Add filetrans rules for homecontent in userdom, allow chrome_sandbox to create home_c...

diff --git a/policy/modules/apps/chrome.te b/policy/modules/apps/chrome.te
index 28cfa1d4d8bbf79203a09b8b4ee7da23ea7abbc2..9dd77b47fc5ed9eb872740bc8046e900f5956bb4 100644 (file)
--- a/policy/modules/apps/chrome.te
+++ b/policy/modules/apps/chrome.te
@@ -83,6 +83,8 @@ userdom_write_inherited_user_tmp_files(chrome_sandbox_t)
 userdom_read_inherited_user_home_content_files(chrome_sandbox_t)
 userdom_dontaudit_use_user_terminals(chrome_sandbox_t)
 userdom_search_user_home_content(chrome_sandbox_t)
+# This one we should figure a way to make it more secure
+userdom_manage_home_certs(chrome_sandbox_t)
 
 miscfiles_read_localization(chrome_sandbox_t)
 miscfiles_read_fonts(chrome_sandbox_t)

diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index a60d2f88c9cacd5bff1185b2c7f2ebddb6b3ec30..e7679224427b466a200879cd18c0ccc14cc2df41 100644 (file)
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -279,6 +279,7 @@ optional_policy(`
 
 optional_policy(`
        userdom_user_home_dir_filetrans_user_home_content(unconfined_domain_type, { dir file lnk_file fifo_file sock_file })
+       userdom_filetrans_home_content(unconfined_domain_type)
 ')
 
 optional_policy(`

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 9b491594295380575b72e6951e46b510c02ee273..ab9a14e53593fb3c5333059f93002d1bc7e05634 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -281,6 +281,8 @@ interface(`userdom_manage_home_role',`
        relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
        relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
        filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
+       userdom_filetrans_home_content($2)
+
        files_list_home($2)
 
        # cjp: this should probably be removed:
@@ -4645,6 +4647,29 @@ interface(`userdom_read_home_certs',`
        read_lnk_files_pattern($1, home_cert_t, home_cert_t)
 ')
 
+########################################
+## <summary>
+##     Manage system SSL certificates in the users homedir.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_manage_home_certs',`
+       gen_require(`
+               type home_cert_t;
+       ')
+
+       allow $1 home_cert_t:dir list_dir_perms;
+       manage_files_pattern($1, home_cert_t, home_cert_t)
+       manage_lnk_files_pattern($1, home_cert_t, home_cert_t)
+
+       userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
+       userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
+')
+
 #######################################
 ## <summary>
 ##  Dontaudit Write system SSL certificates in the users homedir.
@@ -5013,3 +5038,30 @@ interface(`userdom_rw_unpriv_user_semaphores',`
 
    allow $1 unpriv_userdomain:sem rw_sem_perms;
 ')
+
+########################################
+## <summary>
+##     Transition to userdom named content
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_filetrans_home_content',`
+       gen_require(`
+               type home_bin_t, home_cert_t;
+               type audio_home_t;
+       ')
+
+       userdom_user_home_dir_filetrans($1, home_bin_t, dir, "bin")
+       userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Audio")
+       userdom_user_home_dir_filetrans($1, audio_home_t, dir, "Music")
+       userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".cert")
+       userdom_user_home_dir_filetrans($1, home_cert_t, dir, ".pki")
+
+       optional_policy(`
+               gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
+       ')
+')