Remove module for thumb.

[people/stevee/selinux-policy.git] / policy / modules / system / userdomain.if

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 0bb4d1e6195e30724cce4067e689afe6c9010385..db35b2e9b93284ed366bfa5068b010d7eadd63ea 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -655,6 +655,8 @@ template(`userdom_common_user_template',`
        auth_read_login_records($1_usertype)
        auth_run_pam($1_t,$1_r)
        auth_run_utempter($1_t,$1_r)
+       auth_filetrans_admin_home_content($1_t)
+       auth_filetrans_home_content($1_t)
 
        init_read_utmp($1_usertype)
 
@@ -685,10 +687,6 @@ template(`userdom_common_user_template',`
                canna_stream_connect($1_usertype)
        ')
 
-       optional_policy(`
-               chrome_role($1_r, $1_usertype)
-       ')
-
        optional_policy(`
                colord_read_lib_files($1_usertype)
        ')
@@ -721,11 +719,6 @@ template(`userdom_common_user_template',`
                        devicekit_dbus_chat_disk($1_usertype)
                ')
 
-               optional_policy(`
-                       evolution_dbus_chat($1_usertype)
-                       evolution_alarm_dbus_chat($1_usertype)
-               ')
-
                optional_policy(`
                        gnome_dbus_chat_gconfdefault($1_usertype)
                ')
@@ -786,10 +779,6 @@ template(`userdom_common_user_template',`
                mta_filetrans_home_content($1_usertype)
        ')
 
-       optional_policy(`
-               nsplugin_role($1_r, $1_usertype)
-       ')
-
        optional_policy(`
                tunable_policy(`allow_user_mysql_connect',`
                        mysql_stream_connect($1_t)
@@ -846,10 +835,6 @@ template(`userdom_common_user_template',`
        optional_policy(`
                slrnpull_search_spool($1_usertype)
        ')
-
-       optional_policy(`
-               thumb_role($1_r, $1_usertype)
-       ')
 ')
 
 #######################################
@@ -1108,8 +1093,6 @@ template(`userdom_restricted_xwindows_user_template',`
         optional_policy(`
                gnome_read_usr_config($1_usertype)
                gnome_role_gkeyringd($1, $1_r, $1_usertype)
-               # cjp: telepathy F15 bugs
-               telepathy_role($1_r, $1_t, $1)
        ')
 
        optional_policy(`
@@ -1261,10 +1244,6 @@ template(`userdom_unpriv_user_template', `
                cron_role($1_r, $1_t)
        ')
 
-       optional_policy(`
-               games_rw_data($1_usertype)
-       ')
-
        optional_policy(`
                gpg_role($1_r, $1_usertype)
        ')
@@ -3967,6 +3946,38 @@ template(`userdom_unpriv_usertype',`
        ubac_constrained($2)
 ')
 
+#######################################
+## <summary>
+##  Define this type as a Allow apps to set rlimits on userdomain
+## </summary>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+## <param name="userdomain_prefix">
+##  <summary>
+##  The prefix of the user domain (e.g., user
+##  is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+##  <summary>
+##  Domain allowed access.
+##  </summary>
+## </param>
+#
+template(`userdom_unpriv_type',`
+    gen_require(`
+        attribute unpriv_userdomain, userdomain;
+    ')
+    typeattribute $2  unpriv_userdomain;
+    typeattribute $2  userdomain;
+
+    auth_use_nsswitch($2)
+    ubac_constrained($2)
+')
+
 ########################################
 ## <summary>
 ##     Connect to users over an unix stream socket.
@@ -4172,6 +4183,25 @@ interface(`userdom_read_admin_home_files',`
        read_files_pattern($1, admin_home_t, admin_home_t)
 ')
 
+########################################
+## <summary>
+##     Delete admin home files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <rolecap/>
+#
+interface(`userdom_delete_admin_home_files',`
+       gen_require(`
+               type admin_home_t;
+       ')
+
+       allow $1 admin_home_t:file delete_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Execute admin home files.
@@ -5052,6 +5082,8 @@ interface(`userdom_filetrans_home_content',`
        userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
        userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
        userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
+       userdom_user_home_dir_filetrans($1, home_cert_t, dir, "certificates")
+       gnome_config_filetrans($1, home_cert_t, dir, "certificates")
 
        #optional_policy(`
        #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
@@ -5094,4 +5126,3 @@ interface(`userdom_home_manager',`
 
        typeattribute $1 userdom_home_manager_type;
 ')
-