home_dir_t;
3512                 attribute user_home_type;
3513         ')
3514
3515         files_list_home($1)
3516         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3517         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3518 ')
3519
3520 ########################################
3521 ## <summary>
3522 ##      Send general signals to unprivileged user domains.
3523 ## </summary>
3524 ## <param name="domain">
3525 ##      <summary>
3526 ##      Domain allowed access.
3527 ##      </summary>
3528 ## </param>
3529 #
3530 interface(`userdom_signal_unpriv_users',`
3531         gen_require(`
3532                 attribute unpriv_userdomain;
3533         ')
3534
3535         allow $1 unpriv_userdomain:process signal;
3536 ')
3537
3538 ########################################
3539 ## <summary>
3540 ##      Inherit the file descriptors from unprivileged user domains.
3541 ## </summary>
3542 ## <param name="domain">
3543 ##      <summary>
3544 ##      Domain allowed access.
3545 ##      </summary>
3546 ## </param>
3547 #
3548 interface(`userdom_use_unpriv_users_fds',`
3549         gen_require(`
3550                 attribute unpriv_userdomain;
3551         ')
3552
3553         allow $1 unpriv_userdomain:fd use;
3554 ')
3555
3556 ########################################
3557 ## <summary>
3558 ##      Do not audit attempts to inherit the file descriptors
3559 ##      from unprivileged user domains.
3560 ## </summary>
3561 ## <desc>
3562 ##      <p>
3563 ##      Do not audit attempts to inherit the file descriptors
3564 ##      from unprivileged user domains. This will supress
3565 ##      SELinux denial messages when the specified domain is denied
3566 ##      the permission to inherit these file descriptors.
3567 ##      </p>
3568 ## </desc>
3569 ## <param name="domain">
3570 ##      <summary>
3571 ##      Domain to not audit.
3572 ##      </summary>
3573 ## </param>
3574 ## <infoflow type="none"/>
3575 #
3576 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3577         gen_require(`
3578                 attribute unpriv_userdomain;
3579         ')
3580
3581         dontaudit $1 unpriv_userdomain:fd use;
3582 ')
3583
3584 ########################################
3585 ## <summary>
3586 ##      Do not audit attempts to use user ptys.
3587 ## </summary>
3588 ## <param name="domain">
3589 ##      <summary>
3590 ##      Domain to not audit.
3591 ##      </summary>
3592 ## </param>
3593 #
3594 interface(`userdom_dontaudit_use_user_ptys',`
3595         gen_require(`
3596                 type user_devpts_t;
3597         ')
3598
3599         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3600 ')
3601
3602 ########################################
3603 ## <summary>
3604 ##      Relabel files to unprivileged user pty types.
3605 ## </summary>
3606 ## <param name="domain">
3607 ##      <summary>
3608 ##      Domain allowed access.
3609 ##      </summary>
3610 ## </param>
3611 #
3612 interface(`userdom_relabelto_user_ptys',`
3613         gen_require(`
3614                 type user_devpts_t;
3615         ')
3616
3617         allow $1 user_devpts_t:chr_file relabelto;
3618 ')
3619
3620 ########################################
3621 ## <summary>
3622 ##      Do not audit attempts to relabel files from
3623 ##      user pty types.
3624 ## </summary>
3625 ## <param name="domain">
3626 ##      <summary>
3627 ##      Domain to not audit.
3628 ##      </summary>
3629 ## </param>
3630 #
3631 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3632         gen_require(`
3633                 type user_devpts_t;
3634         ')
3635
3636         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3637 ')
3638
3639 ########################################
3640 ## <summary>
3641 ##      Write all users files in /tmp
3642 ## </summary>
3643 ## <param name="domain">
3644 ##      <summary>
3645 ##      Domain allowed access.
3646 ##      </summary>
3647 ## </param>
3648 #
3649 interface(`userdom_write_user_tmp_files',`
3650         gen_require(`
3651                 type user_tmp_t;
3652         ')
3653
3654         write_files_pattern($1, user_tmp_t, user_tmp_t)
3655 ')
3656
3657 ########################################
3658 ## <summary>
3659 ##      Do not audit attempts to write users
3660 ##      temporary files.
3661 ## </summary>
3662 ## <param name="domain">
3663 ##      <summary>
3664 ##      Domain to not audit.
3665 ##      </summary>
3666 ## </param>
3667 #
3668 interface(`userdom_dontaudit_write_user_tmp_files',`
3669         gen_require(`
3670                 type user_tmp_t;
3671         ')
3672
3673         dontaudit $1 user_tmp_t:file write;
3674 ')
3675
3676 ########################################
3677 ## <summary>
3678 ##      Do not audit attempts to read/write users
3679 ##      temporary fifo files.
3680 ## </summary>
3681 ## <param name="domain">
3682 ##      <summary>
3683 ##      Domain to not audit.
3684 ##      </summary>
3685 ## </param>
3686 #
3687 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3688         gen_require(`
3689                 type user_tmp_t;
3690         ')
3691
3692         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3693 ')
3694
3695 ########################################
3696 ## <summary>
3697 ##      Do not audit attempts to use user ttys.
3698 ## </summary>
3699 ## <param name="domain">
3700 ##      <summary>
3701 ##      Domain to not audit.
3702 ##      </summary>
3703 ## </param>
3704 #
3705 interface(`userdom_dontaudit_use_user_ttys',`
3706         gen_require(`
3707                 type user_tty_device_t;
3708         ')
3709
3710         dontaudit $1 user_tty_device_t:chr_file rw_inherited_file_perms;
3711 ')
3712
3713 ########################################
3714 ## <summary>
3715 ##      Read the process state of all user domains.
3716 ## </summary>
3717 ## <param name="domain">
3718 ##      <summary>
3719 ##      Domain allowed access.
3720 ##      </summary>
3721 ## </param>
3722 #
3723 interface(`userdom_read_all_users_state',`
3724         gen_require(`
3725                 attribute userdomain;
3726         ')
3727
3728         read_files_pattern($1, userdomain, userdomain)
3729         read_lnk_files_pattern($1,userdomain,userdomain)
3730         kernel_search_proc($1)
3731 ')
3732
3733 ########################################
3734 ## <summary>
3735 ##      Get the attributes of all user domains.
3736 ## </summary>
3737 ## <param name="domain">
3738 ##      <summary>
3739 ##      Domain allowed access.
3740 ##      </summary>
3741 ## </param>
3742 #
3743 interface(`userdom_getattr_all_users',`
3744         gen_require(`
3745                 attribute userdomain;
3746         ')
3747
3748         allow $1 userdomain:process getattr;
3749 ')
3750
3751 ########################################
3752 ## <summary>
3753 ##      Inherit the file descriptors from all user domains
3754 ## </summary>
3755 ## <param name="domain">
3756 ##      <summary>
3757 ##      Domain allowed access.
3758 ##      </summary>
3759 ## </param>
3760 #
3761 interface(`userdom_use_all_users_fds',`
3762         gen_require(`
3763                 attribute userdomain;
3764         ')
3765
3766         allow $1 userdomain:fd use;
3767 ')
3768
3769 ########################################
3770 ## <summary>
3771 ##      Do not audit attempts to inherit the file
3772 ##      descriptors from any user domains.
3773 ## </summary>
3774 ## <param name="domain">
3775 ##      <summary>
3776 ##      Domain to not audit.
3777 ##      </summary>
3778 ## </param>
3779 #
3780 interface(`userdom_dontaudit_use_all_users_fds',`
3781         gen_require(`
3782                 attribute userdomain;
3783         ')
3784
3785         dontaudit $1 userdomain:fd use;
3786 ')
3787
3788 ########################################
3789 ## <summary>
3790 ##      Send general signals to all user domains.
3791 ## </summary>
3792 ## <param name="domain">
3793 ##      <summary>
3794 ##      Domain allowed access.
3795 ##      </summary>
3796 ## </param>
3797 #
3798 interface(`userdom_signal_all_users',`
3799         gen_require(`
3800                 attribute userdomain;
3801         ')
3802
3803         allow $1 userdomain:process signal;
3804 ')
3805
3806 ########################################
3807 ## <summary>
3808 ##      Send kill signals to all user domains.
3809 ## </summary>
3810 ## <param name="domain">
3811 ##      <summary>
3812 ##      Domain allowed access.
3813 ##      </summary>
3814 ## </param>
3815 #
3816 interface(`userdom_kill_all_users',`
3817         gen_require(`
3818                 attribute userdomain;
3819         ')
3820
3821         allow $1 userdomain:process sigkill;
3822 ')
3823
3824 ########################################
3825 ## <summary>
3826 ##      Send a SIGCHLD signal to all user domains.
3827 ## </summary>
3828 ## <param name="domain">
3829 ##      <summary>
3830 ##      Domain allowed access.
3831 ##      </summary>
3832 ## </param>
3833 #
3834 interface(`userdom_sigchld_all_users',`
3835         gen_require(`
3836                 attribute userdomain;
3837         ')
3838
3839         allow $1 userdomain:process sigchld;
3840 ')
3841
3842 ########################################
3843 ## <summary>
3844 ##      Read keys for all user domains.
3845 ## </summary>
3846 ## <param name="domain">
3847 ##      <summary>
3848 ##      Domain allowed access.
3849 ##      </summary>
3850 ## </param>
3851 #
3852 interface(`userdom_read_all_users_keys',`
3853         gen_require(`
3854                 attribute userdomain;
3855         ')
3856
3857         allow $1 userdomain:key read;
3858 ')
3859
3860 ########################################
3861 ## <summary>
3862 ##      Create keys for all user domains.
3863 ## </summary>
3864 ## <param name="domain">
3865 ##      <summary>
3866 ##      Domain allowed access.
3867 ##      </summary>
3868 ## </param>
3869 #
3870 interface(`userdom_create_all_users_keys',`
3871         gen_require(`
3872                 attribute userdomain;
3873         ')
3874
3875         allow $1 userdomain:key create;
3876 ')
3877
3878 ########################################
3879 ## <summary>
3880 ##      Send a dbus message to all user domains.
3881 ## </summary>
3882 ## <param name="domain">
3883 ##      <summary>
3884 ##      Domain allowed access.
3885 ##      </summary>
3886 ## </param>
3887 #
3888 interface(`userdom_dbus_send_all_users',`
3889         gen_require(`
3890                 attribute userdomain;
3891                 class dbus send_msg;
3892         ')
3893
3894         allow $1 userdomain:dbus send_msg;
3895 ')
3896
3897 ########################################
3898 ## <summary>
3899 ##      Allow apps to set rlimits on userdomain
3900 ## </summary>
3901 ## <param name="domain">
3902 ##      <summary>
3903 ##      Domain allowed access.
3904 ##      </summary>
3905 ## </param>
3906 #
3907 interface(`userdom_set_rlimitnh',`
3908         gen_require(`
3909                 attribute userdomain;
3910         ')
3911
3912         allow $1 userdomain:process rlimitinh;
3913 ')
3914
3915 ########################################
3916 ## <summary>
3917 ##      Define this type as a Allow apps to set rlimits on userdomain
3918 ## </summary>
3919 ## <param name="domain">
3920 ##      <summary>
3921 ##      Domain allowed access.
3922 ##      </summary>
3923 ## </param>
3924 ## <param name="userdomain_prefix">
3925 ##      <summary>
3926 ##      The prefix of the user domain (e.g., user
3927 ##      is the prefix for user_t).
3928 ## </summary>
3929 ## </param>
3930 ## <param name="domain">
3931 ##      <summary>
3932 ##      Domain allowed access.
3933 ##      </summary>
3934 ## </param>
3935 #
3936 template(`userdom_unpriv_usertype',`
3937         gen_require(`
3938                 attribute unpriv_userdomain, userdomain;
3939                 attribute $1_usertype;
3940         ')
3941         typeattribute $2  $1_usertype;
3942         typeattribute $2  unpriv_userdomain;
3943         typeattribute $2  userdomain;
3944
3945         auth_use_nsswitch($2)
3946         ubac_constrained($2)
3947 ')
3948
3949 #######################################
3950 ## <summary>
3951 ##  Define this type as a Allow apps to set rlimits on userdomain
3952 ## </summary>
3953 ## <param name="domain">
3954 ##  <summary>
3955 ##  Domain allowed access.
3956 ##  </summary>
3957 ## </param>
3958 ## <param name="userdomain_prefix">
3959 ##  <summary>
3960 ##  The prefix of the user domain (e.g., user
3961 ##  is the prefix for user_t).
3962 ## </summary>
3963 ## </param>
3964 ## <param name="domain">
3965 ##  <summary>
3966 ##  Domain allowed access.
3967 ##  </summary>
3968 ## </param>
3969 #
3970 template(`userdom_unpriv_type',`
3971     gen_require(`
3972         attribute unpriv_userdomain, userdomain;
3973     ')
3974     typeattribute $2  unpriv_userdomain;
3975     typeattribute $2  userdomain;
3976
3977     auth_use_nsswitch($2)
3978     ubac_constrained($2)
3979 ')
3980
3981 ########################################
3982 ## <summary>
3983 ##      Connect to users over an unix stream socket.
3984 ## </summary>
3985 ## <param name="domain">
3986 ##      <summary>
3987 ##      Domain allowed access.
3988 ##      </summary>
3989 ## </param>
3990 #
3991 interface(`userdom_stream_connect',`
3992         gen_require(`
3993                 type user_tmp_t;
3994                 attribute userdomain;
3995         ')
3996
3997         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3998 ')
3999
4000 ########################################
4001 ## <summary>
4002 ##      Ptrace user domains.
4003 ## </summary>
4004 ## <param name="domain">
4005 ##      <summary>
4006 ##      Domain allowed access.
4007 ##      </summary>
4008 ## </param>
4009 #
4010 interface(`userdom_ptrace_all_users',`
4011         gen_require(`
4012                 attribute userdomain;
4013         ')
4014
4015         tunable_policy(`deny_ptrace',`',`
4016                 allow $1 userdomain:process ptrace;
4017         ')
4018 ')
4019
4020 ########################################
4021 ## <summary>
4022 ##      dontaudit Search /root
4023 ## </summary>
4024 ## <param name="domain">
4025 ##      <summary>
4026 ##      Domain to not audit.
4027 ##      </summary>
4028 ## </param>
4029 #
4030 interface(`userdom_dontaudit_search_admin_dir',`
4031         gen_require(`
4032                 type admin_home_t;
4033         ')
4034
4035         dontaudit $1 admin_home_t:dir search_dir_perms;
4036 ')
4037
4038 ########################################
4039 ## <summary>
4040 ##      dontaudit list /root
4041 ## </summary>
4042 ## <param name="domain">
4043 ##      <summary>
4044 ##      Domain to not audit.
4045 ##      </summary>
4046 ## </param>
4047 #
4048 interface(`userdom_dontaudit_list_admin_dir',`
4049         gen_require(`
4050                 type admin_home_t;
4051         ')
4052
4053         dontaudit $1 admin_home_t:dir list_dir_perms;
4054 ')
4055
4056 ########################################
4057 ## <summary>
4058 ##      Allow domain to  list /root
4059 ## </summary>
4060 ## <param name="domain">
4061 ##      <summary>
4062 ##      Domain allowed access.
4063 ##      </summary>
4064 ## </param>
4065 #
4066 interface(`userdom_list_admin_dir',`
4067         gen_require(`
4068                 type admin_home_t;
4069         ')
4070
4071         allow $1 admin_home_t:dir list_dir_perms;
4072 ')
4073
4074 ########################################
4075 ## <summary>
4076 ##      Allow Search /root
4077 ## </summary>
4078 ## <param name="domain">
4079 ##      <summary>
4080 ##      Domain allowed access.
4081 ##      </summary>
4082 ## </param>
4083 #
4084 interface(`userdom_search_admin_dir',`
4085         gen_require(`
4086                 type admin_home_t;
4087         ')
4088
4089         allow $1 admin_home_t:dir search_dir_perms;
4090 ')
4091
4092 ########################################
4093 ## <summary>
4094 ##      RW unpriviledged user SysV sempaphores.
4095 ## </summary>
4096 ## <param name="domain">
4097 ##      <summary>
4098 ##      Domain allowed access.
4099 ##      </summary>
4100 ## </param>
4101 #
4102 interface(`userdom_rw_semaphores',`
4103         gen_require(`
4104                 attribute unpriv_userdomain;
4105         ')
4106
4107         allow $1 unpriv_userdomain:sem rw_sem_perms;
4108 ')
4109
4110 ########################################
4111 ## <summary>
4112 ##      Send a message to unpriv users over a unix domain
4113 ##      datagram socket.
4114 ## </summary>
4115 ## <param name="domain">
4116 ##      <summary>
4117 ##      Domain allowed access.
4118 ##      </summary>
4119 ## </param>
4120 #
4121 interface(`userdom_dgram_send',`
4122         gen_require(`
4123                 attribute unpriv_userdomain;
4124         ')
4125
4126         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4127 ')
4128
4129 ######################################
4130 ## <summary>
4131 ##      Send a message to users over a unix domain
4132 ##      datagram socket.
4133 ## </summary>
4134 ## <param name="domain">
4135 ##      <summary>
4136 ##      Domain allowed access.
4137 ##      </summary>
4138 ## </param>
4139 #
4140 interface(`userdom_users_dgram_send',`
4141         gen_require(`
4142                  attribute userdomain;
4143       ')
4144
4145        allow $1 userdomain:unix_dgram_socket sendto;
4146 ')
4147
4148 #######################################
4149 ## <summary>
4150 ##      Allow execmod on files in homedirectory
4151 ## </summary>
4152 ## <param name="domain">
4153 ##      <summary>
4154 ##      Domain allowed access.
4155 ##      </summary>
4156 ## </param>
4157 ## <rolebase/>
4158 #
4159 interface(`userdom_execmod_user_home_files',`
4160         gen_require(`
4161                 type user_home_type;
4162         ')
4163
4164         allow $1 user_home_type:file execmod;
4165 ')
4166
4167 ########################################
4168 ## <summary>
4169 ##      Read admin home files.
4170 ## </summary>
4171 ## <param name="domain">
4172 ##      <summary>
4173 ##      Domain allowed access.
4174 ##      </summary>
4175 ## </param>
4176 ## <rolecap/>
4177 #
4178 interface(`userdom_read_admin_home_files',`
4179         gen_require(`
4180                 type admin_home_t;
4181         ')
4182
4183         read_files_pattern($1, admin_home_t, admin_home_t)
4184 ')
4185
4186 ########################################
4187 ## <summary>
4188 ##      Delete admin home files.
4189 ## </summary>
4190 ## <param name="domain">
4191 ##      <summary>
4192 ##      Domain allowed access.
4193 ##      </summary>
4194 ## </param>
4195 ## <rolecap/>
4196 #
4197 interface(`userdom_delete_admin_home_files',`
4198         gen_require(`
4199                 type admin_home_t;
4200         ')
4201
4202         allow $1 admin_home_t:file delete_file_perms;
4203 ')
4204
4205 ########################################
4206 ## <summary>
4207 ##      Execute admin home files.
4208 ## </summary>
4209 ## <param name="domain">
4210 ##      <summary>
4211 ##      Domain allowed access.
4212 ##      </summary>
4213 ## </param>
4214 ## <rolecap/>
4215 #
4216 interface(`userdom_exec_admin_home_files',`
4217         gen_require(`
4218                 type admin_home_t;
4219         ')
4220
4221         exec_files_pattern($1, admin_home_t, admin_home_t)
4222 ')
4223
4224 ########################################
4225 ## <summary>
4226 ##      Append files inherited
4227 ##      in the /root directory.
4228 ## </summary>
4229 ## <param name="domain">
4230 ##      <summary>
4231 ##      Domain allowed access.
4232 ##      </summary>
4233 ## </param>
4234 #
4235 interface(`userdom_inherit_append_admin_home_files',`
4236         gen_require(`
4237                 type admin_home_t;
4238         ')
4239
4240         allow $1 admin_home_t:file { getattr append };
4241 ')
4242
4243
4244 #######################################
4245 ## <summary>
4246 ##      Manage all files/directories in the homedir
4247 ## </summary>
4248 ## <param name="userdomain">
4249 ##      <summary>
4250 ##      The user domain
4251 ##      </summary>
4252 ## </param>
4253 ## <rolebase/>
4254 #
4255 interface(`userdom_manage_user_home_content',`
4256         gen_require(`
4257                 type user_home_dir_t, user_home_t;
4258                 attribute user_home_type;
4259         ')
4260
4261         files_list_home($1)
4262         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4263         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4264         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4265         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4266         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4267         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4268
4269 ')
4270
4271
4272 ########################################
4273 ## <summary>
4274 ##      Create objects in a user home directory
4275 ##      with an automatic type transition to
4276 ##      the user home file type.
4277 ## </summary>
4278 ## <param name="domain">
4279 ##      <summary>
4280 ##      Domain allowed access.
4281 ##      </summary>
4282 ## </param>
4283 ## <param name="object_class">
4284 ##      <summary>
4285 ##      The class of the object to be created.
4286 ##      </summary>
4287 ## </param>
4288 #
4289 interface(`userdom_user_home_dir_filetrans_pattern',`
4290         gen_require(`
4291                 type user_home_dir_t, user_home_t;
4292         ')
4293
4294         type_transition $1 user_home_dir_t:$2 user_home_t;
4295 ')
4296
4297 ########################################
4298 ## <summary>
4299 ##      Create objects in the /root directory
4300 ##      with an automatic type transition to
4301 ##      a specified private type.
4302 ## </summary>
4303 ## <param name="domain">
4304 ##      <summary>
4305 ##      Domain allowed access.
4306 ##      </summary>
4307 ## </param>
4308 ## <param name="private_type">
4309 ##      <summary>
4310 ##      The type of the object to create.
4311 ##      </summary>
4312 ## </param>
4313 ## <param name="object_class">
4314 ##      <summary>
4315 ##      The class of the object to be created.
4316 ##      </summary>
4317 ## </param>
4318 #
4319 interface(`userdom_admin_home_dir_filetrans',`
4320         gen_require(`
4321                 type admin_home_t;
4322         ')
4323
4324         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4325 ')
4326
4327 ########################################
4328 ## <summary>
4329 ##      Send signull to unprivileged user domains.
4330 ## </summary>
4331 ## <param name="domain">
4332 ##      <summary>
4333 ##      Domain allowed access.
4334 ##      </summary>
4335 ## </param>
4336 #
4337 interface(`userdom_signull_unpriv_users',`
4338         gen_require(`
4339                 attribute unpriv_userdomain;
4340         ')
4341
4342         allow $1 unpriv_userdomain:process signull;
4343 ')
4344
4345 ########################################
4346 ## <summary>
4347 ##      Write all users files in /tmp
4348 ## </summary>
4349 ## <param name="domain">
4350 ##      <summary>
4351 ##      Domain allowed access.
4352 ##      </summary>
4353 ## </param>
4354 #
4355 interface(`userdom_write_user_tmp_dirs',`
4356         gen_require(`
4357                 type user_tmp_t;
4358         ')
4359
4360         write_files_pattern($1, user_tmp_t, user_tmp_t)
4361 ')
4362
4363 ########################################
4364 ## <summary>
4365 ##      Manage keys for all user domains.
4366 ## </summary>
4367 ## <param name="domain">
4368 ##      <summary>
4369 ##      Domain allowed access.
4370 ##      </summary>
4371 ## </param>
4372 #
4373 interface(`userdom_manage_all_users_keys',`
4374         gen_require(`
4375                 attribute userdomain;
4376         ')
4377
4378         allow $1 userdomain:key manage_key_perms;
4379 ')
4380
4381
4382 ########################################
4383 ## <summary>
4384 ##      Do not audit attempts to read and write
4385 ##      unserdomain stream.
4386 ## </summary>
4387 ## <param name="domain">
4388 ##      <summary>
4389 ##      Domain to not audit.
4390 ##      </summary>
4391 ## </param>
4392 #
4393 interface(`userdom_dontaudit_rw_stream',`
4394         gen_require(`
4395                 attribute userdomain;
4396         ')
4397
4398         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4399 ')
4400
4401 ########################################
4402 ## <summary>
4403 ##      Do not audit attempts to read and write
4404 ##      unserdomain datagram socket.
4405 ## </summary>
4406 ## <param name="domain">
4407 ##      <summary>
4408 ##      Domain to not audit.
4409 ##      </summary>
4410 ## </param>
4411 #
4412 interface(`userdom_dontaudit_rw_dgram_socket',`
4413         gen_require(`
4414                 attribute userdomain;
4415         ')
4416
4417         dontaudit $1 userdomain:unix_dgram_socket { read write };
4418 ')
4419
4420 ########################################
4421 ## <summary>
4422 ##      Append files
4423 ##      in a user home subdirectory.
4424 ## </summary>
4425 ## <param name="domain">
4426 ##      <summary>
4427 ##      Domain allowed access.
4428 ##      </summary>
4429 ## </param>
4430 #
4431 interface(`userdom_append_user_home_content_files',`
4432         gen_require(`
4433                 type user_home_dir_t, user_home_t;
4434         ')
4435
4436         append_files_pattern($1, user_home_t, user_home_t)
4437         allow $1 user_home_dir_t:dir search_dir_perms;
4438         files_search_home($1)
4439 ')
4440
4441 ########################################
4442 ## <summary>
4443 ##      Read files inherited
4444 ##      in a user home subdirectory.
4445 ## </summary>
4446 ## <param name="domain">
4447 ##      <summary>
4448 ##      Domain allowed access.
4449 ##      </summary>
4450 ## </param>
4451 #
4452 interface(`userdom_read_inherited_user_home_content_files',`
4453         gen_require(`
4454                 attribute user_home_type;
4455         ')
4456
4457         allow $1 user_home_type:file { getattr read };
4458 ')
4459
4460 ########################################
4461 ## <summary>
4462 ##      Append files inherited
4463 ##      in a user home subdirectory.
4464 ## </summary>
4465 ## <param name="domain">
4466 ##      <summary>
4467 ##      Domain allowed access.
4468 ##      </summary>
4469 ## </param>
4470 #
4471 interface(`userdom_inherit_append_user_home_content_files',`
4472         gen_require(`
4473                 type user_home_t;
4474         ')
4475
4476         allow $1 user_home_t:file { getattr append };
4477 ')
4478
4479 ########################################
4480 ## <summary>
4481 ##      Append files inherited
4482 ##      in a user tmp files.
4483 ## </summary>
4484 ## <param name="domain">
4485 ##      <summary>
4486 ##      Domain allowed access.
4487 ##      </summary>
4488 ## </param>
4489 #
4490 interface(`userdom_inherit_append_user_tmp_files',`
4491         gen_require(`
4492                 type user_tmp_t;
4493         ')
4494
4495         allow $1 user_tmp_t:file { getattr append };
4496 ')
4497
4498 ######################################
4499 ## <summary>
4500 ##      Read audio files in the users homedir.
4501 ## </summary>
4502 ## <param name="domain">
4503 ##      <summary>
4504 ##      Domain allowed access.
4505 ##      </summary>
4506 ## </param>
4507 ## <rolecap/>
4508 #
4509 interface(`userdom_read_home_audio_files',`
4510         gen_require(`
4511                 type audio_home_t;
4512         ')
4513
4514         userdom_search_user_home_dirs($1)
4515         allow $1 audio_home_t:dir list_dir_perms;
4516         read_files_pattern($1, audio_home_t, audio_home_t)
4517         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4518 ')
4519
4520 ########################################
4521 ## <summary>
4522 ##      Do not audit attempts to write all user home content files.
4523 ## </summary>
4524 ## <param name="domain">
4525 ##      <summary>
4526 ##      Domain to not audit.
4527 ##      </summary>
4528 ## </param>
4529 #
4530 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4531         gen_require(`
4532                 attribute user_home_type;
4533         ')
4534
4535         dontaudit $1 user_home_type:file write_file_perms;
4536 ')
4537
4538 ########################################
4539 ## <summary>
4540 ##      Do not audit attempts to write all user tmp content files.
4541 ## </summary>
4542 ## <param name="domain">
4543 ##      <summary>
4544 ##      Domain to not audit.
4545 ##      </summary>
4546 ## </param>
4547 #
4548 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4549         gen_require(`
4550                 attribute user_tmp_type;
4551         ')
4552
4553         dontaudit $1 user_tmp_type:file write_file_perms;
4554 ')
4555
4556 ########################################
4557 ## <summary>
4558 ##      Manage all user temporary content.
4559 ## </summary>
4560 ## <param name="domain">
4561 ##      <summary>
4562 ##      Domain allowed access.
4563 ##      </summary>
4564 ## </param>
4565 #
4566 interface(`userdom_manage_all_user_tmp_content',`
4567         gen_require(`
4568                 attribute user_tmp_type;
4569         ')
4570
4571         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4572         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4573         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4574         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4575         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4576         files_search_tmp($1)
4577 ')
4578
4579 ########################################
4580 ## <summary>
4581 ##      List all user temporary content.
4582 ## </summary>
4583 ## <param name="domain">
4584 ##      <summary>
4585 ##      Domain allowed access.
4586 ##      </summary>
4587 ## </param>
4588 #
4589 interface(`userdom_list_all_user_tmp_content',`
4590         gen_require(`
4591                 attribute user_tmp_type;
4592         ')
4593
4594         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4595         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4596         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4597         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4598         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4599         files_search_var($1)
4600         files_search_tmp($1)
4601 ')
4602
4603 ########################################
4604 ## <summary>
4605 ##      Manage all user tmpfs content.
4606 ## </summary>
4607 ## <param name="domain">
4608 ##      <summary>
4609 ##      Domain allowed access.
4610 ##      </summary>
4611 ## </param>
4612 #
4613 interface(`userdom_manage_all_user_tmpfs_content',`
4614         gen_require(`
4615                 attribute user_tmpfs_type;
4616         ')
4617
4618         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4619         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4620         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4621         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4622         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4623         fs_search_tmpfs($1)
4624 ')
4625
4626 ########################################
4627 ## <summary>
4628 ##      Delete all user temporary content.
4629 ## </summary>
4630 ## <param name="domain">
4631 ##      <summary>
4632 ##      Domain allowed access.
4633 ##      </summary>
4634 ## </param>
4635 #
4636 interface(`userdom_delete_all_user_tmp_content',`
4637         gen_require(`
4638                 attribute user_tmp_type;
4639         ')
4640
4641         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4642         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4643         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4644         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4645         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4646         # /var/tmp
4647         files_search_var($1)
4648         files_delete_tmp_dir_entry($1)
4649 ')
4650
4651 ########################################
4652 ## <summary>
4653 ##      Read system SSL certificates in the users homedir.
4654 ## </summary>
4655 ## <param name="domain">
4656 ##      <summary>
4657 ##      Domain allowed access.
4658 ##      </summary>
4659 ## </param>
4660 #
4661 interface(`userdom_read_home_certs',`
4662         gen_require(`
4663                 type home_cert_t;
4664         ')
4665
4666         userdom_search_user_home_content($1)
4667         allow $1 home_cert_t:dir list_dir_perms;
4668         read_files_pattern($1, home_cert_t, home_cert_t)
4669         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4670 ')
4671
4672 ########################################
4673 ## <summary>
4674 ##      Manage system SSL certificates in the users homedir.
4675 ## </summary>
4676 ## <param name="domain">
4677 ##      <summary>
4678 ##      Domain allowed access.
4679 ##      </summary>
4680 ## </param>
4681 #
4682 interface(`userdom_manage_home_certs',`
4683         gen_require(`
4684                 type home_cert_t;
4685         ')
4686
4687         allow $1 home_cert_t:dir list_dir_perms;
4688         manage_files_pattern($1, home_cert_t, home_cert_t)
4689         manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
4690
4691         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
4692         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
4693 ')
4694
4695 #######################################
4696 ## <summary>
4697 ##  Dontaudit Write system SSL certificates in the users homedir.
4698 ## </summary>
4699 ## <param name="domain">
4700 ##  <summary>
4701 ##      Domain to not audit.
4702 ##  </summary>
4703 ## </param>
4704 #
4705 interface(`userdom_dontaudit_write_home_certs',`
4706     gen_require(`
4707         type home_cert_t;
4708     ')
4709
4710     dontaudit $1 home_cert_t:file write;
4711 ')
4712
4713 ########################################
4714 ## <summary>
4715 ##      dontaudit Search getatrr /root files
4716 ## </summary>
4717 ## <param name="domain">
4718 ##      <summary>
4719 ##      Domain to not audit.
4720 ##      </summary>
4721 ## </param>
4722 #
4723 interface(`userdom_dontaudit_getattr_admin_home_files',`
4724         gen_require(`
4725                 type admin_home_t;
4726         ')
4727
4728         dontaudit $1 admin_home_t:file getattr;
4729 ')
4730
4731 ########################################
4732 ## <summary>
4733 ##      dontaudit read /root lnk files
4734 ## </summary>
4735 ## <param name="domain">
4736 ##      <summary>
4737 ##      Domain to not audit.
4738 ##      </summary>
4739 ## </param>
4740 #
4741 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4742         gen_require(`
4743                 type admin_home_t;
4744         ')
4745
4746         dontaudit $1 admin_home_t:lnk_file read;
4747 ')
4748
4749 ########################################
4750 ## <summary>
4751 ##      dontaudit read /root files
4752 ## </summary>
4753 ## <param name="domain">
4754 ##      <summary>
4755 ##      Domain to not audit.
4756 ##      </summary>
4757 ## </param>
4758 #
4759 interface(`userdom_dontaudit_read_admin_home_files',`
4760         gen_require(`
4761                 type admin_home_t;
4762         ')
4763
4764         dontaudit $1 admin_home_t:file read_file_perms;
4765 ')
4766
4767 ########################################
4768 ## <summary>
4769 ##      Create, read, write, and delete user
4770 ##      temporary chr files.
4771 ## </summary>
4772 ## <param name="domain">
4773 ##      <summary>
4774 ##      Domain allowed access.
4775 ##      </summary>
4776 ## </param>
4777 #
4778 interface(`userdom_manage_user_tmp_chr_files',`
4779         gen_require(`
4780                 type user_tmp_t;
4781         ')
4782
4783         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4784         files_search_tmp($1)
4785 ')
4786
4787 ########################################
4788 ## <summary>
4789 ##      Create, read, write, and delete user
4790 ##      temporary blk files.
4791 ## </summary>
4792 ## <param name="domain">
4793 ##      <summary>
4794 ##      Domain allowed access.
4795 ##      </summary>
4796 ## </param>
4797 #
4798 interface(`userdom_manage_user_tmp_blk_files',`
4799         gen_require(`
4800                 type user_tmp_t;
4801         ')
4802
4803         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4804         files_search_tmp($1)
4805 ')
4806
4807 ########################################
4808 ## <summary>
4809 ##      Dontaudit attempt to set attributes on  user temporary directories.
4810 ## </summary>
4811 ## <param name="domain">
4812 ##      <summary>
4813 ##      Domain to not audit.
4814 ##      </summary>
4815 ## </param>
4816 #
4817 interface(`userdom_dontaudit_setattr_user_tmp',`
4818         gen_require(`
4819                 type user_tmp_t;
4820         ')
4821
4822         dontaudit $1 user_tmp_t:dir setattr;
4823 ')
4824
4825 ########################################
4826 ## <summary>
4827 ##      Read all inherited users files in /tmp
4828 ## </summary>
4829 ## <param name="domain">
4830 ##      <summary>
4831 ##      Domain allowed access.
4832 ##      </summary>
4833 ## </param>
4834 #
4835 interface(`userdom_read_inherited_user_tmp_files',`
4836         gen_require(`
4837                 type user_tmp_t;
4838         ')
4839
4840         allow $1 user_tmp_t:file read_inherited_file_perms;
4841 ')
4842
4843 ########################################
4844 ## <summary>
4845 ##      Write all inherited users files in /tmp
4846 ## </summary>
4847 ## <param name="domain">
4848 ##      <summary>
4849 ##      Domain allowed access.
4850 ##      </summary>
4851 ## </param>
4852 #
4853 interface(`userdom_write_inherited_user_tmp_files',`
4854         gen_require(`
4855                 type user_tmp_t;
4856         ')
4857
4858         allow $1 user_tmp_t:file write;
4859 ')
4860
4861 ########################################
4862 ## <summary>
4863 ##      Delete all users files in /tmp
4864 ## </summary>
4865 ## <param name="domain">
4866 ##      <summary>
4867 ##      Domain allowed access.
4868 ##      </summary>
4869 ## </param>
4870 #
4871 interface(`userdom_delete_user_tmp_files',`
4872         gen_require(`
4873                 type user_tmp_t;
4874         ')
4875
4876         allow $1 user_tmp_t:file delete_file_perms;
4877 ')
4878
4879 ########################################
4880 ## <summary>
4881 ##      Delete user tmpfs files.
4882 ## </summary>
4883 ## <param name="domain">
4884 ##      <summary>
4885 ##      Domain allowed access.
4886 ##      </summary>
4887 ## </param>
4888 #
4889 interface(`userdom_delete_user_tmpfs_files',`
4890         gen_require(`
4891                 type user_tmpfs_t;
4892         ')
4893
4894         allow $1 user_tmpfs_t:file delete_file_perms;
4895 ')
4896
4897 ########################################
4898 ## <summary>
4899 ##      Read/Write unpriviledged user SysV shared
4900 ##      memory segments.
4901 ## </summary>
4902 ## <param name="domain">
4903 ##      <summary>
4904 ##      Domain allowed access.
4905 ##      </summary>
4906 ## </param>
4907 #
4908 interface(`userdom_rw_unpriv_user_shared_mem',`
4909         gen_require(`
4910                 attribute unpriv_userdomain;
4911         ')
4912
4913         allow $1 unpriv_userdomain:shm rw_shm_perms;
4914 ')
4915
4916 ########################################
4917 ## <summary>
4918 ##      Do not audit attempts to search user
4919 ##      temporary directories.
4920 ## </summary>
4921 ## <param name="domain">
4922 ##      <summary>
4923 ##      Domain to not audit.
4924 ##      </summary>
4925 ## </param>
4926 #
4927 interface(`userdom_dontaudit_search_user_tmp',`
4928         gen_require(`
4929                 type user_tmp_t;
4930         ')
4931
4932         dontaudit $1 user_tmp_t:dir search_dir_perms;
4933 ')
4934
4935 ########################################
4936 ## <summary>
4937 ##      Execute a file in a user home directory
4938 ##      in the specified domain.
4939 ## </summary>
4940 ## <desc>
4941 ##      <p>
4942 ##      Execute a file in a user home directory
4943 ##      in the specified domain.
4944 ##      </p>
4945 ##      <p>
4946 ##      No interprocess communication (signals, pipes,
4947 ##      etc.) is provided by this interface since
4948 ##      the domains are not owned by this module.
4949 ##      </p>
4950 ## </desc>
4951 ## <param name="domain">
4952 ##      <summary>
4953 ##      Domain allowed access.
4954 ##      </summary>
4955 ## </param>
4956 ## <param name="target_domain">
4957 ##      <summary>
4958 ##      The type of the new process.
4959 ##      </summary>
4960 ## </param>
4961 #
4962 interface(`userdom_domtrans_user_home',`
4963         gen_require(`
4964                 type user_home_t;
4965         ')
4966
4967         read_lnk_files_pattern($1, user_home_t, user_home_t)
4968         domain_transition_pattern($1, user_home_t, $2)
4969         type_transition $1 user_home_t:process $2;
4970 ')
4971
4972 ########################################
4973 ## <summary>
4974 ##      Execute a file in a user tmp directory
4975 ##      in the specified domain.
4976 ## </summary>
4977 ## <desc>
4978 ##      <p>
4979 ##      Execute a file in a user tmp directory
4980 ##      in the specified domain.
4981 ##      </p>
4982 ##      <p>
4983 ##      No interprocess communication (signals, pipes,
4984 ##      etc.) is provided by this interface since
4985 ##      the domains are not owned by this module.
4986 ##      </p>
4987 ## </desc>
4988 ## <param name="domain">
4989 ##      <summary>
4990 ##      Domain allowed access.
4991 ##      </summary>
4992 ## </param>
4993 ## <param name="target_domain">
4994 ##      <summary>
4995 ##      The type of the new process.
4996 ##      </summary>
4997 ## </param>
4998 #
4999 interface(`userdom_domtrans_user_tmp',`
5000         gen_require(`
5001                 type user_tmp_t;
5002         ')
5003
5004         files_search_tmp($1)
5005         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
5006         domain_transition_pattern($1, user_tmp_t, $2)
5007         type_transition $1 user_tmp_t:process $2;
5008 ')
5009
5010 ########################################
5011 ## <summary>
5012 ##      Do not audit attempts to read all user home content files.
5013 ## </summary>
5014 ## <param name="domain">
5015 ##      <summary>
5016 ##      Domain to not audit.
5017 ##      </summary>
5018 ## </param>
5019 #
5020 interface(`userdom_dontaudit_read_all_user_home_content_files',`
5021         gen_require(`
5022                 attribute user_home_type;
5023         ')
5024
5025         dontaudit $1 user_home_type:file read_file_perms;
5026 ')
5027
5028 ########################################
5029 ## <summary>
5030 ##      Do not audit attempts to read all user tmp content files.
5031 ## </summary>
5032 ## <param name="domain">
5033 ##      <summary>
5034 ##      Domain to not audit.
5035 ##      </summary>
5036 ## </param>
5037 #
5038 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
5039         gen_require(`
5040                 attribute user_tmp_type;
5041         ')
5042
5043         dontaudit $1 user_tmp_type:file read_file_perms;
5044 ')
5045
5046 #######################################
5047 ## <summary>
5048 ## Read and write unpriviledged user SysV sempaphores.
5049 ## </summary>
5050 ## <param name="domain">
5051 ## <summary>
5052 ## Domain allowed access.
5053 ## </summary>
5054 ## </param>
5055 #
5056 interface(`userdom_rw_unpriv_user_semaphores',`
5057    gen_require(`
5058        attribute unpriv_userdomain;
5059    ')
5060
5061    allow $1 unpriv_userdomain:sem rw_sem_perms;
5062 ')
5063
5064 ########################################
5065 ## <summary>
5066 ##      Transition to userdom named content
5067 ## </summary>
5068 ## <param name="domain">
5069 ##      <summary>
5070 ##      Domain allowed access.
5071 ##      </summary>
5072 ## </param>
5073 #
5074 interface(`userdom_filetrans_home_content',`
5075         gen_require(`
5076                 type home_bin_t, home_cert_t;
5077                 type audio_home_t;
5078         ')
5079
5080         userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
5081         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
5082         userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
5083         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
5084         userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
5085         userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
5086         gnome_config_filetrans($1, home_cert_t, dir, "certificates")
5087
5088         #optional_policy(`
5089         #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
5090         #')
5091 ')
5092
5093 ########################################
5094 ## <summary>
5095 ##      Make the specified type able to read content in user home dirs
5096 ## </summary>
5097 ## <param name="type">
5098 ##      <summary>
5099 ##      Domain allowed access.
5100 ##      </summary>
5101 ## </param>
5102 #
5103 interface(`userdom_home_reader',`
5104         gen_require(`
5105                 attribute userdom_home_reader_type;
5106         ')
5107
5108         typeattribute $1 userdom_home_reader_type;
5109 ')
5110
5111
5112 ########################################
5113 ## <summary>
5114 ##      Make the specified type able to manage content in user home dirs
5115 ## </summary>
5116 ## <param name="type">
5117 ##      <summary>
5118 ##      Domain allowed access.
5119 ##      </summary>
5120 ## </param>
5121 #
5122 interface(`userdom_home_manager',`
5123         gen_require(`
5124                 attribute userdom_home_manager_type;
5125         ')
5126
5127         typeattribute $1 userdom_home_manager_type;
5128 ')