policy/modules/system/userdomain.if

   1 ## <summary>Policy for user domains</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      The template containing the most basic rules common to all users.
   6 ## </summary>
   7 ## <desc>
   8 ##      <p>
   9 ##      The template containing the most basic rules common to all users.
  10 ##      </p>
  11 ##      <p>
  12 ##      This template creates a user domain, types, and
  13 ##      rules for the user's tty and pty.
  14 ##      </p>
  15 ## </desc>
  16 ## <param name="userdomain_prefix">
  17 ##      <summary>
  18 ##      The prefix of the user domain (e.g., user
  19 ##      is the prefix for user_t).
  20 ##      </summary>
  21 ## </param>
  22 ## <rolebase/>
  23 #
  24 template(`userdom_base_user_template',`
  25
  26         gen_require(`
  27                 attribute userdomain;
  28                 type user_devpts_t, user_tty_device_t;
  29                 class context contains;
  30         ')
  31
  32         attribute $1_file_type;
  33         attribute $1_usertype;
  34
  35         type $1_t, userdomain, $1_usertype;
  36         domain_type($1_t)
  37         corecmd_shell_entry_type($1_t)
  38         corecmd_bin_entry_type($1_t)
  39         domain_user_exemption_target($1_t)
  40         ubac_constrained($1_t)
  41         role $1_r types $1_t;
  42         allow system_r $1_r;
  43
  44         term_user_pty($1_t, user_devpts_t)
  45
  46         term_user_tty($1_t, user_tty_device_t)
  47         term_dontaudit_getattr_generic_ptys($1_t)
  48
  49         allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
  50         allow $1_usertype $1_usertype:fd use;
  51         allow $1_usertype $1_t:key { create view read write search link setattr };
  52
  53         allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
  54         allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
  55         allow $1_usertype $1_usertype:unix_stream_socket { create_stream_socket_perms connectto };
  56         allow $1_usertype $1_usertype:shm create_shm_perms;
  57         allow $1_usertype $1_usertype:sem create_sem_perms;
  58         allow $1_usertype $1_usertype:msgq create_msgq_perms;
  59         allow $1_usertype $1_usertype:msg { send receive };
  60         allow $1_usertype $1_usertype:context contains;
  61         dontaudit $1_usertype $1_usertype:socket create;
  62
  63         allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
  64         term_create_pty($1_usertype, user_devpts_t)
  65         # avoid annoying messages on terminal hangup on role change
  66         dontaudit $1_usertype user_devpts_t:chr_file ioctl;
  67
  68         allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
  69         # avoid annoying messages on terminal hangup on role change
  70         dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
  71
  72         application_exec_all($1_usertype)
  73
  74         kernel_read_kernel_sysctls($1_usertype)
  75         kernel_read_all_sysctls($1_usertype)
  76         kernel_dontaudit_list_unlabeled($1_usertype)
  77         kernel_dontaudit_getattr_unlabeled_files($1_usertype)
  78         kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
  79         kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
  80         kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
  81         kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
  82         kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
  83         kernel_dontaudit_list_proc($1_usertype)
  84
  85         dev_dontaudit_getattr_all_blk_files($1_usertype)
  86         dev_dontaudit_getattr_all_chr_files($1_usertype)
  87         dev_getattr_mtrr_dev($1_t)
  88
  89         # When the user domain runs ps, there will be a number of access
  90         # denials when ps tries to search /proc. Do not audit these denials.
  91         domain_dontaudit_read_all_domains_state($1_usertype)
  92         domain_dontaudit_getattr_all_domains($1_usertype)
  93         domain_dontaudit_getsession_all_domains($1_usertype)
  94         dev_dontaudit_all_access_check($1_usertype)
  95
  96         files_read_etc_files($1_usertype)
  97         files_list_mnt($1_usertype)
  98         files_read_mnt_files($1_usertype)
  99         files_dontaudit_access_check_mnt($1_usertype)
 100         files_read_etc_runtime_files($1_usertype)
 101         files_read_usr_files($1_usertype)
 102         files_read_usr_src_files($1_usertype)
 103         # Read directories and files with the readable_t type.
 104         # This type is a general type for "world"-readable files.
 105         files_list_world_readable($1_usertype)
 106         files_read_world_readable_files($1_usertype)
 107         files_read_world_readable_symlinks($1_usertype)
 108         files_read_world_readable_pipes($1_usertype)
 109         files_read_world_readable_sockets($1_usertype)
 110         # old broswer_domain():
 111         files_dontaudit_getattr_all_dirs($1_usertype)
 112         files_dontaudit_list_non_security($1_usertype)
 113         files_dontaudit_getattr_all_files($1_usertype)
 114         files_dontaudit_getattr_non_security_symlinks($1_usertype)
 115         files_dontaudit_getattr_non_security_pipes($1_usertype)
 116         files_dontaudit_getattr_non_security_sockets($1_usertype)
 117         files_dontaudit_setattr_etc_runtime_files($1_usertype)
 118
 119         files_exec_usr_files($1_t)
 120
 121         fs_list_cgroup_dirs($1_usertype)
 122         fs_dontaudit_rw_cgroup_files($1_usertype)
 123
 124         storage_rw_fuse($1_usertype)
 125
 126         auth_use_nsswitch($1_usertype)
 127
 128         init_stream_connect($1_usertype)
 129         # The library functions always try to open read-write first,
 130         # then fall back to read-only if it fails.
 131         init_dontaudit_rw_utmp($1_usertype)
 132
 133         libs_exec_ld_so($1_usertype)
 134
 135         logging_send_audit_msgs($1_t)
 136
 137         miscfiles_read_localization($1_t)
 138         miscfiles_read_generic_certs($1_t)
 139
 140         miscfiles_read_all_certs($1_usertype)
 141         miscfiles_read_localization($1_usertype)
 142         miscfiles_read_man_pages($1_usertype)
 143         miscfiles_read_public_files($1_usertype)
 144
 145         tunable_policy(`allow_execmem',`
 146                 # Allow loading DSOs that require executable stack.
 147                 allow $1_t self:process execmem;
 148         ')
 149
 150         tunable_policy(`allow_execmem && allow_execstack',`
 151                 # Allow making the stack executable via mprotect.
 152                 allow $1_t self:process execstack;
 153         ')
 154
 155         optional_policy(`
 156                 abrt_stream_connect($1_usertype)
 157         ')
 158
 159         optional_policy(`
 160                 fs_list_cgroup_dirs($1_usertype)
 161         ')
 162
 163         optional_policy(`
 164                 ssh_rw_stream_sockets($1_usertype)
 165                 ssh_delete_tmp($1_t)
 166                 ssh_signal($1_t)
 167         ')
 168 ')
 169
 170 #######################################
 171 ## <summary>
 172 ##      Allow a home directory for which the
 173 ##      role has read-only access.
 174 ## </summary>
 175 ## <desc>
 176 ##      <p>
 177 ##      Allow a home directory for which the
 178 ##      role has read-only access.
 179 ##      </p>
 180 ##      <p>
 181 ##      This does not allow execute access.
 182 ##      </p>
 183 ## </desc>
 184 ## <param name="role">
 185 ##      <summary>
 186 ##      The user role
 187 ##      </summary>
 188 ## </param>
 189 ## <param name="userdomain">
 190 ##      <summary>
 191 ##      The user domain
 192 ##      </summary>
 193 ## </param>
 194 ## <rolebase/>
 195 #
 196 interface(`userdom_ro_home_role',`
 197         gen_require(`
 198                 type user_home_t, user_home_dir_t;
 199         ')
 200
 201         role $1 types { user_home_t user_home_dir_t };
 202
 203         ##############################
 204         #
 205         # Domain access to home dir
 206         #
 207
 208         type_member $2 user_home_dir_t:dir user_home_dir_t;
 209
 210         # read-only home directory
 211         allow $2 user_home_dir_t:dir list_dir_perms;
 212         allow $2 user_home_t:dir list_dir_perms;
 213         allow $2 user_home_t:file entrypoint;
 214         read_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 215         read_lnk_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 216         read_fifo_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 217         read_sock_files_pattern($2, { user_home_t user_home_dir_t }, user_home_t)
 218         files_list_home($2)
 219
 220 ')
 221
 222 #######################################
 223 ## <summary>
 224 ##      Allow a home directory for which the
 225 ##      role has full access.
 226 ## </summary>
 227 ## <desc>
 228 ##      <p>
 229 ##      Allow a home directory for which the
 230 ##      role has full access.
 231 ##      </p>
 232 ##      <p>
 233 ##      This does not allow execute access.
 234 ##      </p>
 235 ## </desc>
 236 ## <param name="role">
 237 ##      <summary>
 238 ##      The user role
 239 ##      </summary>
 240 ## </param>
 241 ## <param name="userdomain">
 242 ##      <summary>
 243 ##      The user domain
 244 ##      </summary>
 245 ## </param>
 246 ## <rolebase/>
 247 #
 248 interface(`userdom_manage_home_role',`
 249         gen_require(`
 250                 type user_home_t, user_home_dir_t;
 251                 attribute user_home_type;
 252         ')
 253
 254         role $1 types { user_home_type user_home_dir_t };
 255
 256         ##############################
 257         #
 258         # Domain access to home dir
 259         #
 260
 261         type_member $2 user_home_dir_t:dir user_home_dir_t;
 262
 263         # full control of the home directory
 264         allow $2 user_home_t:dir mounton;
 265         allow $2 user_home_t:file entrypoint;
 266
 267         allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
 268         allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
 269         manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 270         manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 271         manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 272         manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 273         manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 274         relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 275         relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 276         relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 277         relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 278         relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
 279         filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
 280         files_list_home($2)
 281
 282         # cjp: this should probably be removed:
 283         allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 284
 285         tunable_policy(`use_nfs_home_dirs',`
 286                 fs_mount_nfs($2)
 287                 fs_mounton_nfs($2)
 288                 fs_manage_nfs_dirs($2)
 289                 fs_manage_nfs_files($2)
 290                 fs_manage_nfs_symlinks($2)
 291                 fs_manage_nfs_named_sockets($2)
 292                 fs_manage_nfs_named_pipes($2)
 293         ')
 294
 295         tunable_policy(`use_samba_home_dirs',`
 296                 fs_mount_cifs($2)
 297                 fs_mounton_cifs($2)
 298                 fs_manage_cifs_dirs($2)
 299                 fs_manage_cifs_files($2)
 300                 fs_manage_cifs_symlinks($2)
 301                 fs_manage_cifs_named_sockets($2)
 302                 fs_manage_cifs_named_pipes($2)
 303         ')
 304 ')
 305
 306 #######################################
 307 ## <summary>
 308 ##      Manage user temporary files
 309 ## </summary>
 310 ## <param name="role">
 311 ##      <summary>
 312 ##      Role allowed access.
 313 ##      </summary>
 314 ## </param>
 315 ## <param name="domain">
 316 ##      <summary>
 317 ##      Domain allowed access.
 318 ##      </summary>
 319 ## </param>
 320 ## <rolebase/>
 321 #
 322 interface(`userdom_manage_tmp_role',`
 323         gen_require(`
 324                 attribute user_tmp_type;
 325                 type user_tmp_t;
 326         ')
 327
 328         role $1 types user_tmp_t;
 329
 330         files_poly_member_tmp($2, user_tmp_t)
 331
 332         manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
 333         manage_files_pattern($2, user_tmp_type, user_tmp_type)
 334         manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 335         manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 336         manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 337         files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
 338         relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 339         relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 340         relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
 341         relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
 342         relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 343 ')
 344
 345 #######################################
 346 ## <summary>
 347 ##      Dontaudit search of user bin dirs.
 348 ## </summary>
 349 ## <param name="domain">
 350 ##      <summary>
 351 ##      Domain to not audit.
 352 ##      </summary>
 353 ## </param>
 354 #
 355 interface(`userdom_dontaudit_search_user_bin_dirs',`
 356         gen_require(`
 357                 type home_bin_t;
 358         ')
 359
 360         dontaudit $1 home_bin_t:dir search_dir_perms;
 361 ')
 362
 363 #######################################
 364 ## <summary>
 365 ##      Execute user bin files.
 366 ## </summary>
 367 ## <param name="domain">
 368 ##      <summary>
 369 ##      Domain allowed access.
 370 ##      </summary>
 371 ## </param>
 372 #
 373 interface(`userdom_exec_user_bin_files',`
 374         gen_require(`
 375                 attribute user_home_type;
 376                 type home_bin_t, user_home_dir_t;
 377         ')
 378
 379         exec_files_pattern($1, { user_home_dir_t user_home_type }, home_bin_t)
 380         files_search_home($1)
 381 ')
 382
 383 #######################################
 384 ## <summary>
 385 ##      The execute access user temporary files.
 386 ## </summary>
 387 ## <param name="domain">
 388 ##      <summary>
 389 ##      Domain allowed access.
 390 ##      </summary>
 391 ## </param>
 392 ## <rolebase/>
 393 #
 394 interface(`userdom_exec_user_tmp_files',`
 395         gen_require(`
 396                 type user_tmp_t;
 397         ')
 398
 399         exec_files_pattern($1, user_tmp_t, user_tmp_t)
 400         dontaudit $1 user_tmp_t:sock_file execute;
 401         files_search_tmp($1)
 402 ')
 403
 404 #######################################
 405 ## <summary>
 406 ##      Role access for the user tmpfs type
 407 ##      that the user has full access.
 408 ## </summary>
 409 ## <desc>
 410 ##      <p>
 411 ##      Role access for the user tmpfs type
 412 ##      that the user has full access.
 413 ##      </p>
 414 ##      <p>
 415 ##      This does not allow execute access.
 416 ##      </p>
 417 ## </desc>
 418 ## <param name="role">
 419 ##      <summary>
 420 ##      Role allowed access.
 421 ##      </summary>
 422 ## </param>
 423 ## <param name="domain">
 424 ##      <summary>
 425 ##      Domain allowed access.
 426 ##      </summary>
 427 ## </param>
 428 ## <rolecap/>
 429 #
 430 interface(`userdom_manage_tmpfs_role',`
 431         gen_require(`
 432                 attribute user_tmpfs_type;
 433                 type user_tmpfs_t;
 434         ')
 435
 436         role $1 types user_tmpfs_t;
 437
 438         manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 439         manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 440         manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 441         manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 442         manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 443         fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 444         relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
 445         relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 446         relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 447         relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 448         relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 449 ')
 450
 451 #######################################
 452 ## <summary>
 453 ##      The interface allowing the user basic
 454 ##      network permissions
 455 ## </summary>
 456 ## <param name="userdomain">
 457 ##      <summary>
 458 ##      The user domain
 459 ##      </summary>
 460 ## </param>
 461 ## <rolebase/>
 462 #
 463 interface(`userdom_basic_networking',`
 464
 465         allow $1 self:tcp_socket create_stream_socket_perms;
 466         allow $1 self:udp_socket create_socket_perms;
 467
 468         corenet_all_recvfrom_unlabeled($1)
 469         corenet_all_recvfrom_netlabel($1)
 470         corenet_tcp_sendrecv_generic_if($1)
 471         corenet_udp_sendrecv_generic_if($1)
 472         corenet_tcp_sendrecv_generic_node($1)
 473         corenet_udp_sendrecv_generic_node($1)
 474         corenet_tcp_sendrecv_all_ports($1)
 475         corenet_udp_sendrecv_all_ports($1)
 476         corenet_tcp_connect_all_ports($1)
 477         corenet_sendrecv_all_client_packets($1)
 478
 479         optional_policy(`
 480                 init_tcp_recvfrom_all_daemons($1)
 481                 init_udp_recvfrom_all_daemons($1)
 482         ')
 483
 484         optional_policy(`
 485                 ipsec_match_default_spd($1)
 486         ')
 487
 488 ')
 489
 490 #######################################
 491 ## <summary>
 492 ##      The template for creating a user xwindows client.  (Deprecated)
 493 ## </summary>
 494 ## <param name="userdomain_prefix">
 495 ##      <summary>
 496 ##      The prefix of the user domain (e.g., user
 497 ##      is the prefix for user_t).
 498 ##      </summary>
 499 ## </param>
 500 ## <rolebase/>
 501 #
 502 template(`userdom_xwindows_client_template',`
 503         refpolicywarn(`$0() has been deprecated, please use xserver_role() instead.')
 504         gen_require(`
 505                 type $1_t, user_tmpfs_t;
 506         ')
 507
 508         dev_rw_xserver_misc($1_t)
 509         dev_rw_power_management($1_t)
 510         dev_read_input($1_t)
 511         dev_read_misc($1_t)
 512         dev_write_misc($1_t)
 513         # open office is looking for the following
 514         dev_getattr_agp_dev($1_t)
 515         dev_dontaudit_rw_dri($1_t)
 516         # GNOME checks for usb and other devices:
 517         dev_rw_usbfs($1_t)
 518         dev_rw_generic_usb_dev($1_t)
 519
 520         xserver_user_x_domain_template($1, $1_t, user_tmpfs_t)
 521         xserver_xsession_entry_type($1_t)
 522         xserver_dontaudit_write_log($1_t)
 523         xserver_stream_connect_xdm($1_t)
 524         # certain apps want to read xdm.pid file
 525         xserver_read_xdm_pid($1_t)
 526         # gnome-session creates socket under /tmp/.ICE-unix/
 527         xserver_create_xdm_tmp_sockets($1_t)
 528         # Needed for escd, remove if we get escd policy
 529         xserver_manage_xdm_tmp_files($1_t)
 530 ')
 531
 532 #######################################
 533 ## <summary>
 534 ##      The template for allowing the user to change passwords.
 535 ## </summary>
 536 ## <param name="userdomain_prefix">
 537 ##      <summary>
 538 ##      The prefix of the user domain (e.g., user
 539 ##      is the prefix for user_t).
 540 ##      </summary>
 541 ## </param>
 542 ## <rolebase/>
 543 #
 544 template(`userdom_change_password_template',`
 545         gen_require(`
 546                 type $1_t;
 547                 role $1_r;
 548         ')
 549
 550         optional_policy(`
 551                 usermanage_run_chfn($1_t,$1_r)
 552                 usermanage_run_passwd($1_t,$1_r)
 553         ')
 554 ')
 555
 556 #######################################
 557 ## <summary>
 558 ##      The template containing rules common to unprivileged
 559 ##      users and administrative users.
 560 ## </summary>
 561 ## <desc>
 562 ##      <p>
 563 ##      This template creates a user domain, types, and
 564 ##      rules for the user's tty, pty, tmp, and tmpfs files.
 565 ##      </p>
 566 ## </desc>
 567 ## <param name="userdomain_prefix">
 568 ##      <summary>
 569 ##      The prefix of the user domain (e.g., user
 570 ##      is the prefix for user_t).
 571 ##      </summary>
 572 ## </param>
 573 #
 574 template(`userdom_common_user_template',`
 575         gen_require(`
 576                 attribute unpriv_userdomain;
 577         ')
 578
 579         userdom_basic_networking($1_usertype)
 580
 581         ##############################
 582         #
 583         # User domain Local policy
 584         #
 585
 586         # evolution and gnome-session try to create a netlink socket
 587         dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
 588         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 589         allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
 590         allow $1_t self:socket create_socket_perms;
 591
 592         allow $1_usertype unpriv_userdomain:fd use;
 593
 594         kernel_read_system_state($1_usertype)
 595         kernel_read_network_state($1_usertype)
 596         kernel_read_software_raid_state($1_usertype)
 597         kernel_read_net_sysctls($1_usertype)
 598         # Very permissive allowing every domain to see every type:
 599         kernel_get_sysvipc_info($1_usertype)
 600         # Find CDROM devices:
 601         kernel_read_device_sysctls($1_usertype)
 602         kernel_request_load_module($1_usertype)
 603
 604         corenet_udp_bind_generic_node($1_usertype)
 605         corenet_udp_bind_generic_port($1_usertype)
 606
 607         dev_read_rand($1_usertype)
 608         dev_write_sound($1_usertype)
 609         dev_read_sound($1_usertype)
 610         dev_read_sound_mixer($1_usertype)
 611         dev_write_sound_mixer($1_usertype)
 612
 613         files_exec_etc_files($1_usertype)
 614         files_search_locks($1_usertype)
 615         # Check to see if cdrom is mounted
 616         files_search_mnt($1_usertype)
 617         # cjp: perhaps should cut back on file reads:
 618         files_read_var_files($1_usertype)
 619         files_read_var_symlinks($1_usertype)
 620         files_read_generic_spool($1_usertype)
 621         files_read_var_lib_files($1_usertype)
 622         # Stat lost+found.
 623         files_getattr_lost_found_dirs($1_usertype)
 624         files_read_config_files($1_usertype)
 625         fs_read_noxattr_fs_files($1_usertype)
 626         fs_read_noxattr_fs_symlinks($1_usertype)
 627         fs_rw_cgroup_files($1_usertype)
 628
 629         application_getattr_socket($1_usertype)
 630
 631         logging_send_syslog_msg($1_usertype)
 632         logging_send_audit_msgs($1_usertype)
 633         selinux_get_enforce_mode($1_usertype)
 634
 635         # cjp: some of this probably can be removed
 636         selinux_get_fs_mount($1_usertype)
 637         selinux_validate_context($1_usertype)
 638         selinux_compute_access_vector($1_usertype)
 639         selinux_compute_create_context($1_usertype)
 640         selinux_compute_relabel_context($1_usertype)
 641         selinux_compute_user_contexts($1_usertype)
 642
 643         # for eject
 644         storage_getattr_fixed_disk_dev($1_usertype)
 645
 646         auth_read_login_records($1_usertype)
 647         auth_run_pam($1_t,$1_r)
 648         auth_run_utempter($1_t,$1_r)
 649
 650         init_read_utmp($1_usertype)
 651
 652         seutil_read_file_contexts($1_usertype)
 653         seutil_read_default_contexts($1_usertype)
 654         seutil_run_newrole($1_t,$1_r)
 655         seutil_exec_checkpolicy($1_t)
 656         seutil_exec_setfiles($1_usertype)
 657         # for when the network connection is killed
 658         # this is needed when a login role can change
 659         # to this one.
 660         seutil_dontaudit_signal_newrole($1_t)
 661
 662         tunable_policy(`user_direct_mouse',`
 663                 dev_read_mouse($1_usertype)
 664         ')
 665
 666         tunable_policy(`user_ttyfile_stat',`
 667                 term_getattr_all_ttys($1_t)
 668         ')
 669
 670         optional_policy(`
 671                 alsa_read_rw_config($1_usertype)
 672                 alsa_manage_home_files($1_t)
 673                 alsa_relabel_home_files($1_t)
 674         ')
 675
 676         optional_policy(`
 677                 # Allow graphical boot to check battery lifespan
 678                 apm_stream_connect($1_usertype)
 679         ')
 680
 681         optional_policy(`
 682                 canna_stream_connect($1_usertype)
 683         ')
 684
 685         optional_policy(`
 686                 chrome_role($1_r, $1_usertype)
 687         ')
 688
 689         optional_policy(`
 690                 colord_read_lib_files($1_usertype)
 691         ')
 692
 693         optional_policy(`
 694                 dbus_system_bus_client($1_usertype)
 695
 696                 allow $1_usertype $1_usertype:dbus  send_msg;
 697
 698                 optional_policy(`
 699                         avahi_dbus_chat($1_usertype)
 700                 ')
 701
 702                 optional_policy(`
 703                         policykit_dbus_chat($1_usertype)
 704                 ')
 705
 706                 optional_policy(`
 707                         bluetooth_dbus_chat($1_usertype)
 708                 ')
 709
 710                 optional_policy(`
 711                         consolekit_dbus_chat($1_usertype)
 712                         consolekit_read_log($1_usertype)
 713                 ')
 714
 715                 optional_policy(`
 716                         devicekit_dbus_chat($1_usertype)
 717                         devicekit_dbus_chat_power($1_usertype)
 718                         devicekit_dbus_chat_disk($1_usertype)
 719                 ')
 720
 721                 optional_policy(`
 722                         evolution_dbus_chat($1_usertype)
 723                         evolution_alarm_dbus_chat($1_usertype)
 724                 ')
 725
 726                 optional_policy(`
 727                         gnome_dbus_chat_gconfdefault($1_usertype)
 728                 ')
 729
 730                 optional_policy(`
 731                         hal_dbus_chat($1_usertype)
 732                 ')
 733
 734                 optional_policy(`
 735                         kde_dbus_chat_backlighthelper($1_usertype)
 736                 ')
 737
 738                 optional_policy(`
 739                         modemmanager_dbus_chat($1_usertype)
 740                 ')
 741
 742                 optional_policy(`
 743                         networkmanager_dbus_chat($1_usertype)
 744                         networkmanager_read_lib_files($1_usertype)
 745                 ')
 746
 747                 optional_policy(`
 748                         vpn_dbus_chat($1_usertype)
 749                 ')
 750         ')
 751
 752         optional_policy(`
 753                 git_session_role($1_r, $1_usertype)
 754         ')
 755
 756         optional_policy(`
 757                 inetd_use_fds($1_usertype)
 758                 inetd_rw_tcp_sockets($1_usertype)
 759         ')
 760
 761         optional_policy(`
 762                 inn_read_config($1_usertype)
 763                 inn_read_news_lib($1_usertype)
 764                 inn_read_news_spool($1_usertype)
 765         ')
 766
 767         optional_policy(`
 768                 lircd_stream_connect($1_usertype)
 769         ')
 770
 771         optional_policy(`
 772                 locate_read_lib_files($1_usertype)
 773         ')
 774
 775         # for running depmod as part of the kernel packaging process
 776         optional_policy(`
 777                 modutils_read_module_config($1_usertype)
 778         ')
 779
 780         optional_policy(`
 781                 mta_rw_spool($1_usertype)
 782                 mta_manage_queue($1_usertype)
 783                 mta_filetrans_home_content($1_usertype)
 784         ')
 785
 786         optional_policy(`
 787                 nsplugin_role($1_r, $1_usertype)
 788         ')
 789
 790         optional_policy(`
 791                 tunable_policy(`allow_user_mysql_connect',`
 792                         mysql_stream_connect($1_t)
 793                 ')
 794         ')
 795
 796         optional_policy(`
 797                 oident_manage_user_content($1_t)
 798                 oident_relabel_user_content($1_t)
 799         ')
 800
 801         optional_policy(`
 802                 # to allow monitoring of pcmcia status
 803                 pcmcia_read_pid($1_usertype)
 804         ')
 805
 806         optional_policy(`
 807                 pcscd_read_pub_files($1_usertype)
 808                 pcscd_stream_connect($1_usertype)
 809         ')
 810
 811         optional_policy(`
 812                 tunable_policy(`allow_user_postgresql_connect',`
 813                         postgresql_stream_connect($1_usertype)
 814                         postgresql_tcp_connect($1_usertype)
 815                 ')
 816         ')
 817
 818         optional_policy(`
 819                 resmgr_stream_connect($1_usertype)
 820         ')
 821
 822         optional_policy(`
 823                 rpc_dontaudit_getattr_exports($1_usertype)
 824                 rpc_manage_nfs_rw_content($1_usertype)
 825         ')
 826
 827         optional_policy(`
 828                 rpcbind_stream_connect($1_usertype)
 829         ')
 830
 831         optional_policy(`
 832                 samba_stream_connect_winbind($1_usertype)
 833         ')
 834
 835         optional_policy(`
 836                 sandbox_transition($1_usertype, $1_r)
 837         ')
 838
 839         optional_policy(`
 840                 seunshare_role_template($1, $1_r, $1_t)
 841         ')
 842
 843         optional_policy(`
 844                 slrnpull_search_spool($1_usertype)
 845         ')
 846
 847 ')
 848
 849 #######################################
 850 ## <summary>
 851 ##      The template for creating a login user.
 852 ## </summary>
 853 ## <desc>
 854 ##      <p>
 855 ##      This template creates a user domain, types, and
 856 ##      rules for the user's tty, pty, home directories,
 857 ##      tmp, and tmpfs files.
 858 ##      </p>
 859 ## </desc>
 860 ## <param name="userdomain_prefix">
 861 ##      <summary>
 862 ##      The prefix of the user domain (e.g., user
 863 ##      is the prefix for user_t).
 864 ##      </summary>
 865 ## </param>
 866 #
 867 template(`userdom_login_user_template', `
 868         gen_require(`
 869                 class context contains;
 870         ')
 871
 872         userdom_base_user_template($1)
 873
 874         userdom_manage_home_role($1_r, $1_usertype)
 875
 876         userdom_manage_tmp_role($1_r, $1_usertype)
 877         userdom_manage_tmpfs_role($1_r, $1_usertype)
 878
 879         ifelse(`$1',`unconfined',`',`
 880                 gen_tunable(allow_$1_exec_content, true)
 881
 882                 tunable_policy(`allow_$1_exec_content',`
 883                         userdom_exec_user_tmp_files($1_usertype)
 884                         userdom_exec_user_home_content_files($1_usertype)
 885                 ')
 886                 tunable_policy(`allow_$1_exec_content && use_nfs_home_dirs',`
 887                         fs_exec_nfs_files($1_usertype)
 888                 ')
 889
 890                 tunable_policy(`allow_$1_exec_content && use_samba_home_dirs',`
 891                         fs_exec_cifs_files($1_usertype)
 892                 ')
 893         ')
 894
 895         userdom_change_password_template($1)
 896
 897         ##############################
 898         #
 899         # User domain Local policy
 900         #
 901
 902         allow $1_t self:capability { setgid chown fowner };
 903         dontaudit $1_t self:capability { sys_nice fsetid };
 904
 905         allow $1_t self:process ~{ setcurrent setexec setrlimit execmem execstack execheap };
 906         dontaudit $1_t self:process setrlimit;
 907         dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
 908
 909         allow $1_t self:context contains;
 910
 911         kernel_dontaudit_read_system_state($1_usertype)
 912         kernel_dontaudit_list_all_proc($1_usertype)
 913
 914         dev_read_sysfs($1_usertype)
 915         dev_read_urand($1_usertype)
 916
 917         domain_use_interactive_fds($1_usertype)
 918         # Command completion can fire hundreds of denials
 919         domain_dontaudit_exec_all_entry_files($1_usertype)
 920
 921         files_dontaudit_list_default($1_usertype)
 922         files_dontaudit_read_default_files($1_usertype)
 923         # Stat lost+found.
 924         files_getattr_lost_found_dirs($1_usertype)
 925
 926         fs_get_all_fs_quotas($1_usertype)
 927         fs_getattr_all_fs($1_usertype)
 928         fs_search_all($1_usertype)
 929         fs_list_inotifyfs($1_usertype)
 930         fs_rw_anon_inodefs_files($1_usertype)
 931
 932         auth_dontaudit_write_login_records($1_t)
 933         auth_rw_cache($1_t)
 934
 935         application_exec_all($1_t)
 936         # The library functions always try to open read-write first,
 937         # then fall back to read-only if it fails.
 938         init_dontaudit_rw_utmp($1_t)
 939
 940         # Stop warnings about access to /dev/console
 941         init_dontaudit_use_fds($1_usertype)
 942         init_dontaudit_use_script_fds($1_usertype)
 943
 944         libs_exec_lib_files($1_usertype)
 945
 946         logging_dontaudit_getattr_all_logs($1_usertype)
 947
 948         # for running TeX programs
 949         miscfiles_read_tetex_data($1_usertype)
 950         miscfiles_exec_tetex_data($1_usertype)
 951
 952         seutil_read_config($1_usertype)
 953
 954         optional_policy(`
 955                 cups_read_config($1_usertype)
 956                 cups_stream_connect($1_usertype)
 957                 cups_stream_connect_ptal($1_usertype)
 958         ')
 959
 960         optional_policy(`
 961                 kerberos_use($1_usertype)
 962                 kerberos_filetrans_home_content($1_usertype)
 963         ')
 964
 965         optional_policy(`
 966                 mta_dontaudit_read_spool_symlinks($1_usertype)
 967         ')
 968
 969         optional_policy(`
 970                 quota_dontaudit_getattr_db($1_usertype)
 971         ')
 972
 973         optional_policy(`
 974                 rpm_read_db($1_usertype)
 975                 rpm_dontaudit_manage_db($1_usertype)
 976                 rpm_read_cache($1_usertype)
 977         ')
 978
 979         optional_policy(`
 980                 oddjob_run_mkhomedir($1_t, $1_r)
 981         ')
 982 ')
 983
 984 #######################################
 985 ## <summary>
 986 ##      The template for creating a unprivileged login user.
 987 ## </summary>
 988 ## <desc>
 989 ##      <p>
 990 ##      This template creates a user domain, types, and
 991 ##      rules for the user's tty, pty, home directories,
 992 ##      tmp, and tmpfs files.
 993 ##      </p>
 994 ## </desc>
 995 ## <param name="userdomain_prefix">
 996 ##      <summary>
 997 ##      The prefix of the user domain (e.g., user
 998 ##      is the prefix for user_t).
 999 ##      </summary>
1000 ## </param>
1001 #
1002 template(`userdom_restricted_user_template',`
1003         gen_require(`
1004                 attribute unpriv_userdomain;
1005         ')
1006
1007         userdom_login_user_template($1)
1008
1009         typeattribute $1_t unpriv_userdomain;
1010         domain_interactive_fd($1_t)
1011
1012         allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
1013         dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
1014
1015         ##############################
1016         #
1017         # Local policy
1018         #
1019
1020         optional_policy(`
1021                 loadkeys_run($1_t, $1_r)
1022         ')
1023 ')
1024
1025 #######################################
1026 ## <summary>
1027 ##      The template for creating a unprivileged xwindows login user.
1028 ## </summary>
1029 ## <desc>
1030 ##      <p>
1031 ##      The template for creating a unprivileged xwindows login user.
1032 ##      </p>
1033 ##      <p>
1034 ##      This template creates a user domain, types, and
1035 ##      rules for the user's tty, pty, home directories,
1036 ##      tmp, and tmpfs files.
1037 ##      </p>
1038 ## </desc>
1039 ## <param name="userdomain_prefix">
1040 ##      <summary>
1041 ##      The prefix of the user domain (e.g., user
1042 ##      is the prefix for user_t).
1043 ##      </summary>
1044 ## </param>
1045 #
1046 template(`userdom_restricted_xwindows_user_template',`
1047
1048         userdom_restricted_user_template($1)
1049
1050         ##############################
1051         #
1052         # Local policy
1053         #
1054
1055         auth_role($1_r, $1_t)
1056         auth_search_pam_console_data($1_usertype)
1057         auth_dontaudit_read_login_records($1_usertype)
1058
1059         dev_read_sound($1_usertype)
1060         dev_write_sound($1_usertype)
1061         # gnome keyring wants to read this.
1062         dev_dontaudit_read_rand($1_usertype)
1063         # temporarily allow since openoffice requires this
1064         dev_read_rand($1_usertype)
1065
1066         dev_read_video_dev($1_usertype)
1067         dev_write_video_dev($1_usertype)
1068         dev_rw_wireless($1_usertype)
1069
1070         libs_dontaudit_setattr_lib_files($1_usertype)
1071
1072         tunable_policy(`user_rw_noexattrfile',`
1073                 dev_rw_usbfs($1_t)
1074                 dev_rw_generic_usb_dev($1_usertype)
1075
1076                 fs_manage_noxattr_fs_files($1_usertype)
1077                 fs_manage_noxattr_fs_dirs($1_usertype)
1078                 fs_manage_dos_dirs($1_usertype)
1079                 fs_manage_dos_files($1_usertype)
1080                 storage_raw_read_removable_device($1_usertype)
1081                 storage_raw_write_removable_device($1_usertype)
1082         ')
1083
1084         logging_send_syslog_msg($1_usertype)
1085         logging_dontaudit_send_audit_msgs($1_t)
1086
1087         # Need to to this just so screensaver will work. Should be moved to screensaver domain
1088         logging_send_audit_msgs($1_t)
1089         selinux_get_enforce_mode($1_t)
1090         seutil_exec_restorecond($1_t)
1091         seutil_read_file_contexts($1_t)
1092         seutil_read_default_contexts($1_t)
1093
1094         xserver_restricted_role($1_r, $1_t)
1095
1096         optional_policy(`
1097                 alsa_read_rw_config($1_usertype)
1098         ')
1099
1100          # cjp: needed by KDE apps
1101          # bug: #682499
1102          optional_policy(`
1103                 gnome_read_usr_config($1_usertype)
1104                 gnome_role_gkeyringd($1, $1_r, $1_t)
1105                 # cjp: telepathy F15 bugs
1106                 telepathy_role($1_r, $1_t, $1)
1107         ')
1108
1109         optional_policy(`
1110                 dbus_role_template($1, $1_r, $1_usertype)
1111                 dbus_system_bus_client($1_usertype)
1112                 allow $1_usertype $1_usertype:dbus send_msg;
1113
1114                 optional_policy(`
1115                         abrt_dbus_chat($1_usertype)
1116                         abrt_run_helper($1_usertype, $1_r)
1117                 ')
1118
1119                 optional_policy(`
1120                         consolekit_dontaudit_read_log($1_usertype)
1121                         consolekit_dbus_chat($1_usertype)
1122                 ')
1123
1124                 optional_policy(`
1125                         cups_dbus_chat($1_usertype)
1126                         cups_dbus_chat_config($1_usertype)
1127                 ')
1128
1129                 optional_policy(`
1130                         devicekit_dbus_chat($1_usertype)
1131                         devicekit_dbus_chat_disk($1_usertype)
1132                         devicekit_dbus_chat_power($1_usertype)
1133                 ')
1134
1135                 optional_policy(`
1136                         fprintd_dbus_chat($1_t)
1137                 ')
1138         ')
1139
1140         optional_policy(`
1141                 openoffice_role_template($1, $1_r, $1_usertype)
1142         ')
1143
1144         optional_policy(`
1145                 policykit_role($1_r, $1_usertype)
1146         ')
1147
1148         optional_policy(`
1149                 pulseaudio_role($1_r, $1_usertype)
1150                 pulseaudio_filetrans_admin_home_content($1_usertype)
1151                 pulseaudio_filetrans_home_content($1_usertype)
1152         ')
1153
1154         optional_policy(`
1155                 rtkit_scheduled($1_usertype)
1156         ')
1157
1158         optional_policy(`
1159                 setroubleshoot_dontaudit_stream_connect($1_t)
1160         ')
1161
1162         optional_policy(`
1163                 udev_read_db($1_usertype)
1164         ')
1165
1166         optional_policy(`
1167                 wm_role_template($1, $1_r, $1_t)
1168         ')
1169 ')
1170
1171 #######################################
1172 ## <summary>
1173 ##      The template for creating a unprivileged user roughly
1174 ##      equivalent to a regular linux user.
1175 ## </summary>
1176 ## <desc>
1177 ##      <p>
1178 ##      The template for creating a unprivileged user roughly
1179 ##      equivalent to a regular linux user.
1180 ##      </p>
1181 ##      <p>
1182 ##      This template creates a user domain, types, and
1183 ##      rules for the user's tty, pty, home directories,
1184 ##      tmp, and tmpfs files.
1185 ##      </p>
1186 ## </desc>
1187 ## <param name="userdomain_prefix">
1188 ##      <summary>
1189 ##      The prefix of the user domain (e.g., user
1190 ##      is the prefix for user_t).
1191 ##      </summary>
1192 ## </param>
1193 #
1194 template(`userdom_unpriv_user_template', `
1195
1196         ##############################
1197         #
1198         # Declarations
1199         #
1200
1201         # Inherit rules for ordinary users.
1202         userdom_restricted_xwindows_user_template($1)
1203         userdom_common_user_template($1)
1204
1205         ##############################
1206         #
1207         # Local policy
1208         #
1209
1210         # port access is audited even if dac would not have allowed it, so dontaudit it here
1211 #       corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
1212         # Need the following rule to allow users to run vpnc
1213         corenet_tcp_bind_xserver_port($1_t)
1214         corenet_tcp_bind_generic_node($1_usertype)
1215
1216         storage_rw_fuse($1_t)
1217
1218         files_exec_usr_files($1_t)
1219    # cjp: why?
1220         files_read_kernel_symbol_table($1_t)
1221
1222         ifndef(`enable_mls',`
1223                 fs_exec_noxattr($1_t)
1224
1225                 tunable_policy(`user_rw_noexattrfile',`
1226                         fs_manage_noxattr_fs_files($1_t)
1227                         fs_manage_noxattr_fs_dirs($1_t)
1228                         # Write floppies
1229                         storage_raw_read_removable_device($1_t)
1230                         storage_raw_write_removable_device($1_t)
1231                 ',`
1232                         storage_raw_read_removable_device($1_t)
1233                 ')
1234         ')
1235
1236         miscfiles_read_hwdata($1_usertype)
1237
1238         # Allow users to run TCP servers (bind to ports and accept connection from
1239         # the same domain and outside users) disabling this forces FTP passive mode
1240         # and may change other protocols
1241
1242         tunable_policy(`user_share_music',`
1243                 corenet_tcp_bind_daap_port($1_usertype)
1244         ')
1245
1246         tunable_policy(`user_tcp_server',`
1247                 corenet_tcp_bind_all_unreserved_ports($1_usertype)
1248         ')
1249
1250         tunable_policy(`user_setrlimit',`
1251                 allow $1_usertype self:process setrlimit;
1252         ')
1253
1254         optional_policy(`
1255                 cdrecord_role($1_r, $1_t)
1256         ')
1257
1258         optional_policy(`
1259                 cron_role($1_r, $1_t)
1260         ')
1261
1262         optional_policy(`
1263                 games_rw_data($1_usertype)
1264         ')
1265
1266         optional_policy(`
1267                 gpg_role($1_r, $1_usertype)
1268         ')
1269
1270         optional_policy(`
1271                 gnomeclock_dbus_chat($1_t)
1272         ')
1273
1274         optional_policy(`
1275                 gpm_stream_connect($1_usertype)
1276         ')
1277
1278         optional_policy(`
1279                 execmem_role_template($1, $1_r, $1_t)
1280         ')
1281
1282         optional_policy(`
1283                 java_role_template($1, $1_r, $1_t)
1284         ')
1285
1286         optional_policy(`
1287                 mono_role_template($1, $1_r, $1_t)
1288         ')
1289
1290         optional_policy(`
1291                 mount_run_fusermount($1_t, $1_r)
1292                 mount_read_pid_files($1_t)
1293         ')
1294
1295         optional_policy(`
1296                 wine_role_template($1, $1_r, $1_t)
1297         ')
1298
1299         optional_policy(`
1300                 postfix_run_postdrop($1_t, $1_r)
1301         ')
1302
1303         # Run pppd in pppd_t by default for user
1304         optional_policy(`
1305                 ppp_run_cond($1_t, $1_r)
1306         ')
1307 ')
1308
1309 #######################################
1310 ## <summary>
1311 ##      The template for creating an administrative user.
1312 ## </summary>
1313 ## <desc>
1314 ##      <p>
1315 ##      This template creates a user domain, types, and
1316 ##      rules for the user's tty, pty, home directories,
1317 ##      tmp, and tmpfs files.
1318 ##      </p>
1319 ##      <p>
1320 ##      The privileges given to administrative users are:
1321 ##      <ul>
1322 ##              <li>Raw disk access</li>
1323 ##              <li>Set all sysctls</li>
1324 ##              <li>All kernel ring buffer controls</li>
1325 ##              <li>Create, read, write, and delete all files but shadow</li>
1326 ##              <li>Manage source and binary format SELinux policy</li>
1327 ##              <li>Run insmod</li>
1328 ##      </ul>
1329 ##      </p>
1330 ## </desc>
1331 ## <param name="userdomain_prefix">
1332 ##      <summary>
1333 ##      The prefix of the user domain (e.g., sysadm
1334 ##      is the prefix for sysadm_t).
1335 ##      </summary>
1336 ## </param>
1337 #
1338 template(`userdom_admin_user_template',`
1339         gen_require(`
1340                 attribute admindomain;
1341                 class passwd { passwd chfn chsh rootok crontab };
1342         ')
1343
1344         ##############################
1345         #
1346         # Declarations
1347         #
1348
1349         # Inherit rules for ordinary users.
1350         userdom_login_user_template($1)
1351         userdom_common_user_template($1)
1352
1353         domain_obj_id_change_exemption($1_t)
1354         role system_r types $1_t;
1355
1356         typeattribute $1_t admindomain;
1357
1358         ifdef(`direct_sysadm_daemon',`
1359                 domain_system_change_exemption($1_t)
1360         ')
1361
1362         ##############################
1363         #
1364         # $1_t local policy
1365         #
1366
1367         allow $1_t self:capability ~{ sys_module audit_control audit_write };
1368         allow $1_t self:capability2 syslog;
1369         allow $1_t self:process { setexec setfscreate };
1370         allow $1_t self:netlink_audit_socket nlmsg_readpriv;
1371         allow $1_t self:tun_socket create;
1372         # Set password information for other users.
1373         allow $1_t self:passwd { passwd chfn chsh };
1374         # Skip authentication when pam_rootok is specified.
1375         allow $1_t self:passwd rootok;
1376
1377         # Manipulate other users crontab.
1378         allow $1_t self:passwd crontab;
1379
1380         kernel_read_software_raid_state($1_t)
1381         kernel_getattr_core_if($1_t)
1382         kernel_getattr_message_if($1_t)
1383         kernel_change_ring_buffer_level($1_t)
1384         kernel_clear_ring_buffer($1_t)
1385         kernel_read_ring_buffer($1_t)
1386         kernel_get_sysvipc_info($1_t)
1387         kernel_rw_all_sysctls($1_t)
1388         # signal unlabeled processes:
1389         kernel_kill_unlabeled($1_t)
1390         kernel_signal_unlabeled($1_t)
1391         kernel_sigstop_unlabeled($1_t)
1392         kernel_signull_unlabeled($1_t)
1393         kernel_sigchld_unlabeled($1_t)
1394         kernel_signal($1_t)
1395
1396         corenet_tcp_bind_generic_port($1_t)
1397         # allow setting up tunnels
1398         corenet_rw_tun_tap_dev($1_t)
1399
1400         dev_getattr_generic_blk_files($1_t)
1401         dev_getattr_generic_chr_files($1_t)
1402         # for lsof
1403         dev_getattr_mtrr_dev($1_t)
1404         # Allow MAKEDEV to work
1405         dev_create_all_blk_files($1_t)
1406         dev_create_all_chr_files($1_t)
1407         dev_delete_all_blk_files($1_t)
1408         dev_delete_all_chr_files($1_t)
1409         dev_rename_all_blk_files($1_t)
1410         dev_rename_all_chr_files($1_t)
1411         dev_create_generic_symlinks($1_t)
1412         dev_rw_generic_usb_dev($1_t)
1413         dev_rw_usbfs($1_t)
1414
1415         domain_setpriority_all_domains($1_t)
1416         domain_read_all_domains_state($1_t)
1417         domain_getattr_all_domains($1_t)
1418         domain_getcap_all_domains($1_t)
1419         domain_dontaudit_ptrace_all_domains($1_t)
1420         # signal all domains:
1421         domain_kill_all_domains($1_t)
1422         domain_signal_all_domains($1_t)
1423         domain_signull_all_domains($1_t)
1424         domain_sigstop_all_domains($1_t)
1425         domain_sigstop_all_domains($1_t)
1426         domain_sigchld_all_domains($1_t)
1427         # for lsof
1428         domain_getattr_all_sockets($1_t)
1429         domain_dontaudit_getattr_all_sockets($1_t)
1430
1431         files_exec_usr_src_files($1_t)
1432
1433         fs_getattr_all_fs($1_t)
1434         fs_getattr_all_files($1_t)
1435         fs_list_all($1_t)
1436         fs_set_all_quotas($1_t)
1437         fs_exec_noxattr($1_t)
1438
1439         storage_raw_read_removable_device($1_t)
1440         storage_raw_write_removable_device($1_t)
1441         storage_dontaudit_read_fixed_disk($1_t)
1442
1443         term_use_all_inherited_terms($1_t)
1444         term_use_unallocated_ttys($1_t)
1445
1446         auth_getattr_shadow($1_t)
1447         # Manage almost all files
1448         auth_manage_all_files_except_shadow($1_t)
1449         # Relabel almost all files
1450         auth_relabel_all_files_except_shadow($1_t)
1451
1452         init_telinit($1_t)
1453
1454         logging_send_syslog_msg($1_t)
1455
1456         optional_policy(`
1457                 modutils_domtrans_insmod($1_t)
1458                 modutils_domtrans_depmod($1_t)
1459         ')
1460
1461         # The following rule is temporary until such time that a complete
1462         # policy management infrastructure is in place so that an administrator
1463         # cannot directly manipulate policy files with arbitrary programs.
1464         seutil_manage_src_policy($1_t)
1465         # Violates the goal of limiting write access to checkpolicy.
1466         # But presently necessary for installing the file_contexts file.
1467         seutil_manage_bin_policy($1_t)
1468
1469         systemd_config_all_services($1_t)
1470
1471         userdom_manage_user_home_content_dirs($1_t)
1472         userdom_manage_user_home_content_files($1_t)
1473         userdom_manage_user_home_content_symlinks($1_t)
1474         userdom_manage_user_home_content_pipes($1_t)
1475         userdom_manage_user_home_content_sockets($1_t)
1476         userdom_user_home_dir_filetrans_user_home_content($1_t, { dir file lnk_file fifo_file sock_file })
1477
1478         tunable_policy(`user_rw_noexattrfile',`
1479                 fs_manage_noxattr_fs_files($1_t)
1480                 fs_manage_noxattr_fs_dirs($1_t)
1481         ',`
1482                 fs_read_noxattr_fs_files($1_t)
1483         ')
1484
1485         optional_policy(`
1486                 postgresql_unconfined($1_t)
1487         ')
1488
1489         optional_policy(`
1490                 userhelper_exec($1_t)
1491         ')
1492 ')
1493
1494 ########################################
1495 ## <summary>
1496 ##      Allow user to run as a secadm
1497 ## </summary>
1498 ## <desc>
1499 ##      <p>
1500 ##      Create objects in a user home directory
1501 ##      with an automatic type transition to
1502 ##      a specified private type.
1503 ##      </p>
1504 ##      <p>
1505 ##      This is a templated interface, and should only
1506 ##      be called from a per-userdomain template.
1507 ##      </p>
1508 ## </desc>
1509 ## <param name="domain">
1510 ##      <summary>
1511 ##      Domain allowed access.
1512 ##      </summary>
1513 ## </param>
1514 ## <param name="role">
1515 ##      <summary>
1516 ##      The role  of the object to create.
1517 ##      </summary>
1518 ## </param>
1519 #
1520 template(`userdom_security_admin_template',`
1521         allow $1 self:capability { dac_read_search dac_override };
1522
1523         corecmd_exec_shell($1)
1524
1525         domain_obj_id_change_exemption($1)
1526
1527         dev_relabel_all_dev_nodes($1)
1528
1529         files_create_boot_flag($1)
1530         files_create_default_dir($1)
1531         files_root_filetrans_default($1, dir)
1532
1533         # Necessary for managing /boot/efi
1534         fs_manage_dos_files($1)
1535
1536         mls_process_read_up($1)
1537         mls_file_read_all_levels($1)
1538         mls_file_upgrade($1)
1539         mls_file_downgrade($1)
1540
1541         selinux_set_enforce_mode($1)
1542         selinux_set_all_booleans($1)
1543         selinux_set_parameters($1)
1544         selinux_read_policy($1)
1545
1546         auth_relabel_all_files_except_shadow($1)
1547         auth_relabel_shadow($1)
1548
1549         init_exec($1)
1550
1551         logging_send_syslog_msg($1)
1552         logging_read_audit_log($1)
1553         logging_read_generic_logs($1)
1554         logging_read_audit_config($1)
1555
1556         seutil_manage_bin_policy($1)
1557         seutil_manage_default_contexts($1)
1558         seutil_manage_file_contexts($1)
1559         seutil_manage_module_store($1)
1560         seutil_manage_config($1)
1561         seutil_run_checkpolicy($1,$2)
1562         seutil_run_loadpolicy($1,$2)
1563         seutil_run_semanage($1,$2)
1564         seutil_run_setsebool($1,$2)
1565         seutil_run_setfiles($1, $2)
1566
1567         seutil_manage_bin_policy($1)
1568     seutil_manage_default_contexts($1)
1569     seutil_manage_file_contexts($1)
1570     seutil_manage_module_store($1)
1571     seutil_manage_config($1)
1572
1573         optional_policy(`
1574                 aide_run($1,$2)
1575         ')
1576
1577         optional_policy(`
1578                 consoletype_exec($1)
1579         ')
1580
1581         optional_policy(`
1582                 dmesg_exec($1)
1583         ')
1584
1585         optional_policy(`
1586                 ipsec_run_setkey($1,$2)
1587         ')
1588
1589         optional_policy(`
1590                 netlabel_run_mgmt($1,$2)
1591         ')
1592
1593         optional_policy(`
1594                 samhain_run($1, $2)
1595         ')
1596 ')
1597
1598 ########################################
1599 ## <summary>
1600 ##      Make the specified type usable in a
1601 ##      user home directory.
1602 ## </summary>
1603 ## <param name="type">
1604 ##      <summary>
1605 ##      Type to be used as a file in the
1606 ##      user home directory.
1607 ##      </summary>
1608 ## </param>
1609 #
1610 interface(`userdom_user_home_content',`
1611         gen_require(`
1612                 type user_home_t;
1613                 attribute user_home_type;
1614         ')
1615
1616         allow $1 user_home_t:filesystem associate;
1617         files_type($1)
1618         ubac_constrained($1)
1619
1620         files_poly_member($1)
1621         typeattribute $1  user_home_type;
1622 ')
1623
1624 ########################################
1625 ## <summary>
1626 ##      Make the specified type usable in a
1627 ##      generic temporary directory.
1628 ## </summary>
1629 ## <param name="type">
1630 ##      <summary>
1631 ##      Type to be used as a file in the
1632 ##      generic temporary directory.
1633 ##      </summary>
1634 ## </param>
1635 #
1636 interface(`userdom_user_tmp_content',`
1637         gen_require(`
1638                 attribute user_tmp_type;
1639         ')
1640
1641         typeattribute $1 user_tmp_type;
1642
1643         files_tmp_file($1)
1644         ubac_constrained($1)
1645 ')
1646
1647 ########################################
1648 ## <summary>
1649 ##      Make the specified type usable in a
1650 ##      generic tmpfs_t directory.
1651 ## </summary>
1652 ## <param name="type">
1653 ##      <summary>
1654 ##      Type to be used as a file in the
1655 ##      generic temporary directory.
1656 ##      </summary>
1657 ## </param>
1658 #
1659 interface(`userdom_user_tmpfs_content',`
1660         gen_require(`
1661                 attribute user_tmpfs_type;
1662         ')
1663
1664         typeattribute $1 user_tmpfs_type;
1665
1666         files_tmpfs_file($1)
1667         ubac_constrained($1)
1668 ')
1669
1670 ########################################
1671 ## <summary>
1672 ##      Allow domain to attach to TUN devices created by administrative users.
1673 ## </summary>
1674 ## <param name="domain">
1675 ##      <summary>
1676 ##      Domain allowed access.
1677 ##      </summary>
1678 ## </param>
1679 #
1680 interface(`userdom_attach_admin_tun_iface',`
1681         gen_require(`
1682                 attribute admindomain;
1683         ')
1684
1685         allow $1 admindomain:tun_socket relabelfrom;
1686         allow $1 self:tun_socket relabelto;
1687 ')
1688
1689 ########################################
1690 ## <summary>
1691 ##      Set the attributes of a user pty.
1692 ## </summary>
1693 ## <param name="domain">
1694 ##      <summary>
1695 ##      Domain allowed access.
1696 ##      </summary>
1697 ## </param>
1698 #
1699 interface(`userdom_setattr_user_ptys',`
1700         gen_require(`
1701                 type user_devpts_t;
1702         ')
1703
1704         allow $1 user_devpts_t:chr_file setattr_chr_file_perms;
1705 ')
1706
1707 ########################################
1708 ## <summary>
1709 ##      Create a user pty.
1710 ## </summary>
1711 ## <param name="domain">
1712 ##      <summary>
1713 ##      Domain allowed access.
1714 ##      </summary>
1715 ## </param>
1716 #
1717 interface(`userdom_create_user_pty',`
1718         gen_require(`
1719                 type user_devpts_t;
1720         ')
1721
1722         term_create_pty($1, user_devpts_t)
1723 ')
1724
1725 ########################################
1726 ## <summary>
1727 ##      Get the attributes of user home directories.
1728 ## </summary>
1729 ## <param name="domain">
1730 ##      <summary>
1731 ##      Domain allowed access.
1732 ##      </summary>
1733 ## </param>
1734 #
1735 interface(`userdom_getattr_user_home_dirs',`
1736         gen_require(`
1737                 type user_home_dir_t;
1738         ')
1739
1740         allow $1 user_home_dir_t:dir getattr_dir_perms;
1741         files_search_home($1)
1742 ')
1743
1744 ########################################
1745 ## <summary>
1746 ##      Do not audit attempts to get the attributes of user home directories.
1747 ## </summary>
1748 ## <param name="domain">
1749 ##      <summary>
1750 ##      Domain to not audit.
1751 ##      </summary>
1752 ## </param>
1753 #
1754 interface(`userdom_dontaudit_getattr_user_home_dirs',`
1755         gen_require(`
1756                 type user_home_dir_t;
1757         ')
1758
1759         dontaudit $1 user_home_dir_t:dir getattr_dir_perms;
1760 ')
1761
1762 ########################################
1763 ## <summary>
1764 ##      Search user home directories.
1765 ## </summary>
1766 ## <param name="domain">
1767 ##      <summary>
1768 ##      Domain allowed access.
1769 ##      </summary>
1770 ## </param>
1771 #
1772 interface(`userdom_search_user_home_dirs',`
1773         gen_require(`
1774                 type user_home_dir_t;
1775         ')
1776
1777         allow $1 user_home_dir_t:dir search_dir_perms;
1778         allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
1779         files_search_home($1)
1780 ')
1781
1782 ########################################
1783 ## <summary>
1784 ##      Do not audit attempts to search user home directories.
1785 ## </summary>
1786 ## <desc>
1787 ##      <p>
1788 ##      Do not audit attempts to search user home directories.
1789 ##      This will supress SELinux denial messages when the specified
1790 ##      domain is denied the permission to search these directories.
1791 ##      </p>
1792 ## </desc>
1793 ## <param name="domain">
1794 ##      <summary>
1795 ##      Domain to not audit.
1796 ##      </summary>
1797 ## </param>
1798 ## <infoflow type="none"/>
1799 #
1800 interface(`userdom_dontaudit_search_user_home_dirs',`
1801         gen_require(`
1802                 type user_home_dir_t;
1803         ')
1804
1805         dontaudit $1 user_home_dir_t:dir search_dir_perms;
1806 ')
1807
1808 ########################################
1809 ## <summary>
1810 ##      List user home directories.
1811 ## </summary>
1812 ## <param name="domain">
1813 ##      <summary>
1814 ##      Domain allowed access.
1815 ##      </summary>
1816 ## </param>
1817 #
1818 interface(`userdom_list_user_home_dirs',`
1819         gen_require(`
1820                 type user_home_dir_t;
1821         ')
1822
1823         allow $1 user_home_dir_t:dir list_dir_perms;
1824         files_search_home($1)
1825
1826         tunable_policy(`use_nfs_home_dirs',`
1827                 fs_list_nfs($1)
1828         ')
1829
1830         tunable_policy(`use_samba_home_dirs',`
1831                 fs_list_cifs($1)
1832         ')
1833 ')
1834
1835 ########################################
1836 ## <summary>
1837 ##      Do not audit attempts to list user home subdirectories.
1838 ## </summary>
1839 ## <param name="domain">
1840 ##      <summary>
1841 ##      Domain to not audit.
1842 ##      </summary>
1843 ## </param>
1844 #
1845 interface(`userdom_dontaudit_list_user_home_dirs',`
1846         gen_require(`
1847                 type user_home_dir_t;
1848                 type user_home_t;
1849         ')
1850
1851         dontaudit $1 user_home_dir_t:dir list_dir_perms;
1852         dontaudit $1 user_home_t:dir list_dir_perms;
1853 ')
1854
1855 ########################################
1856 ## <summary>
1857 ##      Create user home directories.
1858 ## </summary>
1859 ## <param name="domain">
1860 ##      <summary>
1861 ##      Domain allowed access.
1862 ##      </summary>
1863 ## </param>
1864 #
1865 interface(`userdom_create_user_home_dirs',`
1866         gen_require(`
1867                 type user_home_dir_t;
1868         ')
1869
1870         allow $1 user_home_dir_t:dir create_dir_perms;
1871 ')
1872
1873 ########################################
1874 ## <summary>
1875 ##      Create user home directories.
1876 ## </summary>
1877 ## <param name="domain">
1878 ##      <summary>
1879 ##      Domain allowed access.
1880 ##      </summary>
1881 ## </param>
1882 #
1883 interface(`userdom_manage_user_home_dirs',`
1884         gen_require(`
1885                 type user_home_dir_t;
1886         ')
1887
1888         allow $1 user_home_dir_t:dir manage_dir_perms;
1889 ')
1890
1891 ########################################
1892 ## <summary>
1893 ##      Relabel to user home directories.
1894 ## </summary>
1895 ## <param name="domain">
1896 ##      <summary>
1897 ##      Domain allowed access.
1898 ##      </summary>
1899 ## </param>
1900 #
1901 interface(`userdom_relabelto_user_home_dirs',`
1902         gen_require(`
1903                 type user_home_dir_t;
1904         ')
1905
1906         allow $1 user_home_dir_t:dir relabelto;
1907 ')
1908
1909
1910 ########################################
1911 ## <summary>
1912 ##      Relabel to user home files.
1913 ## </summary>
1914 ## <param name="domain">
1915 ##      <summary>
1916 ##      Domain allowed access.
1917 ##      </summary>
1918 ## </param>
1919 #
1920 interface(`userdom_relabelto_user_home_files',`
1921         gen_require(`
1922                 type user_home_t;
1923         ')
1924
1925         allow $1 user_home_t:file relabelto;
1926 ')
1927 ########################################
1928 ## <summary>
1929 ##      Relabel user home files.
1930 ## </summary>
1931 ## <param name="domain">
1932 ##      <summary>
1933 ##      Domain allowed access.
1934 ##      </summary>
1935 ## </param>
1936 #
1937 interface(`userdom_relabel_user_home_files',`
1938         gen_require(`
1939                 type user_home_t;
1940         ')
1941
1942         allow $1 user_home_t:file relabel_file_perms;
1943 ')
1944
1945 ########################################
1946 ## <summary>
1947 ##      Create directories in the home dir root with
1948 ##      the user home directory type.
1949 ## </summary>
1950 ## <param name="domain">
1951 ##      <summary>
1952 ##      Domain allowed access.
1953 ##      </summary>
1954 ## </param>
1955 #
1956 interface(`userdom_home_filetrans_user_home_dir',`
1957         gen_require(`
1958                 type user_home_dir_t;
1959         ')
1960
1961         files_home_filetrans($1, user_home_dir_t, dir)
1962 ')
1963
1964 ########################################
1965 ## <summary>
1966 ##      Do a domain transition to the specified
1967 ##      domain when executing a program in the
1968 ##      user home directory.
1969 ## </summary>
1970 ## <desc>
1971 ##      <p>
1972 ##      Do a domain transition to the specified
1973 ##      domain when executing a program in the
1974 ##      user home directory.
1975 ##      </p>
1976 ##      <p>
1977 ##      No interprocess communication (signals, pipes,
1978 ##      etc.) is provided by this interface since
1979 ##      the domains are not owned by this module.
1980 ##      </p>
1981 ## </desc>
1982 ## <param name="source_domain">
1983 ##      <summary>
1984 ##      Domain allowed to transition.
1985 ##      </summary>
1986 ## </param>
1987 ## <param name="target_domain">
1988 ##      <summary>
1989 ##      Domain to transition to.
1990 ##      </summary>
1991 ## </param>
1992 #
1993 interface(`userdom_user_home_domtrans',`
1994         gen_require(`
1995                 type user_home_dir_t, user_home_t;
1996         ')
1997
1998         domain_auto_trans($1, user_home_t, $2)
1999         allow $1 user_home_dir_t:dir search_dir_perms;
2000         files_search_home($1)
2001 ')
2002
2003 ########################################
2004 ## <summary>
2005 ##      Do not audit attempts to search user home content directories.
2006 ## </summary>
2007 ## <param name="domain">
2008 ##      <summary>
2009 ##      Domain to not audit.
2010 ##      </summary>
2011 ## </param>
2012 #
2013 interface(`userdom_dontaudit_search_user_home_content',`
2014         gen_require(`
2015                 type user_home_t;
2016         ')
2017
2018         dontaudit $1 user_home_t:dir search_dir_perms;
2019         fs_dontaudit_list_nfs($1)
2020         fs_dontaudit_list_cifs($1)
2021 ')
2022
2023 ########################################
2024 ## <summary>
2025 ##      List contents of users home directory.
2026 ## </summary>
2027 ## <param name="domain">
2028 ##      <summary>
2029 ##      Domain allowed access.
2030 ##      </summary>
2031 ## </param>
2032 #
2033 interface(`userdom_list_user_home_content',`
2034         gen_require(`
2035                 type user_home_dir_t;
2036                 attribute user_home_type;
2037         ')
2038
2039         files_list_home($1)
2040         allow $1 { user_home_dir_t user_home_type }:dir list_dir_perms;
2041 ')
2042
2043 ########################################
2044 ## <summary>
2045 ##      Create, read, write, and delete directories
2046 ##      in a user home subdirectory.
2047 ## </summary>
2048 ## <param name="domain">
2049 ##      <summary>
2050 ##      Domain allowed access.
2051 ##      </summary>
2052 ## </param>
2053 #
2054 interface(`userdom_manage_user_home_content_dirs',`
2055         gen_require(`
2056                 type user_home_dir_t, user_home_t;
2057         ')
2058
2059         manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2060         files_search_home($1)
2061 ')
2062
2063 ########################################
2064 ## <summary>
2065 ##      Delete directories in a user home subdirectory.
2066 ## </summary>
2067 ## <param name="domain">
2068 ##      <summary>
2069 ##      Domain allowed access.
2070 ##      </summary>
2071 ## </param>
2072 #
2073 interface(`userdom_delete_user_home_content_dirs',`
2074         gen_require(`
2075                 type user_home_t;
2076         ')
2077
2078         allow $1 user_home_t:dir delete_dir_perms;
2079 ')
2080
2081 ########################################
2082 ## <summary>
2083 ##      Delete all directories in a user home subdirectory.
2084 ## </summary>
2085 ## <param name="domain">
2086 ##      <summary>
2087 ##      Domain allowed access.
2088 ##      </summary>
2089 ## </param>
2090 #
2091 interface(`userdom_delete_all_user_home_content_dirs',`
2092         gen_require(`
2093                 attribute user_home_type;
2094         ')
2095
2096         allow $1 user_home_type:dir delete_dir_perms;
2097 ')
2098
2099 ########################################
2100 ## <summary>
2101 ##      Set the attributes of user home files.
2102 ## </summary>
2103 ## <param name="domain">
2104 ##      <summary>
2105 ##      Domain allowed access.
2106 ##      </summary>
2107 ## </param>
2108 ## <rolecap/>
2109 #
2110 interface(`userdom_setattr_user_home_content_files',`
2111         gen_require(`
2112                 type user_home_t;
2113         ')
2114
2115         allow $1 user_home_t:file setattr;
2116 ')
2117
2118 ########################################
2119 ## <summary>
2120 ##      Do not audit attempts to set the
2121 ##      attributes of user home files.
2122 ## </summary>
2123 ## <param name="domain">
2124 ##      <summary>
2125 ##      Domain to not audit.
2126 ##      </summary>
2127 ## </param>
2128 #
2129 interface(`userdom_dontaudit_setattr_user_home_content_files',`
2130         gen_require(`
2131                 type user_home_t;
2132         ')
2133
2134         dontaudit $1 user_home_t:file setattr_file_perms;
2135 ')
2136
2137 ########################################
2138 ## <summary>
2139 ##      Set the attributes of all user home directories.
2140 ## </summary>
2141 ## <param name="domain">
2142 ##      <summary>
2143 ##      Domain allowed access.
2144 ##      </summary>
2145 ## </param>
2146 ## <rolecap/>
2147 #
2148 interface(`userdom_setattr_all_user_home_content_dirs',`
2149         gen_require(`
2150                 attribute user_home_type;
2151         ')
2152
2153         allow $1 user_home_type:dir setattr_dir_perms;
2154 ')
2155
2156 ########################################
2157 ## <summary>
2158 ##      Mmap user home files.
2159 ## </summary>
2160 ## <param name="domain">
2161 ##      <summary>
2162 ##      Domain allowed access.
2163 ##      </summary>
2164 ## </param>
2165 #
2166 interface(`userdom_mmap_user_home_content_files',`
2167         gen_require(`
2168                 type user_home_dir_t, user_home_t;
2169         ')
2170
2171         mmap_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2172         files_search_home($1)
2173 ')
2174
2175 ########################################
2176 ## <summary>
2177 ##      Read user home files.
2178 ## </summary>
2179 ## <param name="domain">
2180 ##      <summary>
2181 ##      Domain allowed access.
2182 ##      </summary>
2183 ## </param>
2184 #
2185 interface(`userdom_read_user_home_content_files',`
2186         gen_require(`
2187                 type user_home_dir_t, user_home_t;
2188         ')
2189
2190         list_dirs_pattern($1, { user_home_dir_t user_home_t }, { user_home_dir_t user_home_t })
2191         read_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
2192         files_search_home($1)
2193 ')
2194
2195 ########################################
2196 ## <summary>
2197 ##      Do not audit attempts to getattr user home files.
2198 ## </summary>
2199 ## <param name="domain">
2200 ##      <summary>
2201 ##      Domain to not audit.
2202 ##      </summary>
2203 ## </param>
2204 #
2205 interface(`userdom_dontaudit_getattr_user_home_content',`
2206         gen_require(`
2207                 attribute user_home_type;
2208         ')
2209
2210         dontaudit $1 user_home_type:dir getattr;
2211         dontaudit $1 user_home_type:file getattr;
2212 ')
2213
2214 ########################################
2215 ## <summary>
2216 ##      Do not audit attempts to read user home files.
2217 ## </summary>
2218 ## <param name="domain">
2219 ##      <summary>
2220 ##      Domain to not audit.
2221 ##      </summary>
2222 ## </param>
2223 #
2224 interface(`userdom_dontaudit_read_user_home_content_files',`
2225         gen_require(`
2226                 attribute user_home_type;
2227                 type user_home_dir_t;
2228         ')
2229
2230         dontaudit $1 user_home_dir_t:dir list_dir_perms;
2231         dontaudit $1 user_home_type:dir list_dir_perms;
2232         dontaudit $1 user_home_type:file read_file_perms;
2233         dontaudit $1 user_home_type:lnk_file read_lnk_file_perms;
2234 ')
2235
2236 ########################################
2237 ## <summary>
2238 ##      Do not audit attempts to append user home files.
2239 ## </summary>
2240 ## <param name="domain">
2241 ##      <summary>
2242 ##      Domain to not audit.
2243 ##      </summary>
2244 ## </param>
2245 #
2246 interface(`userdom_dontaudit_append_user_home_content_files',`
2247         gen_require(`
2248                 type user_home_t;
2249         ')
2250
2251         dontaudit $1 user_home_t:file append_file_perms;
2252 ')
2253
2254 ########################################
2255 ## <summary>
2256 ##      Do not audit attempts to write user home files.
2257 ## </summary>
2258 ## <param name="domain">
2259 ##      <summary>
2260 ##      Domain to not audit.
2261 ##      </summary>
2262 ## </param>
2263 #
2264 interface(`userdom_dontaudit_write_user_home_content_files',`
2265         gen_require(`
2266                 type user_home_t;
2267         ')
2268
2269         dontaudit $1 user_home_t:file write_file_perms;
2270 ')
2271
2272 ########################################
2273 ## <summary>
2274 ##      Delete files in a user home subdirectory.
2275 ## </summary>
2276 ## <param name="domain">
2277 ##      <summary>
2278 ##      Domain allowed access.
2279 ##      </summary>
2280 ## </param>
2281 #
2282 interface(`userdom_delete_user_home_content_files',`
2283         gen_require(`
2284                 type user_home_t;
2285         ')
2286
2287         allow $1 user_home_t:file delete_file_perms;
2288 ')
2289
2290 ########################################
2291 ## <summary>
2292 ##      Delete all files in a user home subdirectory.
2293 ## </summary>
2294 ## <param name="domain">
2295 ##      <summary>
2296 ##      Domain allowed access.
2297 ##      </summary>
2298 ## </param>
2299 #
2300 interface(`userdom_delete_all_user_home_content_files',`
2301         gen_require(`
2302                 attribute user_home_type;
2303         ')
2304
2305         allow $1 user_home_type:file delete_file_perms;
2306 ')
2307
2308 ########################################
2309 ## <summary>
2310 ##      Delete sock files in a user home subdirectory.
2311 ## </summary>
2312 ## <param name="domain">
2313 ##      <summary>
2314 ##      Domain allowed access.
2315 ##      </summary>
2316 ## </param>
2317 #
2318 interface(`userdom_delete_user_home_content_sock_files',`
2319         gen_require(`
2320                 type user_home_t;
2321         ')
2322
2323         allow $1 user_home_t:sock_file delete_file_perms;
2324 ')
2325
2326 ########################################
2327 ## <summary>
2328 ##      Delete all sock files in a user home subdirectory.
2329 ## </summary>
2330 ## <param name="domain">
2331 ##      <summary>
2332 ##      Domain allowed access.
2333 ##      </summary>
2334 ## </param>
2335 #
2336 interface(`userdom_delete_all_user_home_content_sock_files',`
2337         gen_require(`
2338                 attribute user_home_type;
2339         ')
2340
2341         allow $1 user_home_type:sock_file delete_file_perms;
2342 ')
2343
2344 ########################################
2345 ## <summary>
2346 ##      Do not audit attempts to write user home files.
2347 ## </summary>
2348 ## <param name="domain">
2349 ##      <summary>
2350 ##      Domain to not audit.
2351 ##      </summary>
2352 ## </param>
2353 #
2354 interface(`userdom_dontaudit_relabel_user_home_content_files',`
2355         gen_require(`
2356                 type user_home_t;
2357         ')
2358
2359         dontaudit $1 user_home_t:file relabel_file_perms;
2360 ')
2361
2362 ########################################
2363 ## <summary>
2364 ##      Read user home subdirectory symbolic links.
2365 ## </summary>
2366 ## <param name="domain">
2367 ##      <summary>
2368 ##      Domain allowed access.
2369 ##      </summary>
2370 ## </param>
2371 #
2372 interface(`userdom_read_user_home_content_symlinks',`
2373         gen_require(`
2374                 type user_home_dir_t, user_home_t;
2375         ')
2376
2377         allow $1 { user_home_dir_t user_home_t }:lnk_file  read_lnk_file_perms;
2378 ')
2379
2380 ########################################
2381 ## <summary>
2382 ##      Execute user home files.
2383 ## </summary>
2384 ## <param name="domain">
2385 ##      <summary>
2386 ##      Domain allowed access.
2387 ##      </summary>
2388 ## </param>
2389 ## <rolecap/>
2390 #
2391 interface(`userdom_exec_user_home_content_files',`
2392         gen_require(`
2393                 type user_home_dir_t;
2394                 attribute user_home_type;
2395         ')
2396
2397         files_search_home($1)
2398         exec_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
2399         dontaudit $1 user_home_type:sock_file execute;
2400         ')
2401
2402 ########################################
2403 ## <summary>
2404 ##      Do not audit attempts to execute user home files.
2405 ## </summary>
2406 ## <param name="domain">
2407 ##      <summary>
2408 ##      Domain to not audit.
2409 ##      </summary>
2410 ## </param>
2411 #
2412 interface(`userdom_dontaudit_exec_user_home_content_files',`
2413         gen_require(`
2414                 type user_home_t;
2415         ')
2416
2417         dontaudit $1 user_home_t:file exec_file_perms;
2418 ')
2419
2420 ########################################
2421 ## <summary>
2422 ##      Create, read, write, and delete files
2423 ##      in a user home subdirectory.
2424 ## </summary>
2425 ## <param name="domain">
2426 ##      <summary>
2427 ##      Domain allowed access.
2428 ##      </summary>
2429 ## </param>
2430 #
2431 interface(`userdom_manage_user_home_content_files',`
2432         gen_require(`
2433                 type user_home_dir_t, user_home_t;
2434         ')
2435
2436         manage_files_pattern($1, user_home_t, user_home_t)
2437         allow $1 user_home_dir_t:dir search_dir_perms;
2438         files_search_home($1)
2439 ')
2440
2441 ########################################
2442 ## <summary>
2443 ##      Do not audit attempts to create, read, write, and delete directories
2444 ##      in a user home subdirectory.
2445 ## </summary>
2446 ## <param name="domain">
2447 ##      <summary>
2448 ##      Domain to not audit.
2449 ##      </summary>
2450 ## </param>
2451 #
2452 interface(`userdom_dontaudit_manage_user_home_content_dirs',`
2453         gen_require(`
2454                 type user_home_dir_t, user_home_t;
2455         ')
2456
2457         dontaudit $1 user_home_t:dir manage_dir_perms;
2458 ')
2459
2460 ########################################
2461 ## <summary>
2462 ##      Create, read, write, and delete symbolic links
2463 ##      in a user home subdirectory.
2464 ## </summary>
2465 ## <param name="domain">
2466 ##      <summary>
2467 ##      Domain allowed access.
2468 ##      </summary>
2469 ## </param>
2470 #
2471 interface(`userdom_manage_user_home_content_symlinks',`
2472         gen_require(`
2473                 type user_home_dir_t, user_home_t;
2474         ')
2475
2476         manage_lnk_files_pattern($1, user_home_t, user_home_t)
2477         allow $1 user_home_dir_t:dir search_dir_perms;
2478         files_search_home($1)
2479 ')
2480
2481 ########################################
2482 ## <summary>
2483 ##      Delete symbolic links in a user home directory.
2484 ## </summary>
2485 ## <param name="domain">
2486 ##      <summary>
2487 ##      Domain allowed access.
2488 ##      </summary>
2489 ## </param>
2490 #
2491 interface(`userdom_delete_user_home_content_symlinks',`
2492         gen_require(`
2493                 type user_home_t;
2494         ')
2495
2496         allow $1 user_home_t:lnk_file delete_lnk_file_perms;
2497 ')
2498
2499 ########################################
2500 ## <summary>
2501 ##      Delete all symbolic links in a user home directory.
2502 ## </summary>
2503 ## <param name="domain">
2504 ##      <summary>
2505 ##      Domain allowed access.
2506 ##      </summary>
2507 ## </param>
2508 #
2509 interface(`userdom_delete_all_user_home_content_symlinks',`
2510         gen_require(`
2511                 attribute user_home_type;
2512         ')
2513
2514         allow $1 user_home_type:lnk_file delete_lnk_file_perms;
2515 ')
2516
2517 ########################################
2518 ## <summary>
2519 ##      Create, read, write, and delete named pipes
2520 ##      in a user home subdirectory.
2521 ## </summary>
2522 ## <param name="domain">
2523 ##      <summary>
2524 ##      Domain allowed access.
2525 ##      </summary>
2526 ## </param>
2527 #
2528 interface(`userdom_manage_user_home_content_pipes',`
2529         gen_require(`
2530                 type user_home_dir_t, user_home_t;
2531         ')
2532
2533         manage_fifo_files_pattern($1, user_home_t, user_home_t)
2534         allow $1 user_home_dir_t:dir search_dir_perms;
2535         files_search_home($1)
2536 ')
2537
2538 ########################################
2539 ## <summary>
2540 ##      Create, read, write, and delete named sockets
2541 ##      in a user home subdirectory.
2542 ## </summary>
2543 ## <param name="domain">
2544 ##      <summary>
2545 ##      Domain allowed access.
2546 ##      </summary>
2547 ## </param>
2548 #
2549 interface(`userdom_manage_user_home_content_sockets',`
2550         gen_require(`
2551                 type user_home_dir_t, user_home_t;
2552         ')
2553
2554         allow $1 user_home_dir_t:dir search_dir_perms;
2555         manage_sock_files_pattern($1, user_home_t, user_home_t)
2556         files_search_home($1)
2557 ')
2558
2559 ########################################
2560 ## <summary>
2561 ##      Create objects in a user home directory
2562 ##      with an automatic type transition to
2563 ##      a specified private type.
2564 ## </summary>
2565 ## <param name="domain">
2566 ##      <summary>
2567 ##      Domain allowed access.
2568 ##      </summary>
2569 ## </param>
2570 ## <param name="private_type">
2571 ##      <summary>
2572 ##      The type of the object to create.
2573 ##      </summary>
2574 ## </param>
2575 ## <param name="object_class">
2576 ##      <summary>
2577 ##      The class of the object to be created.
2578 ##      </summary>
2579 ## </param>
2580 #
2581 interface(`userdom_user_home_dir_filetrans',`
2582         gen_require(`
2583                 type user_home_dir_t;
2584         ')
2585
2586         filetrans_pattern($1, user_home_dir_t, $2, $3, $4)
2587         files_search_home($1)
2588 ')
2589
2590 ########################################
2591 ## <summary>
2592 ##      Create objects in a user home directory
2593 ##      with an automatic type transition to
2594 ##      a specified private type.
2595 ## </summary>
2596 ## <param name="domain">
2597 ##      <summary>
2598 ##      Domain allowed access.
2599 ##      </summary>
2600 ## </param>
2601 ## <param name="private_type">
2602 ##      <summary>
2603 ##      The type of the object to create.
2604 ##      </summary>
2605 ## </param>
2606 ## <param name="object_class">
2607 ##      <summary>
2608 ##      The class of the object to be created.
2609 ##      </summary>
2610 ## </param>
2611 #
2612 interface(`userdom_user_home_content_filetrans',`
2613         gen_require(`
2614                 type user_home_dir_t, user_home_t;
2615         ')
2616
2617         filetrans_pattern($1, user_home_t, $2, $3)
2618         allow $1 user_home_dir_t:dir search_dir_perms;
2619         files_search_home($1)
2620 ')
2621
2622 ########################################
2623 ## <summary>
2624 ##      Create objects in a user home directory
2625 ##      with an automatic type transition to
2626 ##      the user home file type.
2627 ## </summary>
2628 ## <param name="domain">
2629 ##      <summary>
2630 ##      Domain allowed access.
2631 ##      </summary>
2632 ## </param>
2633 ## <param name="object_class">
2634 ##      <summary>
2635 ##      The class of the object to be created.
2636 ##      </summary>
2637 ## </param>
2638 #
2639 interface(`userdom_user_home_dir_filetrans_user_home_content',`
2640         gen_require(`
2641                 type user_home_dir_t, user_home_t;
2642         ')
2643
2644         filetrans_pattern($1, user_home_dir_t, user_home_t, $2)
2645         files_search_home($1)
2646 ')
2647
2648 ########################################
2649 ## <summary>
2650 ##      Write to user temporary named sockets.
2651 ## </summary>
2652 ## <param name="domain">
2653 ##      <summary>
2654 ##      Domain allowed access.
2655 ##      </summary>
2656 ## </param>
2657 #
2658 interface(`userdom_write_user_tmp_sockets',`
2659         gen_require(`
2660                 type user_tmp_t;
2661         ')
2662
2663         allow $1 user_tmp_t:sock_file write_sock_file_perms;
2664         files_search_tmp($1)
2665 ')
2666
2667 ########################################
2668 ## <summary>
2669 ##      List user temporary directories.
2670 ## </summary>
2671 ## <param name="domain">
2672 ##      <summary>
2673 ##      Domain allowed access.
2674 ##      </summary>
2675 ## </param>
2676 #
2677 interface(`userdom_list_user_tmp',`
2678         gen_require(`
2679                 type user_tmp_t;
2680         ')
2681
2682         allow $1 user_tmp_t:dir list_dir_perms;
2683         files_search_tmp($1)
2684 ')
2685
2686 ########################################
2687 ## <summary>
2688 ##      Do not audit attempts to list user
2689 ##      temporary directories.
2690 ## </summary>
2691 ## <param name="domain">
2692 ##      <summary>
2693 ##      Domain to not audit.
2694 ##      </summary>
2695 ## </param>
2696 #
2697 interface(`userdom_dontaudit_list_user_tmp',`
2698         gen_require(`
2699                 type user_tmp_t;
2700         ')
2701
2702         dontaudit $1 user_tmp_t:dir list_dir_perms;
2703 ')
2704
2705 ########################################
2706 ## <summary>
2707 ##      Do not audit attempts to manage users
2708 ##      temporary directories.
2709 ## </summary>
2710 ## <param name="domain">
2711 ##      <summary>
2712 ##      Domain to not audit.
2713 ##      </summary>
2714 ## </param>
2715 #
2716 interface(`userdom_dontaudit_manage_user_tmp_dirs',`
2717         gen_require(`
2718                 type user_tmp_t;
2719         ')
2720
2721         dontaudit $1 user_tmp_t:dir manage_dir_perms;
2722 ')
2723
2724 ########################################
2725 ## <summary>
2726 ##      Read user temporary files.
2727 ## </summary>
2728 ## <param name="domain">
2729 ##      <summary>
2730 ##      Domain allowed access.
2731 ##      </summary>
2732 ## </param>
2733 #
2734 interface(`userdom_read_user_tmp_files',`
2735         gen_require(`
2736                 type user_tmp_t;
2737         ')
2738
2739         read_files_pattern($1, user_tmp_t, user_tmp_t)
2740         allow $1 user_tmp_t:dir list_dir_perms;
2741         files_search_tmp($1)
2742 ')
2743
2744 ########################################
2745 ## <summary>
2746 ##      Do not audit attempts to read users
2747 ##      temporary files.
2748 ## </summary>
2749 ## <param name="domain">
2750 ##      <summary>
2751 ##      Domain to not audit.
2752 ##      </summary>
2753 ## </param>
2754 #
2755 interface(`userdom_dontaudit_read_user_tmp_files',`
2756         gen_require(`
2757                 type user_tmp_t;
2758         ')
2759
2760         dontaudit $1 user_tmp_t:file read_inherited_file_perms;
2761 ')
2762
2763 ########################################
2764 ## <summary>
2765 ##      Do not audit attempts to append users
2766 ##      temporary files.
2767 ## </summary>
2768 ## <param name="domain">
2769 ##      <summary>
2770 ##      Domain to not audit.
2771 ##      </summary>
2772 ## </param>
2773 #
2774 interface(`userdom_dontaudit_append_user_tmp_files',`
2775         gen_require(`
2776                 type user_tmp_t;
2777         ')
2778
2779         dontaudit $1 user_tmp_t:file append_file_perms;
2780 ')
2781
2782 ########################################
2783 ## <summary>
2784 ##      Read and write user temporary files.
2785 ## </summary>
2786 ## <param name="domain">
2787 ##      <summary>
2788 ##      Domain allowed access.
2789 ##      </summary>
2790 ## </param>
2791 #
2792 interface(`userdom_rw_user_tmp_files',`
2793         gen_require(`
2794                 type user_tmp_t;
2795         ')
2796
2797         allow $1 user_tmp_t:dir list_dir_perms;
2798         rw_files_pattern($1, user_tmp_t, user_tmp_t)
2799         files_search_tmp($1)
2800 ')
2801
2802 ########################################
2803 ## <summary>
2804 ##      Do not audit attempts to manage users
2805 ##      temporary files.
2806 ## </summary>
2807 ## <param name="domain">
2808 ##      <summary>
2809 ##      Domain to not audit.
2810 ##      </summary>
2811 ## </param>
2812 #
2813 interface(`userdom_dontaudit_manage_user_tmp_files',`
2814         gen_require(`
2815                 type user_tmp_t;
2816         ')
2817
2818         dontaudit $1 user_tmp_t:file manage_file_perms;
2819 ')
2820
2821 ########################################
2822 ## <summary>
2823 ##      Read user temporary symbolic links.
2824 ## </summary>
2825 ## <param name="domain">
2826 ##      <summary>
2827 ##      Domain allowed access.
2828 ##      </summary>
2829 ## </param>
2830 #
2831 interface(`userdom_read_user_tmp_symlinks',`
2832         gen_require(`
2833                 type user_tmp_t;
2834         ')
2835
2836         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2837         allow $1 user_tmp_t:dir list_dir_perms;
2838         files_search_tmp($1)
2839 ')
2840
2841 ########################################
2842 ## <summary>
2843 ##      Create, read, write, and delete user
2844 ##      temporary directories.
2845 ## </summary>
2846 ## <param name="domain">
2847 ##      <summary>
2848 ##      Domain allowed access.
2849 ##      </summary>
2850 ## </param>
2851 #
2852 interface(`userdom_manage_user_tmp_dirs',`
2853         gen_require(`
2854                 type user_tmp_t;
2855         ')
2856
2857         manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
2858         files_search_tmp($1)
2859 ')
2860
2861 ########################################
2862 ## <summary>
2863 ##      Create, read, write, and delete user
2864 ##      temporary files.
2865 ## </summary>
2866 ## <param name="domain">
2867 ##      <summary>
2868 ##      Domain allowed access.
2869 ##      </summary>
2870 ## </param>
2871 #
2872 interface(`userdom_manage_user_tmp_files',`
2873         gen_require(`
2874                 type user_tmp_t;
2875         ')
2876
2877         manage_files_pattern($1, user_tmp_t, user_tmp_t)
2878         files_search_tmp($1)
2879 ')
2880
2881 ########################################
2882 ## <summary>
2883 ##      Create, read, write, and delete user
2884 ##      temporary symbolic links.
2885 ## </summary>
2886 ## <param name="domain">
2887 ##      <summary>
2888 ##      Domain allowed access.
2889 ##      </summary>
2890 ## </param>
2891 #
2892 interface(`userdom_manage_user_tmp_symlinks',`
2893         gen_require(`
2894                 type user_tmp_t;
2895         ')
2896
2897         manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
2898         files_search_tmp($1)
2899 ')
2900
2901 ########################################
2902 ## <summary>
2903 ##      Create, read, write, and delete user
2904 ##      temporary named pipes.
2905 ## </summary>
2906 ## <param name="domain">
2907 ##      <summary>
2908 ##      Domain allowed access.
2909 ##      </summary>
2910 ## </param>
2911 #
2912 interface(`userdom_manage_user_tmp_pipes',`
2913         gen_require(`
2914                 type user_tmp_t;
2915         ')
2916
2917         manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
2918         files_search_tmp($1)
2919 ')
2920
2921 ########################################
2922 ## <summary>
2923 ##      Create, read, write, and delete user
2924 ##      temporary named sockets.
2925 ## </summary>
2926 ## <param name="domain">
2927 ##      <summary>
2928 ##      Domain allowed access.
2929 ##      </summary>
2930 ## </param>
2931 #
2932 interface(`userdom_manage_user_tmp_sockets',`
2933         gen_require(`
2934                 type user_tmp_t;
2935         ')
2936
2937         manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
2938         files_search_tmp($1)
2939 ')
2940
2941 ########################################
2942 ## <summary>
2943 ##      Create objects in a user temporary directory
2944 ##      with an automatic type transition to
2945 ##      a specified private type.
2946 ## </summary>
2947 ## <param name="domain">
2948 ##      <summary>
2949 ##      Domain allowed access.
2950 ##      </summary>
2951 ## </param>
2952 ## <param name="private_type">
2953 ##      <summary>
2954 ##      The type of the object to create.
2955 ##      </summary>
2956 ## </param>
2957 ## <param name="object_class">
2958 ##      <summary>
2959 ##      The class of the object to be created.
2960 ##      </summary>
2961 ## </param>
2962 #
2963 interface(`userdom_user_tmp_filetrans',`
2964         gen_require(`
2965                 type user_tmp_t;
2966         ')
2967
2968         filetrans_pattern($1, user_tmp_t, $2, $3)
2969         files_search_tmp($1)
2970 ')
2971
2972 ########################################
2973 ## <summary>
2974 ##      Create objects in the temporary directory
2975 ##      with an automatic type transition to
2976 ##      the user temporary type.
2977 ## </summary>
2978 ## <param name="domain">
2979 ##      <summary>
2980 ##      Domain allowed access.
2981 ##      </summary>
2982 ## </param>
2983 ## <param name="object_class">
2984 ##      <summary>
2985 ##      The class of the object to be created.
2986 ##      </summary>
2987 ## </param>
2988 #
2989 interface(`userdom_tmp_filetrans_user_tmp',`
2990         gen_require(`
2991                 type user_tmp_t;
2992         ')
2993
2994         files_tmp_filetrans($1, user_tmp_t, $2)
2995 ')
2996
2997 ########################################
2998 ## <summary>
2999 ##      Read user tmpfs files.
3000 ## </summary>
3001 ## <param name="domain">
3002 ##      <summary>
3003 ##      Domain allowed access.
3004 ##      </summary>
3005 ## </param>
3006 #
3007 interface(`userdom_read_user_tmpfs_files',`
3008         gen_require(`
3009                 type user_tmpfs_t;
3010         ')
3011
3012         read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3013         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3014         allow $1 user_tmpfs_t:dir list_dir_perms;
3015         fs_search_tmpfs($1)
3016 ')
3017
3018 ########################################
3019 ## <summary>
3020 ##      Read/Write user tmpfs files.
3021 ## </summary>
3022 ## <param name="domain">
3023 ##      <summary>
3024 ##      Domain allowed access.
3025 ##      </summary>
3026 ## </param>
3027 #
3028 interface(`userdom_rw_user_tmpfs_files',`
3029         gen_require(`
3030                 type user_tmpfs_t;
3031         ')
3032
3033         rw_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3034         read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
3035         allow $1 user_tmpfs_t:dir list_dir_perms;
3036         fs_search_tmpfs($1)
3037 ')
3038
3039 ########################################
3040 ## <summary>
3041 ##      Get the attributes of a user domain tty.
3042 ## </summary>
3043 ## <param name="domain">
3044 ##      <summary>
3045 ##      Domain allowed access.
3046 ##      </summary>
3047 ## </param>
3048 #
3049 interface(`userdom_getattr_user_ttys',`
3050         gen_require(`
3051                 type user_tty_device_t;
3052         ')
3053
3054         allow $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3055 ')
3056
3057 ########################################
3058 ## <summary>
3059 ##      Do not audit attempts to get the attributes of a user domain tty.
3060 ## </summary>
3061 ## <param name="domain">
3062 ##      <summary>
3063 ##      Domain to not audit.
3064 ##      </summary>
3065 ## </param>
3066 #
3067 interface(`userdom_dontaudit_getattr_user_ttys',`
3068         gen_require(`
3069                 type user_tty_device_t;
3070         ')
3071
3072         dontaudit $1 user_tty_device_t:chr_file getattr_chr_file_perms;
3073 ')
3074
3075 ########################################
3076 ## <summary>
3077 ##      Set the attributes of a user domain tty.
3078 ## </summary>
3079 ## <param name="domain">
3080 ##      <summary>
3081 ##      Domain allowed access.
3082 ##      </summary>
3083 ## </param>
3084 #
3085 interface(`userdom_setattr_user_ttys',`
3086         gen_require(`
3087                 type user_tty_device_t;
3088         ')
3089
3090         allow $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3091 ')
3092
3093 ########################################
3094 ## <summary>
3095 ##      Do not audit attempts to set the attributes of a user domain tty.
3096 ## </summary>
3097 ## <param name="domain">
3098 ##      <summary>
3099 ##      Domain to not audit.
3100 ##      </summary>
3101 ## </param>
3102 #
3103 interface(`userdom_dontaudit_setattr_user_ttys',`
3104         gen_require(`
3105                 type user_tty_device_t;
3106         ')
3107
3108         dontaudit $1 user_tty_device_t:chr_file setattr_chr_file_perms;
3109 ')
3110
3111 ########################################
3112 ## <summary>
3113 ##      Read and write a user domain tty.
3114 ## </summary>
3115 ## <param name="domain">
3116 ##      <summary>
3117 ##      Domain allowed access.
3118 ##      </summary>
3119 ## </param>
3120 #
3121 interface(`userdom_use_user_ttys',`
3122         gen_require(`
3123                 type user_tty_device_t;
3124         ')
3125
3126         allow $1 user_tty_device_t:chr_file rw_term_perms;
3127 ')
3128
3129 ########################################
3130 ## <summary>
3131 ##      Read and write a inherited user domain tty.
3132 ## </summary>
3133 ## <param name="domain">
3134 ##      <summary>
3135 ##      Domain allowed access.
3136 ##      </summary>
3137 ## </param>
3138 #
3139 interface(`userdom_use_inherited_user_ttys',`
3140         gen_require(`
3141                 type user_tty_device_t;
3142         ')
3143
3144         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3145 ')
3146
3147 ########################################
3148 ## <summary>
3149 ##      Read and write a user domain pty.
3150 ## </summary>
3151 ## <param name="domain">
3152 ##      <summary>
3153 ##      Domain allowed access.
3154 ##      </summary>
3155 ## </param>
3156 #
3157 interface(`userdom_use_user_ptys',`
3158         gen_require(`
3159                 type user_devpts_t;
3160         ')
3161
3162         allow $1 user_devpts_t:chr_file rw_term_perms;
3163 ')
3164
3165 ########################################
3166 ## <summary>
3167 ##      Read and write a inherited user domain pty.
3168 ## </summary>
3169 ## <param name="domain">
3170 ##      <summary>
3171 ##      Domain allowed access.
3172 ##      </summary>
3173 ## </param>
3174 #
3175 interface(`userdom_use_inherited_user_ptys',`
3176         gen_require(`
3177                 type user_devpts_t;
3178         ')
3179
3180         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3181 ')
3182
3183 ########################################
3184 ## <summary>
3185 ##      Read and write a inherited user TTYs and PTYs.
3186 ## </summary>
3187 ## <desc>
3188 ##      <p>
3189 ##      Allow the specified domain to read and write inherited user
3190 ##      TTYs and PTYs. This will allow the domain to
3191 ##      interact with the user via the terminal. Typically
3192 ##      all interactive applications will require this
3193 ##      access.
3194 ##      </p>
3195 ## </desc>
3196 ## <param name="domain">
3197 ##      <summary>
3198 ##      Domain allowed access.
3199 ##      </summary>
3200 ## </param>
3201 ## <infoflow type="both" weight="10"/>
3202 #
3203 interface(`userdom_use_inherited_user_terminals',`
3204         gen_require(`
3205                 type user_tty_device_t, user_devpts_t;
3206         ')
3207
3208         allow $1 user_tty_device_t:chr_file rw_inherited_term_perms;
3209         allow $1 user_devpts_t:chr_file rw_inherited_term_perms;
3210 ')
3211
3212 #######################################
3213 ## <summary>
3214 ##  Allow attempts to read and write
3215 ##  a user domain tty and pty.
3216 ## </summary>
3217 ## <param name="domain">
3218 ##  <summary>
3219 ##  Domain to not audit.
3220 ##  </summary>
3221 ## </param>
3222 #
3223 interface(`userdom_use_user_terminals',`
3224     gen_require(`
3225         type user_tty_device_t, user_devpts_t;
3226     ')
3227
3228     allow $1 user_tty_device_t:chr_file rw_term_perms;
3229     allow $1 user_devpts_t:chr_file rw_term_perms;
3230 ')
3231
3232 ########################################
3233 ## <summary>
3234 ##      Do not audit attempts to read and write
3235 ##      a user domain tty and pty.
3236 ## </summary>
3237 ## <param name="domain">
3238 ##      <summary>
3239 ##      Domain to not audit.
3240 ##      </summary>
3241 ## </param>
3242 #
3243 interface(`userdom_dontaudit_use_user_terminals',`
3244         gen_require(`
3245                 type user_tty_device_t, user_devpts_t;
3246         ')
3247
3248         dontaudit $1 user_tty_device_t:chr_file rw_term_perms;
3249         dontaudit $1 user_devpts_t:chr_file rw_term_perms;
3250 ')
3251
3252
3253 ########################################
3254 ## <summary>
3255 ##      Get attributes of user domain tty and pty.
3256 ## </summary>
3257 ## <param name="domain">
3258 ##      <summary>
3259 ##      Domain allowed access.
3260 ##      </summary>
3261 ## </param>
3262 #
3263 interface(`userdom_getattr_user_terminals',`
3264         gen_require(`
3265                 type user_tty_device_t, user_devpts_t;
3266         ')
3267
3268         allow $1 { user_tty_device_t user_devpts_t }:chr_file getattr_chr_file_perms;
3269 ')
3270
3271 ########################################
3272 ## <summary>
3273 ##      Execute a shell in all user domains.  This
3274 ##      is an explicit transition, requiring the
3275 ##      caller to use setexeccon().
3276 ## </summary>
3277 ## <param name="domain">
3278 ##      <summary>
3279 ##      Domain allowed to transition.
3280 ##      </summary>
3281 ## </param>
3282 #
3283 interface(`userdom_spec_domtrans_all_users',`
3284         gen_require(`
3285                 attribute userdomain;
3286         ')
3287
3288         corecmd_shell_spec_domtrans($1, userdomain)
3289         allow userdomain $1:fd use;
3290         allow userdomain $1:fifo_file rw_file_perms;
3291         allow userdomain $1:process sigchld;
3292 ')
3293
3294 ########################################
3295 ## <summary>
3296 ##      Execute an Xserver session in all unprivileged user domains.  This
3297 ##      is an explicit transition, requiring the
3298 ##      caller to use setexeccon().
3299 ## </summary>
3300 ## <param name="domain">
3301 ##      <summary>
3302 ##      Domain allowed to transition.
3303 ##      </summary>
3304 ## </param>
3305 #
3306 interface(`userdom_xsession_spec_domtrans_all_users',`
3307         gen_require(`
3308                 attribute userdomain;
3309         ')
3310
3311         xserver_xsession_spec_domtrans($1, userdomain)
3312         allow userdomain $1:fd use;
3313         allow userdomain $1:fifo_file rw_file_perms;
3314         allow userdomain $1:process sigchld;
3315 ')
3316
3317 ########################################
3318 ## <summary>
3319 ##      Execute a shell in all unprivileged user domains.  This
3320 ##      is an explicit transition, requiring the
3321 ##      caller to use setexeccon().
3322 ## </summary>
3323 ## <param name="domain">
3324 ##      <summary>
3325 ##      Domain allowed to transition.
3326 ##      </summary>
3327 ## </param>
3328 #
3329 interface(`userdom_spec_domtrans_unpriv_users',`
3330         gen_require(`
3331                 attribute unpriv_userdomain;
3332         ')
3333
3334         corecmd_shell_spec_domtrans($1, unpriv_userdomain)
3335         allow unpriv_userdomain $1:fd use;
3336         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3337         allow unpriv_userdomain $1:process sigchld;
3338 ')
3339
3340 ########################################
3341 ## <summary>
3342 ##      Execute an Xserver session in all unprivileged user domains.  This
3343 ##      is an explicit transition, requiring the
3344 ##      caller to use setexeccon().
3345 ## </summary>
3346 ## <param name="domain">
3347 ##      <summary>
3348 ##      Domain allowed to transition.
3349 ##      </summary>
3350 ## </param>
3351 #
3352 interface(`userdom_xsession_spec_domtrans_unpriv_users',`
3353         gen_require(`
3354                 attribute unpriv_userdomain;
3355         ')
3356
3357         xserver_xsession_spec_domtrans($1, unpriv_userdomain)
3358         allow unpriv_userdomain $1:fd use;
3359         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3360         allow unpriv_userdomain $1:process sigchld;
3361 ')
3362
3363 ########################################
3364 ## <summary>
3365 ##      Manage unpriviledged user SysV sempaphores.
3366 ## </summary>
3367 ## <param name="domain">
3368 ##      <summary>
3369 ##      Domain allowed access.
3370 ##      </summary>
3371 ## </param>
3372 #
3373 interface(`userdom_manage_unpriv_user_semaphores',`
3374         gen_require(`
3375                 attribute unpriv_userdomain;
3376         ')
3377
3378         allow $1 unpriv_userdomain:sem create_sem_perms;
3379 ')
3380
3381 ########################################
3382 ## <summary>
3383 ##      Manage unpriviledged user SysV shared
3384 ##      memory segments.
3385 ## </summary>
3386 ## <param name="domain">
3387 ##      <summary>
3388 ##      Domain allowed access.
3389 ##      </summary>
3390 ## </param>
3391 #
3392 interface(`userdom_manage_unpriv_user_shared_mem',`
3393         gen_require(`
3394                 attribute unpriv_userdomain;
3395         ')
3396
3397         allow $1 unpriv_userdomain:shm create_shm_perms;
3398 ')
3399
3400 ########################################
3401 ## <summary>
3402 ##      Execute bin_t in the unprivileged user domains. This
3403 ##      is an explicit transition, requiring the
3404 ##      caller to use setexeccon().
3405 ## </summary>
3406 ## <param name="domain">
3407 ##      <summary>
3408 ##      Domain allowed to transition.
3409 ##      </summary>
3410 ## </param>
3411 #
3412 interface(`userdom_bin_spec_domtrans_unpriv_users',`
3413         gen_require(`
3414                 attribute unpriv_userdomain;
3415         ')
3416
3417         corecmd_bin_spec_domtrans($1, unpriv_userdomain)
3418         allow unpriv_userdomain $1:fd use;
3419         allow unpriv_userdomain $1:fifo_file rw_file_perms;
3420         allow unpriv_userdomain $1:process sigchld;
3421 ')
3422
3423 ########################################
3424 ## <summary>
3425 ##      Execute all entrypoint files in unprivileged user
3426 ##      domains. This is an explicit transition, requiring the
3427 ##      caller to use setexeccon().
3428 ## </summary>
3429 ## <param name="domain">
3430 ##      <summary>
3431 ##      Domain allowed access.
3432 ##      </summary>
3433 ## </param>
3434 #
3435 interface(`userdom_entry_spec_domtrans_unpriv_users',`
3436         gen_require(`
3437                 attribute unpriv_userdomain;
3438         ')
3439
3440         domain_entry_file_spec_domtrans($1, unpriv_userdomain)
3441         allow unpriv_userdomain $1:fd use;
3442         allow unpriv_userdomain $1:fifo_file rw_fifo_file_perms;
3443         allow unpriv_userdomain $1:process sigchld;
3444 ')
3445
3446 ########################################
3447 ## <summary>
3448 ##      Search users home directories.
3449 ## </summary>
3450 ## <param name="domain">
3451 ##      <summary>
3452 ##      Domain allowed access.
3453 ##      </summary>
3454 ## </param>
3455 #
3456 interface(`userdom_search_user_home_content',`
3457         gen_require(`
3458                 type user_home_dir_t;
3459                 attribute user_home_type;
3460         ')
3461
3462         files_list_home($1)
3463         allow $1 { user_home_dir_t user_home_type }:dir search_dir_perms;
3464         allow $1 { user_home_dir_t user_home_type }:lnk_file read_lnk_file_perms;
3465 ')
3466
3467 ########################################
3468 ## <summary>
3469 ##      Send general signals to unprivileged user domains.
3470 ## </summary>
3471 ## <param name="domain">
3472 ##      <summary>
3473 ##      Domain allowed access.
3474 ##      </summary>
3475 ## </param>
3476 #
3477 interface(`userdom_signal_unpriv_users',`
3478         gen_require(`
3479                 attribute unpriv_userdomain;
3480         ')
3481
3482         allow $1 unpriv_userdomain:process signal;
3483 ')
3484
3485 ########################################
3486 ## <summary>
3487 ##      Inherit the file descriptors from unprivileged user domains.
3488 ## </summary>
3489 ## <param name="domain">
3490 ##      <summary>
3491 ##      Domain allowed access.
3492 ##      </summary>
3493 ## </param>
3494 #
3495 interface(`userdom_use_unpriv_users_fds',`
3496         gen_require(`
3497                 attribute unpriv_userdomain;
3498         ')
3499
3500         allow $1 unpriv_userdomain:fd use;
3501 ')
3502
3503 ########################################
3504 ## <summary>
3505 ##      Do not audit attempts to inherit the file descriptors
3506 ##      from unprivileged user domains.
3507 ## </summary>
3508 ## <desc>
3509 ##      <p>
3510 ##      Do not audit attempts to inherit the file descriptors
3511 ##      from unprivileged user domains. This will supress
3512 ##      SELinux denial messages when the specified domain is denied
3513 ##      the permission to inherit these file descriptors.
3514 ##      </p>
3515 ## </desc>
3516 ## <param name="domain">
3517 ##      <summary>
3518 ##      Domain to not audit.
3519 ##      </summary>
3520 ## </param>
3521 ## <infoflow type="none"/>
3522 #
3523 interface(`userdom_dontaudit_use_unpriv_user_fds',`
3524         gen_require(`
3525                 attribute unpriv_userdomain;
3526         ')
3527
3528         dontaudit $1 unpriv_userdomain:fd use;
3529 ')
3530
3531 ########################################
3532 ## <summary>
3533 ##      Do not audit attempts to use user ptys.
3534 ## </summary>
3535 ## <param name="domain">
3536 ##      <summary>
3537 ##      Domain to not audit.
3538 ##      </summary>
3539 ## </param>
3540 #
3541 interface(`userdom_dontaudit_use_user_ptys',`
3542         gen_require(`
3543                 type user_devpts_t;
3544         ')
3545
3546         dontaudit $1 user_devpts_t:chr_file rw_inherited_file_perms;
3547 ')
3548
3549 ########################################
3550 ## <summary>
3551 ##      Relabel files to unprivileged user pty types.
3552 ## </summary>
3553 ## <param name="domain">
3554 ##      <summary>
3555 ##      Domain allowed access.
3556 ##      </summary>
3557 ## </param>
3558 #
3559 interface(`userdom_relabelto_user_ptys',`
3560         gen_require(`
3561                 type user_devpts_t;
3562         ')
3563
3564         allow $1 user_devpts_t:chr_file relabelto;
3565 ')
3566
3567 ########################################
3568 ## <summary>
3569 ##      Do not audit attempts to relabel files from
3570 ##      user pty types.
3571 ## </summary>
3572 ## <param name="domain">
3573 ##      <summary>
3574 ##      Domain to not audit.
3575 ##      </summary>
3576 ## </param>
3577 #
3578 interface(`userdom_dontaudit_relabelfrom_user_ptys',`
3579         gen_require(`
3580                 type user_devpts_t;
3581         ')
3582
3583         dontaudit $1 user_devpts_t:chr_file relabelfrom;
3584 ')
3585
3586 ########################################
3587 ## <summary>
3588 ##      Write all users files in /tmp
3589 ## </summary>
3590 ## <param name="domain">
3591 ##      <summary>
3592 ##      Domain allowed access.
3593 ##      </summary>
3594 ## </param>
3595 #
3596 interface(`userdom_write_user_tmp_files',`
3597         gen_require(`
3598                 type user_tmp_t;
3599         ')
3600
3601         write_files_pattern($1, user_tmp_t, user_tmp_t)
3602 ')
3603
3604 ########################################
3605 ## <summary>
3606 ##      Do not audit attempts to write users
3607 ##      temporary files.
3608 ## </summary>
3609 ## <param name="domain">
3610 ##      <summary>
3611 ##      Domain to not audit.
3612 ##      </summary>
3613 ## </param>
3614 #
3615 interface(`userdom_dontaudit_write_user_tmp_files',`
3616         gen_require(`
3617                 type user_tmp_t;
3618         ')
3619
3620         dontaudit $1 user_tmp_t:file write;
3621 ')
3622
3623 ########################################
3624 ## <summary>
3625 ##      Do not audit attempts to read/write users
3626 ##      temporary fifo files.
3627 ## </summary>
3628 ## <param name="domain">
3629 ##      <summary>
3630 ##      Domain to not audit.
3631 ##      </summary>
3632 ## </param>
3633 #
3634 interface(`userdom_dontaudit_rw_user_tmp_pipes',`
3635         gen_require(`
3636                 type user_tmp_t;
3637         ')
3638
3639         dontaudit $1 user_tmp_t:fifo_file rw_inherited_fifo_file_perms;
3640 ')
3641
3642 ########################################
3643 ## <summary>
3644 ##      Do not audit attempts to use user ttys.
3645 ## </summary>
3646 ## <param name="domain">
3647 ##      <summary>
3648 ##      Domain to not audit.
3649 ##      </summary>
3650 ## </param>
3651 #
3652 interface(`userdom_dontaudit_use_user_ttys',`
3653         gen_require(`
3654                 type user_tty_device_t;
3655         ')
3656
3657         dontaudit $1 user_tty_device_t:chr_file rw_file_perms;
3658 ')
3659
3660 ########################################
3661 ## <summary>
3662 ##      Read the process state of all user domains.
3663 ## </summary>
3664 ## <param name="domain">
3665 ##      <summary>
3666 ##      Domain allowed access.
3667 ##      </summary>
3668 ## </param>
3669 #
3670 interface(`userdom_read_all_users_state',`
3671         gen_require(`
3672                 attribute userdomain;
3673         ')
3674
3675         read_files_pattern($1, userdomain, userdomain)
3676         read_lnk_files_pattern($1,userdomain,userdomain)
3677         kernel_search_proc($1)
3678 ')
3679
3680 ########################################
3681 ## <summary>
3682 ##      Get the attributes of all user domains.
3683 ## </summary>
3684 ## <param name="domain">
3685 ##      <summary>
3686 ##      Domain allowed access.
3687 ##      </summary>
3688 ## </param>
3689 #
3690 interface(`userdom_getattr_all_users',`
3691         gen_require(`
3692                 attribute userdomain;
3693         ')
3694
3695         allow $1 userdomain:process getattr;
3696 ')
3697
3698 ########################################
3699 ## <summary>
3700 ##      Inherit the file descriptors from all user domains
3701 ## </summary>
3702 ## <param name="domain">
3703 ##      <summary>
3704 ##      Domain allowed access.
3705 ##      </summary>
3706 ## </param>
3707 #
3708 interface(`userdom_use_all_users_fds',`
3709         gen_require(`
3710                 attribute userdomain;
3711         ')
3712
3713         allow $1 userdomain:fd use;
3714 ')
3715
3716 ########################################
3717 ## <summary>
3718 ##      Do not audit attempts to inherit the file
3719 ##      descriptors from any user domains.
3720 ## </summary>
3721 ## <param name="domain">
3722 ##      <summary>
3723 ##      Domain to not audit.
3724 ##      </summary>
3725 ## </param>
3726 #
3727 interface(`userdom_dontaudit_use_all_users_fds',`
3728         gen_require(`
3729                 attribute userdomain;
3730         ')
3731
3732         dontaudit $1 userdomain:fd use;
3733 ')
3734
3735 ########################################
3736 ## <summary>
3737 ##      Send general signals to all user domains.
3738 ## </summary>
3739 ## <param name="domain">
3740 ##      <summary>
3741 ##      Domain allowed access.
3742 ##      </summary>
3743 ## </param>
3744 #
3745 interface(`userdom_signal_all_users',`
3746         gen_require(`
3747                 attribute userdomain;
3748         ')
3749
3750         allow $1 userdomain:process signal;
3751 ')
3752
3753 ########################################
3754 ## <summary>
3755 ##      Send kill signals to all user domains.
3756 ## </summary>
3757 ## <param name="domain">
3758 ##      <summary>
3759 ##      Domain allowed access.
3760 ##      </summary>
3761 ## </param>
3762 #
3763 interface(`userdom_kill_all_users',`
3764         gen_require(`
3765                 attribute userdomain;
3766         ')
3767
3768         allow $1 userdomain:process sigkill;
3769 ')
3770
3771 ########################################
3772 ## <summary>
3773 ##      Send a SIGCHLD signal to all user domains.
3774 ## </summary>
3775 ## <param name="domain">
3776 ##      <summary>
3777 ##      Domain allowed access.
3778 ##      </summary>
3779 ## </param>
3780 #
3781 interface(`userdom_sigchld_all_users',`
3782         gen_require(`
3783                 attribute userdomain;
3784         ')
3785
3786         allow $1 userdomain:process sigchld;
3787 ')
3788
3789 ########################################
3790 ## <summary>
3791 ##      Create keys for all user domains.
3792 ## </summary>
3793 ## <param name="domain">
3794 ##      <summary>
3795 ##      Domain allowed access.
3796 ##      </summary>
3797 ## </param>
3798 #
3799 interface(`userdom_create_all_users_keys',`
3800         gen_require(`
3801                 attribute userdomain;
3802         ')
3803
3804         allow $1 userdomain:key create;
3805 ')
3806
3807 ########################################
3808 ## <summary>
3809 ##      Send a dbus message to all user domains.
3810 ## </summary>
3811 ## <param name="domain">
3812 ##      <summary>
3813 ##      Domain allowed access.
3814 ##      </summary>
3815 ## </param>
3816 #
3817 interface(`userdom_dbus_send_all_users',`
3818         gen_require(`
3819                 attribute userdomain;
3820                 class dbus send_msg;
3821         ')
3822
3823         allow $1 userdomain:dbus send_msg;
3824 ')
3825
3826 ########################################
3827 ## <summary>
3828 ##      Allow apps to set rlimits on userdomain
3829 ## </summary>
3830 ## <param name="domain">
3831 ##      <summary>
3832 ##      Domain allowed access.
3833 ##      </summary>
3834 ## </param>
3835 #
3836 interface(`userdom_set_rlimitnh',`
3837         gen_require(`
3838                 attribute userdomain;
3839         ')
3840
3841         allow $1 userdomain:process rlimitinh;
3842 ')
3843
3844 ########################################
3845 ## <summary>
3846 ##      Define this type as a Allow apps to set rlimits on userdomain
3847 ## </summary>
3848 ## <param name="domain">
3849 ##      <summary>
3850 ##      Domain allowed access.
3851 ##      </summary>
3852 ## </param>
3853 ## <param name="userdomain_prefix">
3854 ##      <summary>
3855 ##      The prefix of the user domain (e.g., user
3856 ##      is the prefix for user_t).
3857 ## </summary>
3858 ## </param>
3859 ## <param name="domain">
3860 ##      <summary>
3861 ##      Domain allowed access.
3862 ##      </summary>
3863 ## </param>
3864 #
3865 template(`userdom_unpriv_usertype',`
3866         gen_require(`
3867                 attribute unpriv_userdomain, userdomain;
3868                 attribute $1_usertype;
3869         ')
3870         typeattribute $2  $1_usertype;
3871         typeattribute $2  unpriv_userdomain;
3872         typeattribute $2  userdomain;
3873
3874         ubac_constrained($2)
3875 ')
3876
3877 ########################################
3878 ## <summary>
3879 ##      Connect to users over an unix stream socket.
3880 ## </summary>
3881 ## <param name="domain">
3882 ##      <summary>
3883 ##      Domain allowed access.
3884 ##      </summary>
3885 ## </param>
3886 #
3887 interface(`userdom_stream_connect',`
3888         gen_require(`
3889                 type user_tmp_t;
3890                 attribute userdomain;
3891         ')
3892
3893         stream_connect_pattern($1, user_tmp_t, user_tmp_t, userdomain)
3894 ')
3895
3896 ########################################
3897 ## <summary>
3898 ##      Ptrace user domains.
3899 ## </summary>
3900 ## <param name="domain">
3901 ##      <summary>
3902 ##      Domain allowed access.
3903 ##      </summary>
3904 ## </param>
3905 #
3906 interface(`userdom_ptrace_all_users',`
3907         gen_require(`
3908                 attribute userdomain;
3909         ')
3910
3911         allow $1 userdomain:process ptrace;
3912 ')
3913
3914 ########################################
3915 ## <summary>
3916 ##      dontaudit Search /root
3917 ## </summary>
3918 ## <param name="domain">
3919 ##      <summary>
3920 ##      Domain to not audit.
3921 ##      </summary>
3922 ## </param>
3923 #
3924 interface(`userdom_dontaudit_search_admin_dir',`
3925         gen_require(`
3926                 type admin_home_t;
3927         ')
3928
3929         dontaudit $1 admin_home_t:dir search_dir_perms;
3930 ')
3931
3932 ########################################
3933 ## <summary>
3934 ##      dontaudit list /root
3935 ## </summary>
3936 ## <param name="domain">
3937 ##      <summary>
3938 ##      Domain to not audit.
3939 ##      </summary>
3940 ## </param>
3941 #
3942 interface(`userdom_dontaudit_list_admin_dir',`
3943         gen_require(`
3944                 type admin_home_t;
3945         ')
3946
3947         dontaudit $1 admin_home_t:dir list_dir_perms;
3948 ')
3949
3950 ########################################
3951 ## <summary>
3952 ##      Allow domain to  list /root
3953 ## </summary>
3954 ## <param name="domain">
3955 ##      <summary>
3956 ##      Domain allowed access.
3957 ##      </summary>
3958 ## </param>
3959 #
3960 interface(`userdom_list_admin_dir',`
3961         gen_require(`
3962                 type admin_home_t;
3963         ')
3964
3965         allow $1 admin_home_t:dir list_dir_perms;
3966 ')
3967
3968 ########################################
3969 ## <summary>
3970 ##      Allow Search /root
3971 ## </summary>
3972 ## <param name="domain">
3973 ##      <summary>
3974 ##      Domain allowed access.
3975 ##      </summary>
3976 ## </param>
3977 #
3978 interface(`userdom_search_admin_dir',`
3979         gen_require(`
3980                 type admin_home_t;
3981         ')
3982
3983         allow $1 admin_home_t:dir search_dir_perms;
3984 ')
3985
3986 ########################################
3987 ## <summary>
3988 ##      RW unpriviledged user SysV sempaphores.
3989 ## </summary>
3990 ## <param name="domain">
3991 ##      <summary>
3992 ##      Domain allowed access.
3993 ##      </summary>
3994 ## </param>
3995 #
3996 interface(`userdom_rw_semaphores',`
3997         gen_require(`
3998                 attribute unpriv_userdomain;
3999         ')
4000
4001         allow $1 unpriv_userdomain:sem rw_sem_perms;
4002 ')
4003
4004 ########################################
4005 ## <summary>
4006 ##      Send a message to unpriv users over a unix domain
4007 ##      datagram socket.
4008 ## </summary>
4009 ## <param name="domain">
4010 ##      <summary>
4011 ##      Domain allowed access.
4012 ##      </summary>
4013 ## </param>
4014 #
4015 interface(`userdom_dgram_send',`
4016         gen_require(`
4017                 attribute unpriv_userdomain;
4018         ')
4019
4020         allow $1 unpriv_userdomain:unix_dgram_socket sendto;
4021 ')
4022
4023 ######################################
4024 ## <summary>
4025 ##      Send a message to users over a unix domain
4026 ##      datagram socket.
4027 ## </summary>
4028 ## <param name="domain">
4029 ##      <summary>
4030 ##      Domain allowed access.
4031 ##      </summary>
4032 ## </param>
4033 #
4034 interface(`userdom_users_dgram_send',`
4035         gen_require(`
4036                  attribute userdomain;
4037       ')
4038
4039        allow $1 userdomain:unix_dgram_socket sendto;
4040 ')
4041
4042 #######################################
4043 ## <summary>
4044 ##      Allow execmod on files in homedirectory
4045 ## </summary>
4046 ## <param name="domain">
4047 ##      <summary>
4048 ##      Domain allowed access.
4049 ##      </summary>
4050 ## </param>
4051 ## <rolebase/>
4052 #
4053 interface(`userdom_execmod_user_home_files',`
4054         gen_require(`
4055                 type user_home_type;
4056         ')
4057
4058         allow $1 user_home_type:file execmod;
4059 ')
4060
4061 ########################################
4062 ## <summary>
4063 ##      Read admin home files.
4064 ## </summary>
4065 ## <param name="domain">
4066 ##      <summary>
4067 ##      Domain allowed access.
4068 ##      </summary>
4069 ## </param>
4070 ## <rolecap/>
4071 #
4072 interface(`userdom_read_admin_home_files',`
4073         gen_require(`
4074                 type admin_home_t;
4075         ')
4076
4077         read_files_pattern($1, admin_home_t, admin_home_t)
4078 ')
4079
4080 ########################################
4081 ## <summary>
4082 ##      Execute admin home files.
4083 ## </summary>
4084 ## <param name="domain">
4085 ##      <summary>
4086 ##      Domain allowed access.
4087 ##      </summary>
4088 ## </param>
4089 ## <rolecap/>
4090 #
4091 interface(`userdom_exec_admin_home_files',`
4092         gen_require(`
4093                 type admin_home_t;
4094         ')
4095
4096         exec_files_pattern($1, admin_home_t, admin_home_t)
4097 ')
4098
4099 ########################################
4100 ## <summary>
4101 ##      Append files inherited
4102 ##      in the /root directory.
4103 ## </summary>
4104 ## <param name="domain">
4105 ##      <summary>
4106 ##      Domain allowed access.
4107 ##      </summary>
4108 ## </param>
4109 #
4110 interface(`userdom_inherit_append_admin_home_files',`
4111         gen_require(`
4112                 type admin_home_t;
4113         ')
4114
4115         allow $1 admin_home_t:file { getattr append };
4116 ')
4117
4118
4119 #######################################
4120 ## <summary>
4121 ##      Manage all files/directories in the homedir
4122 ## </summary>
4123 ## <param name="userdomain">
4124 ##      <summary>
4125 ##      The user domain
4126 ##      </summary>
4127 ## </param>
4128 ## <rolebase/>
4129 #
4130 interface(`userdom_manage_user_home_content',`
4131         gen_require(`
4132                 type user_home_dir_t, user_home_t;
4133                 attribute user_home_type;
4134         ')
4135
4136         files_list_home($1)
4137         manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4138         manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4139         manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4140         manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4141         manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
4142         filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
4143
4144 ')
4145
4146
4147 ########################################
4148 ## <summary>
4149 ##      Create objects in a user home directory
4150 ##      with an automatic type transition to
4151 ##      the user home file type.
4152 ## </summary>
4153 ## <param name="domain">
4154 ##      <summary>
4155 ##      Domain allowed access.
4156 ##      </summary>
4157 ## </param>
4158 ## <param name="object_class">
4159 ##      <summary>
4160 ##      The class of the object to be created.
4161 ##      </summary>
4162 ## </param>
4163 #
4164 interface(`userdom_user_home_dir_filetrans_pattern',`
4165         gen_require(`
4166                 type user_home_dir_t, user_home_t;
4167         ')
4168
4169         type_transition $1 user_home_dir_t:$2 user_home_t;
4170 ')
4171
4172 ########################################
4173 ## <summary>
4174 ##      Create objects in the /root directory
4175 ##      with an automatic type transition to
4176 ##      a specified private type.
4177 ## </summary>
4178 ## <param name="domain">
4179 ##      <summary>
4180 ##      Domain allowed access.
4181 ##      </summary>
4182 ## </param>
4183 ## <param name="private_type">
4184 ##      <summary>
4185 ##      The type of the object to create.
4186 ##      </summary>
4187 ## </param>
4188 ## <param name="object_class">
4189 ##      <summary>
4190 ##      The class of the object to be created.
4191 ##      </summary>
4192 ## </param>
4193 #
4194 interface(`userdom_admin_home_dir_filetrans',`
4195         gen_require(`
4196                 type admin_home_t;
4197         ')
4198
4199         filetrans_pattern($1, admin_home_t, $2, $3, $4)
4200 ')
4201
4202 ########################################
4203 ## <summary>
4204 ##      Send signull to unprivileged user domains.
4205 ## </summary>
4206 ## <param name="domain">
4207 ##      <summary>
4208 ##      Domain allowed access.
4209 ##      </summary>
4210 ## </param>
4211 #
4212 interface(`userdom_signull_unpriv_users',`
4213         gen_require(`
4214                 attribute unpriv_userdomain;
4215         ')
4216
4217         allow $1 unpriv_userdomain:process signull;
4218 ')
4219
4220 ########################################
4221 ## <summary>
4222 ##      Write all users files in /tmp
4223 ## </summary>
4224 ## <param name="domain">
4225 ##      <summary>
4226 ##      Domain allowed access.
4227 ##      </summary>
4228 ## </param>
4229 #
4230 interface(`userdom_write_user_tmp_dirs',`
4231         gen_require(`
4232                 type user_tmp_t;
4233         ')
4234
4235         write_files_pattern($1, user_tmp_t, user_tmp_t)
4236 ')
4237
4238 ########################################
4239 ## <summary>
4240 ##      Manage keys for all user domains.
4241 ## </summary>
4242 ## <param name="domain">
4243 ##      <summary>
4244 ##      Domain allowed access.
4245 ##      </summary>
4246 ## </param>
4247 #
4248 interface(`userdom_manage_all_users_keys',`
4249         gen_require(`
4250                 attribute userdomain;
4251         ')
4252
4253         allow $1 userdomain:key manage_key_perms;
4254 ')
4255
4256
4257 ########################################
4258 ## <summary>
4259 ##      Do not audit attempts to read and write
4260 ##      unserdomain stream.
4261 ## </summary>
4262 ## <param name="domain">
4263 ##      <summary>
4264 ##      Domain to not audit.
4265 ##      </summary>
4266 ## </param>
4267 #
4268 interface(`userdom_dontaudit_rw_stream',`
4269         gen_require(`
4270                 attribute userdomain;
4271         ')
4272
4273         dontaudit $1 userdomain:unix_stream_socket rw_socket_perms;
4274 ')
4275
4276 ########################################
4277 ## <summary>
4278 ##      Do not audit attempts to read and write
4279 ##      unserdomain datagram socket.
4280 ## </summary>
4281 ## <param name="domain">
4282 ##      <summary>
4283 ##      Domain to not audit.
4284 ##      </summary>
4285 ## </param>
4286 #
4287 interface(`userdom_dontaudit_rw_dgram_socket',`
4288         gen_require(`
4289                 attribute userdomain;
4290         ')
4291
4292         dontaudit $1 userdomain:unix_dgram_socket { read write };
4293 ')
4294
4295 ########################################
4296 ## <summary>
4297 ##      Append files
4298 ##      in a user home subdirectory.
4299 ## </summary>
4300 ## <param name="domain">
4301 ##      <summary>
4302 ##      Domain allowed access.
4303 ##      </summary>
4304 ## </param>
4305 #
4306 interface(`userdom_append_user_home_content_files',`
4307         gen_require(`
4308                 type user_home_dir_t, user_home_t;
4309         ')
4310
4311         append_files_pattern($1, user_home_t, user_home_t)
4312         allow $1 user_home_dir_t:dir search_dir_perms;
4313         files_search_home($1)
4314 ')
4315
4316 ########################################
4317 ## <summary>
4318 ##      Read files inherited
4319 ##      in a user home subdirectory.
4320 ## </summary>
4321 ## <param name="domain">
4322 ##      <summary>
4323 ##      Domain allowed access.
4324 ##      </summary>
4325 ## </param>
4326 #
4327 interface(`userdom_read_inherited_user_home_content_files',`
4328         gen_require(`
4329                 attribute user_home_type;
4330         ')
4331
4332         allow $1 user_home_type:file { getattr read };
4333 ')
4334
4335 ########################################
4336 ## <summary>
4337 ##      Append files inherited
4338 ##      in a user home subdirectory.
4339 ## </summary>
4340 ## <param name="domain">
4341 ##      <summary>
4342 ##      Domain allowed access.
4343 ##      </summary>
4344 ## </param>
4345 #
4346 interface(`userdom_inherit_append_user_home_content_files',`
4347         gen_require(`
4348                 type user_home_t;
4349         ')
4350
4351         allow $1 user_home_t:file { getattr append };
4352 ')
4353
4354 ########################################
4355 ## <summary>
4356 ##      Append files inherited
4357 ##      in a user tmp files.
4358 ## </summary>
4359 ## <param name="domain">
4360 ##      <summary>
4361 ##      Domain allowed access.
4362 ##      </summary>
4363 ## </param>
4364 #
4365 interface(`userdom_inherit_append_user_tmp_files',`
4366         gen_require(`
4367                 type user_tmp_t;
4368         ')
4369
4370         allow $1 user_tmp_t:file { getattr append };
4371 ')
4372
4373 ######################################
4374 ## <summary>
4375 ##      Read audio files in the users homedir.
4376 ## </summary>
4377 ## <param name="domain">
4378 ##      <summary>
4379 ##      Domain allowed access.
4380 ##      </summary>
4381 ## </param>
4382 ## <rolecap/>
4383 #
4384 interface(`userdom_read_home_audio_files',`
4385         gen_require(`
4386                 type audio_home_t;
4387         ')
4388
4389         userdom_search_user_home_dirs($1)
4390         allow $1 audio_home_t:dir list_dir_perms;
4391         read_files_pattern($1, audio_home_t, audio_home_t)
4392         read_lnk_files_pattern($1, audio_home_t, audio_home_t)
4393 ')
4394
4395 ########################################
4396 ## <summary>
4397 ##      Do not audit attempts to write all user home content files.
4398 ## </summary>
4399 ## <param name="domain">
4400 ##      <summary>
4401 ##      Domain to not audit.
4402 ##      </summary>
4403 ## </param>
4404 #
4405 interface(`userdom_dontaudit_write_all_user_home_content_files',`
4406         gen_require(`
4407                 attribute user_home_type;
4408         ')
4409
4410         dontaudit $1 user_home_type:file write_file_perms;
4411 ')
4412
4413 ########################################
4414 ## <summary>
4415 ##      Do not audit attempts to write all user tmp content files.
4416 ## </summary>
4417 ## <param name="domain">
4418 ##      <summary>
4419 ##      Domain to not audit.
4420 ##      </summary>
4421 ## </param>
4422 #
4423 interface(`userdom_dontaudit_write_all_user_tmp_content_files',`
4424         gen_require(`
4425                 attribute user_tmp_type;
4426         ')
4427
4428         dontaudit $1 user_tmp_type:file write_file_perms;
4429 ')
4430
4431 ########################################
4432 ## <summary>
4433 ##      Manage all user temporary content.
4434 ## </summary>
4435 ## <param name="domain">
4436 ##      <summary>
4437 ##      Domain allowed access.
4438 ##      </summary>
4439 ## </param>
4440 #
4441 interface(`userdom_manage_all_user_tmp_content',`
4442         gen_require(`
4443                 attribute user_tmp_type;
4444         ')
4445
4446         manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
4447         manage_files_pattern($1, user_tmp_type, user_tmp_type)
4448         manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4449         manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4450         manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4451         files_search_tmp($1)
4452 ')
4453
4454 ########################################
4455 ## <summary>
4456 ##      List all user temporary content.
4457 ## </summary>
4458 ## <param name="domain">
4459 ##      <summary>
4460 ##      Domain allowed access.
4461 ##      </summary>
4462 ## </param>
4463 #
4464 interface(`userdom_list_all_user_tmp_content',`
4465         gen_require(`
4466                 attribute user_tmp_type;
4467         ')
4468
4469         list_dirs_pattern($1, user_tmp_type, user_tmp_type)
4470         getattr_files_pattern($1, user_tmp_type, user_tmp_type)
4471         read_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4472         getattr_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4473         getattr_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4474         files_search_var($1)
4475         files_search_tmp($1)
4476 ')
4477
4478 ########################################
4479 ## <summary>
4480 ##      Manage all user tmpfs content.
4481 ## </summary>
4482 ## <param name="domain">
4483 ##      <summary>
4484 ##      Domain allowed access.
4485 ##      </summary>
4486 ## </param>
4487 #
4488 interface(`userdom_manage_all_user_tmpfs_content',`
4489         gen_require(`
4490                 attribute user_tmpfs_type;
4491         ')
4492
4493         manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
4494         manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4495         manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4496         manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4497         manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
4498         fs_search_tmpfs($1)
4499 ')
4500
4501 ########################################
4502 ## <summary>
4503 ##      Delete all user temporary content.
4504 ## </summary>
4505 ## <param name="domain">
4506 ##      <summary>
4507 ##      Domain allowed access.
4508 ##      </summary>
4509 ## </param>
4510 #
4511 interface(`userdom_delete_all_user_tmp_content',`
4512         gen_require(`
4513                 attribute user_tmp_type;
4514         ')
4515
4516         delete_dirs_pattern($1, user_tmp_type, user_tmp_type)
4517         delete_files_pattern($1, user_tmp_type, user_tmp_type)
4518         delete_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
4519         delete_sock_files_pattern($1, user_tmp_type, user_tmp_type)
4520         delete_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
4521         # /var/tmp
4522         files_search_var($1)
4523         files_delete_tmp_dir_entry($1)
4524 ')
4525
4526 ########################################
4527 ## <summary>
4528 ##      Read system SSL certificates in the users homedir.
4529 ## </summary>
4530 ## <param name="domain">
4531 ##      <summary>
4532 ##      Domain allowed access.
4533 ##      </summary>
4534 ## </param>
4535 #
4536 interface(`userdom_read_home_certs',`
4537         gen_require(`
4538                 type home_cert_t;
4539         ')
4540
4541         userdom_search_user_home_content($1)
4542         allow $1 home_cert_t:dir list_dir_perms;
4543         read_files_pattern($1, home_cert_t, home_cert_t)
4544         read_lnk_files_pattern($1, home_cert_t, home_cert_t)
4545 ')
4546
4547 #######################################
4548 ## <summary>
4549 ##  Dontaudit Write system SSL certificates in the users homedir.
4550 ## </summary>
4551 ## <param name="domain">
4552 ##  <summary>
4553 ##      Domain to not audit.
4554 ##  </summary>
4555 ## </param>
4556 #
4557 interface(`userdom_dontaudit_write_home_certs',`
4558     gen_require(`
4559         type home_cert_t;
4560     ')
4561
4562     dontaudit $1 home_cert_t:file write;
4563 ')
4564
4565 ########################################
4566 ## <summary>
4567 ##      dontaudit Search getatrr /root files
4568 ## </summary>
4569 ## <param name="domain">
4570 ##      <summary>
4571 ##      Domain to not audit.
4572 ##      </summary>
4573 ## </param>
4574 #
4575 interface(`userdom_dontaudit_getattr_admin_home_files',`
4576         gen_require(`
4577                 type admin_home_t;
4578         ')
4579
4580         dontaudit $1 admin_home_t:file getattr;
4581 ')
4582
4583 ########################################
4584 ## <summary>
4585 ##      dontaudit read /root lnk files
4586 ## </summary>
4587 ## <param name="domain">
4588 ##      <summary>
4589 ##      Domain to not audit.
4590 ##      </summary>
4591 ## </param>
4592 #
4593 interface(`userdom_dontaudit_read_admin_home_lnk_files',`
4594         gen_require(`
4595                 type admin_home_t;
4596         ')
4597
4598         dontaudit $1 admin_home_t:lnk_file read;
4599 ')
4600
4601 ########################################
4602 ## <summary>
4603 ##      dontaudit read /root files
4604 ## </summary>
4605 ## <param name="domain">
4606 ##      <summary>
4607 ##      Domain to not audit.
4608 ##      </summary>
4609 ## </param>
4610 #
4611 interface(`userdom_dontaudit_read_admin_home_files',`
4612         gen_require(`
4613                 type admin_home_t;
4614         ')
4615
4616         dontaudit $1 admin_home_t:file read_file_perms;
4617 ')
4618
4619 ########################################
4620 ## <summary>
4621 ##      Create, read, write, and delete user
4622 ##      temporary chr files.
4623 ## </summary>
4624 ## <param name="domain">
4625 ##      <summary>
4626 ##      Domain allowed access.
4627 ##      </summary>
4628 ## </param>
4629 #
4630 interface(`userdom_manage_user_tmp_chr_files',`
4631         gen_require(`
4632                 type user_tmp_t;
4633         ')
4634
4635         manage_chr_files_pattern($1, user_tmp_t, user_tmp_t)
4636         files_search_tmp($1)
4637 ')
4638
4639 ########################################
4640 ## <summary>
4641 ##      Create, read, write, and delete user
4642 ##      temporary blk files.
4643 ## </summary>
4644 ## <param name="domain">
4645 ##      <summary>
4646 ##      Domain allowed access.
4647 ##      </summary>
4648 ## </param>
4649 #
4650 interface(`userdom_manage_user_tmp_blk_files',`
4651         gen_require(`
4652                 type user_tmp_t;
4653         ')
4654
4655         manage_blk_files_pattern($1, user_tmp_t, user_tmp_t)
4656         files_search_tmp($1)
4657 ')
4658
4659 ########################################
4660 ## <summary>
4661 ##      Dontaudit attempt to set attributes on  user temporary directories.
4662 ## </summary>
4663 ## <param name="domain">
4664 ##      <summary>
4665 ##      Domain to not audit.
4666 ##      </summary>
4667 ## </param>
4668 #
4669 interface(`userdom_dontaudit_setattr_user_tmp',`
4670         gen_require(`
4671                 type user_tmp_t;
4672         ')
4673
4674         dontaudit $1 user_tmp_t:dir setattr;
4675 ')
4676
4677 ########################################
4678 ## <summary>
4679 ##      Write all inherited users files in /tmp
4680 ## </summary>
4681 ## <param name="domain">
4682 ##      <summary>
4683 ##      Domain allowed access.
4684 ##      </summary>
4685 ## </param>
4686 #
4687 interface(`userdom_write_inherited_user_tmp_files',`
4688         gen_require(`
4689                 type user_tmp_t;
4690         ')
4691
4692         allow $1 user_tmp_t:file write;
4693 ')
4694
4695 ########################################
4696 ## <summary>
4697 ##      Delete all users files in /tmp
4698 ## </summary>
4699 ## <param name="domain">
4700 ##      <summary>
4701 ##      Domain allowed access.
4702 ##      </summary>
4703 ## </param>
4704 #
4705 interface(`userdom_delete_user_tmp_files',`
4706         gen_require(`
4707                 type user_tmp_t;
4708         ')
4709
4710         allow $1 user_tmp_t:file delete_file_perms;
4711 ')
4712
4713 ########################################
4714 ## <summary>
4715 ##      Delete user tmpfs files.
4716 ## </summary>
4717 ## <param name="domain">
4718 ##      <summary>
4719 ##      Domain allowed access.
4720 ##      </summary>
4721 ## </param>
4722 #
4723 interface(`userdom_delete_user_tmpfs_files',`
4724         gen_require(`
4725                 type user_tmpfs_t;
4726         ')
4727
4728         allow $1 user_tmpfs_t:file delete_file_perms;
4729 ')
4730
4731 ########################################
4732 ## <summary>
4733 ##      Read/Write unpriviledged user SysV shared
4734 ##      memory segments.
4735 ## </summary>
4736 ## <param name="domain">
4737 ##      <summary>
4738 ##      Domain allowed access.
4739 ##      </summary>
4740 ## </param>
4741 #
4742 interface(`userdom_rw_unpriv_user_shared_mem',`
4743         gen_require(`
4744                 attribute unpriv_userdomain;
4745         ')
4746
4747         allow $1 unpriv_userdomain:shm rw_shm_perms;
4748 ')
4749
4750 ########################################
4751 ## <summary>
4752 ##      Do not audit attempts to search user
4753 ##      temporary directories.
4754 ## </summary>
4755 ## <param name="domain">
4756 ##      <summary>
4757 ##      Domain to not audit.
4758 ##      </summary>
4759 ## </param>
4760 #
4761 interface(`userdom_dontaudit_search_user_tmp',`
4762         gen_require(`
4763                 type user_tmp_t;
4764         ')
4765
4766         dontaudit $1 user_tmp_t:dir search_dir_perms;
4767 ')
4768
4769 ########################################
4770 ## <summary>
4771 ##      Execute a file in a user home directory
4772 ##      in the specified domain.
4773 ## </summary>
4774 ## <desc>
4775 ##      <p>
4776 ##      Execute a file in a user home directory
4777 ##      in the specified domain.
4778 ##      </p>
4779 ##      <p>
4780 ##      No interprocess communication (signals, pipes,
4781 ##      etc.) is provided by this interface since
4782 ##      the domains are not owned by this module.
4783 ##      </p>
4784 ## </desc>
4785 ## <param name="domain">
4786 ##      <summary>
4787 ##      Domain allowed access.
4788 ##      </summary>
4789 ## </param>
4790 ## <param name="target_domain">
4791 ##      <summary>
4792 ##      The type of the new process.
4793 ##      </summary>
4794 ## </param>
4795 #
4796 interface(`userdom_domtrans_user_home',`
4797         gen_require(`
4798                 type user_home_t;
4799         ')
4800
4801         read_lnk_files_pattern($1, user_home_t, user_home_t)
4802         domain_transition_pattern($1, user_home_t, $2)
4803         type_transition $1 user_home_t:process $2;
4804 ')
4805
4806 ########################################
4807 ## <summary>
4808 ##      Execute a file in a user tmp directory
4809 ##      in the specified domain.
4810 ## </summary>
4811 ## <desc>
4812 ##      <p>
4813 ##      Execute a file in a user tmp directory
4814 ##      in the specified domain.
4815 ##      </p>
4816 ##      <p>
4817 ##      No interprocess communication (signals, pipes,
4818 ##      etc.) is provided by this interface since
4819 ##      the domains are not owned by this module.
4820 ##      </p>
4821 ## </desc>
4822 ## <param name="domain">
4823 ##      <summary>
4824 ##      Domain allowed access.
4825 ##      </summary>
4826 ## </param>
4827 ## <param name="target_domain">
4828 ##      <summary>
4829 ##      The type of the new process.
4830 ##      </summary>
4831 ## </param>
4832 #
4833 interface(`userdom_domtrans_user_tmp',`
4834         gen_require(`
4835                 type user_tmp_t;
4836         ')
4837
4838         files_search_tmp($1)
4839         read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
4840         domain_transition_pattern($1, user_tmp_t, $2)
4841         type_transition $1 user_tmp_t:process $2;
4842 ')
4843
4844 ########################################
4845 ## <summary>
4846 ##      Do not audit attempts to read all user home content files.
4847 ## </summary>
4848 ## <param name="domain">
4849 ##      <summary>
4850 ##      Domain to not audit.
4851 ##      </summary>
4852 ## </param>
4853 #
4854 interface(`userdom_dontaudit_read_all_user_home_content_files',`
4855         gen_require(`
4856                 attribute user_home_type;
4857         ')
4858
4859         dontaudit $1 user_home_type:file read_file_perms;
4860 ')
4861
4862 ########################################
4863 ## <summary>
4864 ##      Do not audit attempts to read all user tmp content files.
4865 ## </summary>
4866 ## <param name="domain">
4867 ##      <summary>
4868 ##      Domain to not audit.
4869 ##      </summary>
4870 ## </param>
4871 #
4872 interface(`userdom_dontaudit_read_all_user_tmp_content_files',`
4873         gen_require(`
4874                 attribute user_tmp_type;
4875         ')
4876
4877         dontaudit $1 user_tmp_type:file read_file_perms;
4878 ')
4879
4880 #######################################
4881 ## <summary>
4882 ## Read and write unpriviledged user SysV sempaphores.
4883 ## </summary>
4884 ## <param name="domain">
4885 ## <summary>
4886 ## Domain allowed access.
4887 ## </summary>
4888 ## </param>
4889 #
4890 interface(`userdom_rw_unpriv_user_semaphores',`
4891    gen_require(`
4892        attribute unpriv_userdomain;
4893    ')
4894
4895    allow $1 unpriv_userdomain:sem rw_sem_perms;
4896 ')