Change all calls that use the use_nfs_home_dirs to use attributes for either userdom_...

diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 634c47afae34d88fb52375b3122efb0f6b5a5d92..748db5b218f99102d47bb72061e17b3e689e75ac 100644 (file)
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -47,6 +47,7 @@ template(`sudo_role_template',`
        domain_role_change_exemption($1_sudo_t)
        ubac_constrained($1_sudo_t)
        role $2 types $1_sudo_t;
+       userdom_home_manager($1_sudo_t)
 
        type $1_sudo_tmp_t;
        files_tmp_file($1_sudo_tmp_t)

diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 71bf5e8df47639a238b8dd4a47a9f503786259b0..9ce39ddd70571f072e1a15c506c14178ed36841a 100644 (file)
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -101,14 +101,6 @@ userdom_search_user_home_content(sudodomain)
 userdom_search_admin_dir(sudodomain)
 userdom_manage_all_users_keys(sudodomain)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_files(sudodomain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_files(sudodomain)
-')
-
 optional_policy(`
        dbus_system_bus_client(sudodomain)
 ')

diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index f7183ef1695a1202cf57e9601e0df5a85df03681..49ce279f31b12301c41a004c90c3e44184298829 100644 (file)
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -109,11 +109,7 @@ tunable_policy(`cdrecord_read_content',`
        userdom_dontaudit_read_user_home_content_files(cdrecord_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       files_search_mnt(cdrecord_t)
-       fs_read_nfs_files(cdrecord_t)
-       fs_read_nfs_symlinks(cdrecord_t)
-')
+userdom_home_manager(cdrecord_t)
 
 optional_policy(`
        resmgr_stream_connect(cdrecord_t)

diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te
index 10a2ce4a424e6be0a931419815b8785a082f8d86..5c8183212260a28e0df91446ae878a21faf69124 100644 (file)
--- a/policy/modules/apps/gift.te
+++ b/policy/modules/apps/gift.te
@@ -70,17 +70,7 @@ sysnet_read_config(gift_t)
 # giftui looks in .icons, .themes.
 userdom_dontaudit_read_user_home_content_files(gift_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(gift_t)
-       fs_manage_nfs_files(gift_t)
-       fs_manage_nfs_symlinks(gift_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(gift_t)
-       fs_manage_cifs_files(gift_t)
-       fs_manage_cifs_symlinks(gift_t)
-')
+userdom_home_manager(gift_t)
 
 optional_policy(`
        nscd_socket_use(gift_t)
@@ -133,15 +123,4 @@ miscfiles_read_localization(giftd_t)
 sysnet_read_config(giftd_t)
 
 userdom_use_inherited_user_terminals(giftd_t)
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(giftd_t)
-       fs_manage_nfs_files(giftd_t)
-       fs_manage_nfs_symlinks(giftd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(giftd_t)
-       fs_manage_cifs_files(giftd_t)
-       fs_manage_cifs_symlinks(giftd_t)
-')
+userdom_home_manager(gitd_t)

diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if
index deab06c85876d57daad540c69fa73aab7cb2186c..00762c593bd30ab9017a8764735a321bf9957cfe 100644 (file)
--- a/policy/modules/apps/gnome.if
+++ b/policy/modules/apps/gnome.if
@@ -70,6 +70,8 @@ interface(`gnome_role_gkeyringd',`
        ubac_constrained($1_gkeyringd_t)
        domain_user_exemption_target($1_gkeyringd_t)
 
+       userdom_home_manager($1_gkeyringd_t)
+
        role $2 types $1_gkeyringd_t;
 
        domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t)

diff --git a/policy/modules/apps/gnome.te b/policy/modules/apps/gnome.te
index b63754a41c531cf8feb47067845e5f873fd06af7..14d7e30bcebd365fe7bb6ba52bea500f4d9f0396 100644 (file)
--- a/policy/modules/apps/gnome.te
+++ b/policy/modules/apps/gnome.te
@@ -153,15 +153,7 @@ optional_policy(`
        policykit_read_reload(gconfdefaultsm_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(gconfdefaultsm_t)
-       fs_manage_nfs_files(gconfdefaultsm_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(gconfdefaultsm_t)
-       fs_manage_cifs_files(gconfdefaultsm_t)
-')
+userdom_home_manager(gconfdefaultsm_t)
 
 #######################################
 #
@@ -269,13 +261,3 @@ domain_use_interactive_fds(gnome_domain)
 
 userdom_use_inherited_user_terminals(gnome_domain)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_getattr_nfs(gkeyringd_domain)
-       fs_manage_nfs_dirs(gkeyringd_domain)
-       fs_manage_nfs_files(gkeyringd_domain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(gkeyringd_domain)
-       fs_manage_cifs_files(gkeyringd_domain)
-')

diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 401a4ecefde0044c17203a59472c1047fdb592f7..80f8c3180320ac6673200e8ee66c12308262c4b5 100644 (file)
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -150,15 +150,7 @@ userdom_stream_connect(gpg_t)
 
 mta_write_config(gpg_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(gpg_t)
-       fs_manage_nfs_files(gpg_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(gpg_t)
-       fs_manage_cifs_files(gpg_t)
-')
+userdom_home_manager(gpg_t)
 
 optional_policy(`
        gnome_read_config(gpg_t)
@@ -290,17 +282,7 @@ tunable_policy(`gpg_agent_env_file',`
        userdom_manage_user_home_content_files(gpg_agent_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(gpg_agent_t)
-       fs_manage_nfs_files(gpg_agent_t)
-       fs_manage_nfs_symlinks(gpg_agent_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(gpg_agent_t)
-       fs_manage_cifs_files(gpg_agent_t)
-       fs_manage_cifs_symlinks(gpg_agent_t)
-')
+userdom_home_manager(gpg_agent_t)
 
 optional_policy(`
        mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
@@ -371,13 +353,7 @@ allow gpg_pinentry_t user_tmpfs_t:file unlink;
 userdom_signull_unpriv_users(gpg_pinentry_t)
 userdom_use_user_terminals(gpg_pinentry_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(gpg_pinentry_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(gpg_pinentry_t)
-')
+userdom_home_reader(gpg_pinentry_t)
 
 optional_policy(`
        gnome_read_home_config(gpg_pinentry_t)

diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
index b69a6289210821b1c42baa03d6988c3976881dc4..4bc18b642f267dbf1f7ef15aa451fe2b4a1ac849 100644 (file)
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -110,17 +110,7 @@ sysnet_read_config(irc_t)
 # Write to the user domain tty.
 userdom_use_inherited_user_terminals(irc_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(irc_t)
-       fs_manage_nfs_files(irc_t)
-       fs_manage_nfs_symlinks(irc_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(irc_t)
-       fs_manage_cifs_files(irc_t)
-       fs_manage_cifs_symlinks(irc_t)
-')
+userdom_home_manager(irc_t)
 
 optional_policy(`
        nis_use_ypbind(irc_t)
@@ -185,17 +175,7 @@ tunable_policy(`irssi_use_full_network', `
        corenet_sendrecv_all_client_packets(irssi_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs', `
-       fs_manage_nfs_dirs(irssi_t)
-       fs_manage_nfs_files(irssi_t)
-       fs_manage_nfs_symlinks(irssi_t)
-')
-
-tunable_policy(`use_samba_home_dirs', `
-       fs_manage_cifs_dirs(irssi_t)
-       fs_manage_cifs_files(irssi_t)
-       fs_manage_cifs_symlinks(irssi_t)
-')
+userdom_home_manager(irssi_t)
 
 optional_policy(`
        automount_dontaudit_getattr_tmp_dirs(irssi_t)

diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 69e2534668821d9b7733cc9fcb369c404901ba8c..3654ad3b3ff9e6c9d41eaef4de30d6b99921f6a8 100644 (file)
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -186,17 +186,7 @@ tunable_policy(`deny_execmem',`',`
        allow mozilla_t self:process execmem;
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(mozilla_t)
-       fs_manage_nfs_files(mozilla_t)
-       fs_manage_nfs_symlinks(mozilla_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(mozilla_t)
-       fs_manage_cifs_files(mozilla_t)
-       fs_manage_cifs_symlinks(mozilla_t)
-')
+userdom_home_manager(mozilla_t)
 
 # Uploads, local html
 tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
@@ -426,17 +416,7 @@ tunable_policy(`allow_execstack',`
        allow mozilla_plugin_t self:process execstack;
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(mozilla_plugin_t)
-       fs_manage_nfs_files(mozilla_plugin_t)
-       fs_manage_nfs_symlinks(mozilla_plugin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(mozilla_plugin_t)
-       fs_manage_cifs_files(mozilla_plugin_t)
-       fs_manage_cifs_symlinks(mozilla_plugin_t)
-')
+userdom_home_manager(mozilla_plugin_t)
 
 optional_policy(`
        alsa_read_rw_config(mozilla_plugin_t)

diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index 8b1fa1b888cf4e2527fffd72637ec10b6d08f576..320963bee4840efcf268a9f5e32b2e8ab3e9b8c0 100644 (file)
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -84,6 +84,7 @@ userdom_read_user_tmp_files(mencoder_t)
 userdom_read_user_tmp_symlinks(mencoder_t)
 userdom_read_user_home_content_files(mencoder_t)
 userdom_read_user_home_content_symlinks(mencoder_t)
+userdom_home_manager(mencoder_t)
 
 # Read content to encode
 ifndef(`enable_mls',`
@@ -104,46 +105,6 @@ tunable_policy(`allow_mplayer_execstack',`
        allow mencoder_t self:process { execmem execstack };
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(mencoder_t)
-       fs_manage_nfs_files(mencoder_t)
-       fs_manage_nfs_symlinks(mencoder_t)
-
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(mencoder_t)
-       fs_manage_cifs_files(mencoder_t)
-       fs_manage_cifs_symlinks(mencoder_t)
-
-')
-
-# Read content to encode
-tunable_policy(`use_nfs_home_dirs',`
-       fs_list_auto_mountpoints(mencoder_t)
-       files_list_home(mencoder_t)
-       fs_read_nfs_files(mencoder_t)
-       fs_read_nfs_symlinks(mencoder_t)
-
-',`
-       files_dontaudit_list_home(mencoder_t)
-       fs_dontaudit_list_auto_mountpoints(mencoder_t)
-       fs_dontaudit_read_nfs_files(mencoder_t)
-       fs_dontaudit_list_nfs(mencoder_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_list_auto_mountpoints(mencoder_t)
-       files_list_home(mencoder_t)
-       fs_read_cifs_files(mencoder_t)
-       fs_read_cifs_symlinks(mencoder_t)
-',`
-       files_dontaudit_list_home(mencoder_t)
-       fs_dontaudit_list_auto_mountpoints(mencoder_t)
-       fs_dontaudit_read_cifs_files(mencoder_t)
-       fs_dontaudit_list_cifs(mencoder_t)
-')
-
 ########################################
 #
 # mplayer local policy
@@ -242,6 +203,7 @@ userdom_read_user_tmp_symlinks(mplayer_t)
 userdom_read_user_home_content_files(mplayer_t)
 userdom_read_user_home_content_symlinks(mplayer_t)
 userdom_write_user_tmp_sockets(mplayer_t)
+userdom_home_manager(mplayer_t)
 
 xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
 
@@ -264,47 +226,12 @@ tunable_policy(`allow_mplayer_execstack',`
        allow mplayer_t self:process { execmem execstack };
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(mplayer_t)
-       fs_manage_nfs_files(mplayer_t)
-       fs_manage_nfs_symlinks(mplayer_t)
-')
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(mplayer_t)
-       fs_manage_cifs_files(mplayer_t)
-       fs_manage_cifs_symlinks(mplayer_t)
-')
-
 # Legacy domain issues
 tunable_policy(`allow_mplayer_execstack',`
        allow mplayer_t mplayer_tmpfs_t:file execute;
 ')
 
-# Read songs
-tunable_policy(`use_nfs_home_dirs',`
-       fs_list_auto_mountpoints(mplayer_t)
-       files_list_home(mplayer_t)
-       fs_read_nfs_files(mplayer_t)
-       fs_read_nfs_symlinks(mplayer_t)
-
-',`
-       files_dontaudit_list_home(mplayer_t)
-       fs_dontaudit_list_auto_mountpoints(mplayer_t)
-       fs_dontaudit_read_nfs_files(mplayer_t)
-       fs_dontaudit_list_nfs(mplayer_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_list_auto_mountpoints(mplayer_t)
-       files_list_home(mplayer_t)
-       fs_read_cifs_files(mplayer_t)
-       fs_read_cifs_symlinks(mplayer_t)
-',`
-       files_dontaudit_list_home(mplayer_t)
-       fs_dontaudit_list_auto_mountpoints(mplayer_t)
-       fs_dontaudit_read_cifs_files(mplayer_t)
-       fs_dontaudit_list_cifs(mplayer_t)
-')
+userdom_home_manager(mplayer_t)
 
 optional_policy(`
        alsa_read_rw_config(mplayer_t)

diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index f9fbc60a67e44840f9e19696ae8f15015babaf7b..b0b3ce6f8dd72bda9f585e4f4c9ef9d78e740ef3 100644 (file)
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -39,6 +39,8 @@ template(`screen_role_template',`
        ubac_constrained($1_screen_t)
        role $2 types $1_screen_t;
 
+       userdom_home_reader($1_screen_t)
+
        domtrans_pattern($3, screen_exec_t, $1_screen_t)
        allow $3 $1_screen_t:process { signal sigchld };
        dontaudit $3 $1_screen_t:unix_stream_socket { read write };

diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index b3b144cef80852b269b67dfed45ebcc56167097c..0bd13e33fbfdcd9219ca41524d906223a0a6a6b2 100644 (file)
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -115,12 +115,3 @@ userdom_create_user_pty(screen_domain)
 userdom_setattr_user_ptys(screen_domain)
 userdom_setattr_user_ttys(screen_domain)
 
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_symlinks(screen_domain)
-       fs_list_cifs(screen_domain)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_list_nfs(screen_domain)
-       fs_read_nfs_symlinks(screen_domain)
-')

diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
index 546f5a56a8098f2d76a2188a95064463d7bd3f83..7942965db3ec169e6766f24a96bae4ee5e8ec52c 100644 (file)
--- a/policy/modules/apps/telepathy.te
+++ b/policy/modules/apps/telepathy.te
@@ -116,15 +116,7 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',`
        corenet_sendrecv_generic_client_packets(telepathy_gabble_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(telepathy_gabble_t)
-       fs_manage_nfs_files(telepathy_gabble_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(telepathy_gabble_t)
-       fs_manage_cifs_files(telepathy_gabble_t)
-')
+userdom_home_manager(telepathy_gabble_t)
 
 optional_policy(`
        dbus_system_bus_client(telepathy_gabble_t)
@@ -183,15 +175,7 @@ files_search_pids(telepathy_logger_t)
 
 fs_getattr_all_fs(telepathy_logger_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(telepathy_logger_t)
-       fs_manage_nfs_files(telepathy_logger_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(telepathy_logger_t)
-       fs_manage_cifs_files(telepathy_logger_t)
-')
+userdom_home_manager(telepathy_logger_t)
 
 optional_policy(`
        # ~/.config/dconf/user
@@ -220,15 +204,7 @@ fs_getattr_all_fs(telepathy_mission_control_t)
 files_read_etc_files(telepathy_mission_control_t)
 files_read_usr_files(telepathy_mission_control_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(telepathy_mission_control_t)
-       fs_manage_nfs_files(telepathy_mission_control_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(telepathy_mission_control_t)
-       fs_manage_cifs_files(telepathy_mission_control_t)
-')
+userdom_home_manager(telepathy_mission_control_t)
 
 optional_policy(`
        dbus_system_bus_client(telepathy_mission_control_t)

diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te
index f50789e4f526282266fbd0cdd0b6c0e1b6ee8493..9ba6da84eb086ff5d2b09cf194f5a096769a2e8b 100644 (file)
--- a/policy/modules/apps/thunderbird.te
+++ b/policy/modules/apps/thunderbird.te
@@ -114,17 +114,7 @@ xserver_read_xdm_tmp_files(thunderbird_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
 
 # Access ~/.thunderbird
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(thunderbird_t)
-       fs_manage_nfs_files(thunderbird_t)
-       fs_manage_nfs_symlinks(thunderbird_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(thunderbird_t)
-       fs_manage_cifs_files(thunderbird_t)
-       fs_manage_cifs_symlinks(thunderbird_t)
-')
+userdom_home_manager(thunderbird_t)
 
 tunable_policy(`mail_read_content && use_nfs_home_dirs',`
        files_list_home(thunderbird_t)

diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 98bfbf3c263f3491eb79c37db10b5cba65719193..38318b9cf9253149916d88eb35f05289bf6f3bb9 100644 (file)
--- a/policy/modules/apps/tvtime.te
+++ b/policy/modules/apps/tvtime.te
@@ -77,16 +77,7 @@ userdom_use_inherited_user_terminals(tvtime_t)
 userdom_read_user_home_content_files(tvtime_t)
 
 # X access, Home files
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(tvtime_t)
-       fs_manage_nfs_files(tvtime_t)
-       fs_manage_nfs_symlinks(tvtime_t)
-')
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(tvtime_t)
-       fs_manage_cifs_files(tvtime_t)
-       fs_manage_cifs_symlinks(tvtime_t)
-')
+userdom_home_manager(tvtime_t)
 
 optional_policy(`
        xserver_user_x_domain_template(tvtime, tvtime_t, tvtime_tmpfs_t)

diff --git a/policy/modules/apps/wireshark.te b/policy/modules/apps/wireshark.te
index 95a3d065df597ed4785dc4d58a7fee8c488a9e04..356e2a1e0117d5717f12b8ded1e3ed23db694d9a 100644 (file)
--- a/policy/modules/apps/wireshark.te
+++ b/policy/modules/apps/wireshark.te
@@ -97,17 +97,7 @@ sysnet_read_config(wireshark_t)
 
 userdom_manage_user_home_content_files(wireshark_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(wireshark_t)
-       fs_manage_nfs_files(wireshark_t)
-       fs_manage_nfs_symlinks(wireshark_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(wireshark_t)
-       fs_manage_cifs_files(wireshark_t)
-       fs_manage_cifs_symlinks(wireshark_t)
-')
+userdom_home_manager(wireshark_t)
 
 # Manual transition from userhelper
 optional_policy(`

diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index e5652a11d4f1c8f729114a7852c1281805b6aaa8..6342520d96650832c4881a4ca0a672423296ef7c 100644 (file)
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2165,6 +2165,24 @@ interface(`fs_read_fusefs_symlinks',`
        read_lnk_files_pattern($1, fusefs_t, fusefs_t)
 ')
 
+########################################
+## <summary>
+##     Manage symbolic links on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`fs_manage_fusefs_symlinks',`
+       gen_require(`
+               type fusefs_t;
+       ')
+
+       manage_lnk_files_pattern($1, fusefs_t, fusefs_t)
+')
+
 ########################################
 ## <summary>
 ##     Get the attributes of an hugetlbfs

diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 7cb2fe58deeabc14f0ab5c0473ba619b60d9fb3f..2ef8fefb269027215a8cdc84a7f0acbecdfb688e 100644 (file)
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1401,5 +1401,3 @@ tunable_policy(`httpd_builtin_scripting',`
        read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
        read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
 ')
-
-

diff --git a/policy/modules/services/cloudform.te b/policy/modules/services/cloudform.te
index 5c0c84f8d9c6fd72bb68a158d42f875e37def555..83fc37d28ecc1de0906a0fea4e7bed4c547eff10 100644 (file)
--- a/policy/modules/services/cloudform.te
+++ b/policy/modules/services/cloudform.te
@@ -137,12 +137,7 @@ corenet_tcp_connect_all_ports(iwhd_t)
 dev_read_rand(iwhd_t)
 dev_read_urand(iwhd_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-    fs_list_auto_mountpoints(iwhd_t)
-    fs_manage_nfs_dirs(iwhd_t)
-    fs_manage_nfs_files(iwhd_t)
-    fs_manage_nfs_symlinks(iwhd_t)
-')
+userdom_home_manager(iwhd_t)
 
 ########################################
 #

diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
index 6ff206b997e825071f542dd57983d45800b81a82..74f1baaeaa8b5f872cabfc36657b0bca43bde418 100644 (file)
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
@@ -91,15 +91,7 @@ sysnet_dns_name_resolve(colord_t)
 
 userdom_rw_user_tmpfs_files(colord_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_getattr_nfs(colord_t)
-       fs_read_nfs_files(colord_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_getattr_cifs(colord_t)
-       fs_read_cifs_files(colord_t)
-')
+userdom_home_reader(colord_t)
 
 optional_policy(`
        cups_read_config(colord_t)

diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te
index 5b322ca88f9290c2a4186c9ebb1184b7f462ac07..d45381d65fd84779ba06c4e8848b023a5f0dce93 100644 (file)
--- a/policy/modules/services/consolekit.te
+++ b/policy/modules/services/consolekit.te
@@ -82,13 +82,7 @@ userdom_dontaudit_read_user_home_content_files(consolekit_t)
 userdom_dontaudit_getattr_admin_home_files(consolekit_t)
 userdom_read_user_tmp_files(consolekit_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(consolekit_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(consolekit_t)
-')
+userdom_home_reader(consolekit_t)
 
 optional_policy(`
        cron_read_system_job_lib_files(consolekit_t)

diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index 825cafbbdbd023fe096cf5f41f470059a34738f3..3bc4cfd4e0147db708f1840efe389c01e2c82628 100644 (file)
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -625,16 +625,7 @@ optional_policy(`
        lpd_manage_spool(cups_pdf_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_search_auto_mountpoints(cups_pdf_t)
-       fs_manage_nfs_dirs(cups_pdf_t)
-       fs_manage_nfs_files(cups_pdf_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(cups_pdf_t)
-       fs_manage_cifs_files(cups_pdf_t)
-')
+userdom_home_manager(cups_pdf_t)
 
 optional_policy(`
        gnome_read_config(cups_pdf_t)

diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 3558f18126f9759187b00d60fead6ba2e5786489..115133d3ceba50dddeaee299315e4a25dd6764cc 100644 (file)
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -56,6 +56,8 @@ template(`dbus_role_template',`
        ubac_constrained($1_dbusd_t)
        role $2 types $1_dbusd_t;
 
+       userdom_home_manager($1_dbusd_t)
+
        ##############################
        #
        # Local policy

diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index f0266a937bc4df14766d44364629f46e14883ee1..c9396dbfd3e94d93d9e5364d0ac19774a6dfde79 100644 (file)
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -143,13 +143,7 @@ seutil_sigchld_newrole(system_dbusd_t)
 userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
 userdom_dontaudit_search_user_home_dirs(system_dbusd_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-    fs_read_nfs_files(system_dbusd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-    fs_read_cifs_files(system_dbusd_t)
-')
+userdom_home_reader(system_dbusd_t)
 
 optional_policy(`
        bind_domtrans(system_dbusd_t)
@@ -309,16 +303,6 @@ userdom_manage_user_home_content_dirs(session_bus_type)
 userdom_manage_user_home_content_files(session_bus_type)
 userdom_user_home_dir_filetrans_user_home_content(session_bus_type, { dir file })
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(session_bus_type)
-       fs_manage_nfs_files(session_bus_type)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(session_bus_type)
-       fs_manage_cifs_files(session_bus_type)
-')
-
 optional_policy(`
        gnome_read_gconf_home_files(session_bus_type)
 ')

diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index 2fbb8694a2590e69593a16c789362e0ae8e81e9a..194f1709ed64c3ae11212e6ec57d2a2fede4b3b4 100644 (file)
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -142,6 +142,7 @@ files_dontaudit_list_default(dovecot_t)
 # Dovecot now has quota support and it uses getmntent() to find the mountpoints.
 files_read_etc_runtime_files(dovecot_t)
 files_search_all_mountpoints(dovecot_t)
+files_read_var_lib_files(dovecot_t)
 
 init_getattr_utmp(dovecot_t)
 
@@ -152,6 +153,7 @@ logging_send_syslog_msg(dovecot_t)
 miscfiles_read_generic_certs(dovecot_t)
 miscfiles_read_localization(dovecot_t)
 
+userdom_home_manager(dovecot_t)
 userdom_dontaudit_use_unpriv_user_fds(dovecot_t)
 userdom_manage_user_home_content_dirs(dovecot_t)
 userdom_manage_user_home_content_files(dovecot_t)
@@ -238,7 +240,6 @@ files_read_usr_files(dovecot_auth_t)
 files_read_usr_symlinks(dovecot_auth_t)
 files_read_var_lib_files(dovecot_auth_t)
 files_search_tmp(dovecot_auth_t)
-files_read_var_lib_files(dovecot_t)
 
 fs_getattr_xattr_fs(dovecot_auth_t)
 
@@ -330,23 +331,7 @@ userdom_manage_user_home_content_pipes(dovecot_deliver_t)
 userdom_manage_user_home_content_sockets(dovecot_deliver_t)
 userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(dovecot_deliver_t)
-       fs_manage_nfs_files(dovecot_deliver_t)
-       fs_manage_nfs_symlinks(dovecot_deliver_t)
-       fs_manage_nfs_dirs(dovecot_t)
-       fs_manage_nfs_files(dovecot_t)
-       fs_manage_nfs_symlinks(dovecot_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(dovecot_deliver_t)
-       fs_manage_cifs_files(dovecot_deliver_t)
-       fs_manage_cifs_symlinks(dovecot_deliver_t)
-       fs_manage_cifs_dirs(dovecot_t)
-       fs_manage_cifs_files(dovecot_t)
-       fs_manage_cifs_symlinks(dovecot_t)
-')
+userdom_home_manager(dovecot_deliver_t)
 
 optional_policy(`
        gnome_manage_data(dovecot_deliver_t)

diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
index 3bc14c311474957b59636dca5ad50fc28f2271fe..6c4a30df5b190b118af2ddf587e6490b71caffd1 100644 (file)
--- a/policy/modules/services/ftp.te
+++ b/policy/modules/services/ftp.te
@@ -458,16 +458,4 @@ tunable_policy(`sftpd_full_access',`
        files_manage_non_security_files(sftpd_t)
 ')
 
-tunable_policy(`use_samba_home_dirs',`
-       # allow read access to /home by default
-       fs_list_cifs(sftpd_t)
-       fs_read_cifs_files(sftpd_t)
-       fs_read_cifs_symlinks(sftpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
-       # allow read access to /home by default
-       fs_list_nfs(sftpd_t)
-       fs_read_nfs_files(sftpd_t)
-       fs_read_nfs_symlinks(ftpd_t)
-')
+userdom_home_reader(sftpd_t)

diff --git a/policy/modules/services/git.if b/policy/modules/services/git.if
index 27945d10f937b2f008fac843be753fd97295b0f3..9077b2d8531530b463c95e5634cb451a652fd7d8 100644 (file)
--- a/policy/modules/services/git.if
+++ b/policy/modules/services/git.if
@@ -209,17 +209,7 @@ interface(`git_rwx_all_content',`
        userdom_search_user_home_dirs($1)
        files_search_var_lib($1)
 
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_exec_nfs_files($1)
-               fs_manage_nfs_dirs($1)
-               fs_manage_nfs_files($1)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_exec_cifs_files($1)
-               fs_manage_cifs_dirs($1)
-               fs_manage_cifs_files($1)
-       ')
+       userdom_home_manager($1)
 
        tunable_policy(`git_system_use_cifs',`
                fs_exec_cifs_files($1)
@@ -323,15 +313,7 @@ interface(`git_read_all_content_files',`
        userdom_search_user_home_dirs($1)
        files_search_var_lib($1)
 
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_list_nfs($1)
-               fs_read_nfs_files($1)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_list_cifs($1)
-               fs_read_cifs_files($1)
-       ')
+       userdom_home_reader($1)
 
        tunable_policy(`git_system_use_cifs',`
                fs_list_cifs($1)
@@ -363,16 +345,7 @@ interface(`git_read_session_content_files',`
        list_dirs_pattern($1, git_session_content_t, git_session_content_t)
        read_files_pattern($1, git_session_content_t, git_session_content_t)
        userdom_search_user_home_dirs($1)
-
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_list_nfs($1)
-               fs_read_nfs_files($1)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_list_cifs($1)
-               fs_read_cifs_files($1)
-       ')
+       userdom_home_reader($1)
 ')
 
 #######################################

diff --git a/policy/modules/services/git.te b/policy/modules/services/git.te
index 2ef543c1051d46dc1a592afefd7008063947e426..fa32fcfbd9b04bdbb48b849a17520b81ecaf85be 100644 (file)
--- a/policy/modules/services/git.te
+++ b/policy/modules/services/git.te
@@ -166,15 +166,7 @@ tunable_policy(`git_session_bind_all_unreserved_ports',`
        corenet_sendrecv_generic_server_packets(git_session_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_list_nfs(git_session_t)
-       fs_read_nfs_files(git_session_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_list_cifs(git_session_t)
-       fs_read_cifs_files(git_session_t)
-')
+userdom_home_reader(git_session_t)
 
 ########################################
 #

diff --git a/policy/modules/services/i18n_input.te b/policy/modules/services/i18n_input.te
index 5fc89c4e6b6f29d23b2b879866b038773ad23535..738c3e291dfcdf9cbbbbdf8f40271c5467ad4a55 100644 (file)
--- a/policy/modules/services/i18n_input.te
+++ b/policy/modules/services/i18n_input.te
@@ -74,16 +74,7 @@ sysnet_read_config(i18n_input_t)
 
 userdom_dontaudit_use_unpriv_user_fds(i18n_input_t)
 userdom_read_user_home_content_files(i18n_input_t)
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(i18n_input_t)
-       fs_read_nfs_symlinks(i18n_input_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(i18n_input_t)
-       fs_read_cifs_symlinks(i18n_input_t)
-')
+userdom_home_reader(i18n_input_t)
 
 optional_policy(`
        canna_stream_connect(i18n_input_t)

diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index f28acd2ca76fb02485c8360e6a636eea6a4ea69b..27d96e182ee5d7ebe67c46437f72cd0023b9c76f 100644 (file)
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -308,19 +308,7 @@ tunable_policy(`use_lpd_server',`
        read_lnk_files_pattern(lpr_t, printconf_t, printconf_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       files_list_home(lpr_t)
-       fs_list_auto_mountpoints(lpr_t)
-       fs_read_nfs_files(lpr_t)
-       fs_read_nfs_symlinks(lpr_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       files_list_home(lpr_t)
-       fs_list_auto_mountpoints(lpr_t)
-       fs_read_cifs_files(lpr_t)
-       fs_read_cifs_symlinks(lpr_t)
-')
+userdom_home_reader(lpr_t)
 
 optional_policy(`
        cups_read_config(lpr_t)

diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
index e4ac35e3721a5bba8c870574fd1f0d48a19a78c7..36ff69df959943eab7e8ed5df5d1ae79e1f79239 100644 (file)
--- a/policy/modules/services/mpd.te
+++ b/policy/modules/services/mpd.te
@@ -108,16 +108,7 @@ miscfiles_read_localization(mpd_t)
 
 userdom_read_home_audio_files(mpd_t)
 userdom_read_user_tmpfs_files(mpd_t)
-
-tunable_policy(`use_samba_home_dirs',`
-    fs_read_cifs_files(mpd_t)
-    fs_read_cifs_symlinks(mpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
-    fs_read_nfs_files(mpd_t)
-    fs_read_nfs_symlinks(mpd_t)
-')
+userdom_home_reader(mpd_t)
 
 optional_policy(`
        alsa_read_rw_config(mpd_t)

diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index e5519fdef588ff77978cd1c40b33bd2520ad1e82..867dfacd5bd1949f934f4aa713ccb9611b6bbee4 100644 (file)
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -340,6 +340,8 @@ interface(`mta_mailserver_delivery',`
        ')
 
        typeattribute $1 mailserver_delivery;
+
+       userdom_home_manager($1)
 ')
 
 #######################################

diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index 65fd01fae3214baea87455e67784fbdab66aee3c..7f55b853d5f22a6143f8b8e39d1b38a20ad27915 100644 (file)
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -233,18 +233,6 @@ read_files_pattern(mailserver_delivery, mail_home_t, mail_home_t)
 
 read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
 
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(mailserver_delivery)
-       fs_manage_cifs_files(mailserver_delivery)
-       fs_manage_cifs_symlinks(mailserver_delivery)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(mailserver_delivery)
-       fs_manage_nfs_files(mailserver_delivery)
-       fs_manage_nfs_symlinks(mailserver_delivery)
-')
-
 optional_policy(`
        dovecot_manage_spool(mailserver_delivery)
        dovecot_domtrans_deliver(mailserver_delivery)

diff --git a/policy/modules/services/oident.te b/policy/modules/services/oident.te
index 98f541f78c577612bad3ba0f0662b7ecdde8ce19..58148edc2c3ce389a6a6c99d1bf2542a9c749bee 100644 (file)
--- a/policy/modules/services/oident.te
+++ b/policy/modules/services/oident.te
@@ -59,17 +59,8 @@ miscfiles_read_localization(oidentd_t)
 sysnet_read_config(oidentd_t)
 
 oident_read_user_content(oidentd_t)
+userdom_home_reader(oidentd_t)
 
 optional_policy(`
        nis_use_ypbind(oidentd_t)
 ')
-
-tunable_policy(`use_samba_home_dirs', `
-       fs_list_cifs(oidentd_t)
-       fs_read_cifs_files(oidentd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs', `
-       fs_list_nfs(oidentd_t)
-       fs_read_nfs_files(oidentd_t)
-')

diff --git a/policy/modules/services/polipo.te b/policy/modules/services/polipo.te
index 89ab1b6d65dc135cec2ddad84f456ccd0e4d3472..d958b5355d06553eefc4f0db1af98e0b5c11c4e0 100644 (file)
--- a/policy/modules/services/polipo.te
+++ b/policy/modules/services/polipo.te
@@ -146,14 +146,4 @@ tunable_policy(`polipo_session_send_syslog_msg',`
        logging_send_syslog_msg(polipo_session_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_files(polipo_session_t)
-',`
-       fs_dontaudit_manage_nfs_files(polipo_session_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_files(polipo_session_t)
-',`
-       fs_dontaudit_manage_cifs_files(polipo_session_t)
-')
+userdom_home_manager(polipo_session_t)

diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te
index 6451f821222cc9cda47328c04d4677b62fbca4ee..4c188f9990259e4a98ae3eacc13023a55dd80716 100644 (file)
--- a/policy/modules/services/procmail.te
+++ b/policy/modules/services/procmail.te
@@ -110,17 +110,7 @@ ifdef(`hide_broken_symptoms',`
        mta_dontaudit_rw_queue(procmail_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(procmail_t)
-       fs_manage_nfs_files(procmail_t)
-       fs_manage_nfs_symlinks(procmail_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(procmail_t)
-       fs_manage_cifs_files(procmail_t)
-       fs_manage_cifs_symlinks(procmail_t)
-')
+userdom_home_manager(procmail_t)
 
 optional_policy(`
        clamav_domtrans_clamscan(procmail_t)

diff --git a/policy/modules/services/razor.te b/policy/modules/services/razor.te
index cc1775ed14898f1d92911f0d899b28b5f29953aa..9405f78deca6d70d451635aa3467bfb4aa42ff35 100644 (file)
--- a/policy/modules/services/razor.te
+++ b/policy/modules/services/razor.te
@@ -121,17 +121,7 @@ ifdef(`distro_redhat',`
        userdom_search_user_home_dirs(razor_t)
        userdom_use_inherited_user_terminals(razor_t)
 
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_manage_nfs_dirs(razor_t)
-               fs_manage_nfs_files(razor_t)
-               fs_manage_nfs_symlinks(razor_t)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_manage_cifs_dirs(razor_t)
-               fs_manage_cifs_files(razor_t)
-               fs_manage_cifs_symlinks(razor_t)
-       ')
+       userdom_home_manager(razor_t)
 
        optional_policy(`
                milter_manage_spamass_state(razor_t)

diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te
index adc198dab8481b1f05810c796b00448e865b31c3..a4757973879cc86eb457f57e590f669019a368f3 100644 (file)
--- a/policy/modules/services/remotelogin.te
+++ b/policy/modules/services/remotelogin.te
@@ -88,15 +88,7 @@ userdom_manage_user_tmp_dirs(remote_login_t)
 userdom_manage_user_tmp_files(remote_login_t)
 userdom_tmp_filetrans_user_tmp(remote_login_t, { file dir })
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(remote_login_t)
-       fs_read_nfs_symlinks(remote_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(remote_login_t)
-       fs_read_cifs_symlinks(remote_login_t)
-')
+userdom_home_reader(remote_login_t)
 
 optional_policy(`
        alsa_domtrans(remote_login_t)

diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te
index 4bcaacc53071daebf8c572af91cbbb804001d32c..91c8ee8c8551e2bb049e506ea565e7578a3e0a08 100644 (file)
--- a/policy/modules/services/rlogin.te
+++ b/policy/modules/services/rlogin.te
@@ -92,21 +92,10 @@ userdom_search_admin_dir(rlogind_t)
 userdom_manage_user_tmp_files(rlogind_t)
 userdom_tmp_filetrans_user_tmp(rlogind_t, file)
 userdom_use_user_terminals(rlogind_t)
+userdom_home_reader(rlogind_t)
 
 rlogin_read_home_content(rlogind_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_list_nfs(rlogind_t)
-       fs_read_nfs_files(rlogind_t)
-       fs_read_nfs_symlinks(rlogind_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_list_cifs(rlogind_t)
-       fs_read_cifs_files(rlogind_t)
-       fs_read_cifs_symlinks(rlogind_t)
-')
-
 optional_policy(`
        kerberos_keytab_template(rlogind, rlogind_t)
        kerberos_manage_host_rcache(rlogind_t)

diff --git a/policy/modules/services/rshd.te b/policy/modules/services/rshd.te
index 49a42832a0a513cc73ad9876ddbf11c828bd8097..cdf9184813691a7c4e2812dca252ee13efcf6fdc 100644 (file)
--- a/policy/modules/services/rshd.te
+++ b/policy/modules/services/rshd.te
@@ -68,15 +68,7 @@ seutil_read_default_contexts(rshd_t)
 userdom_search_user_home_content(rshd_t)
 userdom_manage_tmp_role(system_r, rshd_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(rshd_t)
-       fs_read_nfs_symlinks(rshd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(rshd_t)
-       fs_read_cifs_symlinks(rshd_t)
-')
+userdom_home_reader(rshd_t)
 
 optional_policy(`
        kerberos_keytab_template(rshd, rshd_t)

diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
index a370364325fa880c98d8c068450229d10c764aa7..32019d895797c87f5931de0b046e02e6a9e27a3f 100644 (file)
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -147,6 +147,7 @@ manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
 userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
+userdom_home_manager(spamassassin_t)
 
 kernel_read_kernel_sysctls(spamassassin_t)
 
@@ -207,18 +208,6 @@ tunable_policy(`spamd_enable_home_dirs',`
        userdom_manage_user_home_content_symlinks(spamd_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(spamassassin_t)
-       fs_manage_nfs_files(spamassassin_t)
-       fs_manage_nfs_symlinks(spamassassin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(spamassassin_t)
-       fs_manage_cifs_files(spamassassin_t)
-       fs_manage_cifs_symlinks(spamassassin_t)
-')
-
 optional_policy(`
        # Write pid file and socket in ~/.evolution/cache/tmp
        evolution_home_filetrans(spamd_t, spamd_tmp_t, { file sock_file })
@@ -328,18 +317,7 @@ seutil_read_config(spamc_t)
 
 sysnet_read_config(spamc_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(spamc_t)
-       fs_manage_nfs_files(spamc_t)
-       fs_manage_nfs_symlinks(spamc_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(spamc_t)
-       fs_manage_cifs_files(spamc_t)
-       fs_manage_cifs_symlinks(spamc_t)
-')
-
+userdom_home_manager(spamc_t)
 
 optional_policy(`
        abrt_stream_connect(spamc_t)
@@ -479,22 +457,13 @@ miscfiles_read_localization(spamd_t)
 
 userdom_use_unpriv_users_fds(spamd_t)
 userdom_search_user_home_dirs(spamd_t)
+userdom_home_manager(spamd_t)
 
 optional_policy(`
        exim_manage_spool_dirs(spamd_t)
        exim_manage_spool_files(spamd_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(spamd_t)
-       fs_manage_nfs_files(spamd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(spamd_t)
-       fs_manage_cifs_files(spamd_t)
-')
-
 optional_policy(`
        amavis_manage_lib_files(spamd_t)
 ')

diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 5439f7ed8886f8d4c4fb3d2009381e5714cd18f7..126255fa8444a818c8306f373b56854fc075c718 100644 (file)
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -277,19 +277,7 @@ template(`ssh_server_template',`
        # Allow checking users mail at login
        mta_getattr_spool($1_t)
 
-       tunable_policy(`use_fusefs_home_dirs',`
-               fs_manage_fusefs_dirs($1_t)
-               fs_manage_fusefs_files($1_t)
-       ')
-
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_read_nfs_files($1_t)
-               fs_read_nfs_symlinks($1_t)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_read_cifs_files($1_t)
-       ')
+       userdom_home_manager($1_t)
 
        optional_policy(`
                kerberos_use($1_t)
@@ -443,19 +431,7 @@ template(`ssh_role_template',`
 
        ssh_exec_keygen($3)
 
-       tunable_policy(`use_nfs_home_dirs',`
-               fs_manage_nfs_files($1_ssh_agent_t)
-
-               # transition back to normal privs upon exec
-               fs_nfs_domtrans($1_ssh_agent_t, $3)
-       ')
-
-       tunable_policy(`use_samba_home_dirs',`
-               fs_manage_cifs_files($1_ssh_agent_t)
-
-               # transition back to normal privs upon exec
-               fs_cifs_domtrans($1_ssh_agent_t, $3)
-       ')
+       userdom_home_manager($1_ssh_agent_t)
 
        optional_policy(`
                nis_use_ypbind($1_ssh_agent_t)

diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 02e70c9fd62397caefeb2add197a3df3da9455fd..e93db051385feb1566d2770035e9980ab8cd690a 100644 (file)
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
 userdom_write_user_tmp_files(ssh_t)
 userdom_read_user_home_content_symlinks(ssh_t)
 userdom_read_home_certs(ssh_t)
+userdom_home_manager(ssh_t)
 
 tunable_policy(`allow_ssh_keysign',`
        domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
@@ -210,16 +211,6 @@ tunable_policy(`use_fusefs_home_dirs',`
        fs_manage_fusefs_files(ssh_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(ssh_t)
-       fs_manage_nfs_files(ssh_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(ssh_t)
-       fs_manage_cifs_files(ssh_t)
-')
-
 # for port forwarding
 tunable_policy(`user_tcp_server',`
        corenet_tcp_bind_ssh_port(ssh_t)
@@ -498,14 +489,7 @@ tunable_policy(`use_samba_home_dirs',`
     fs_read_cifs_symlinks(chroot_user_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-    fs_read_nfs_files(chroot_user_t)
-    fs_read_nfs_symlinks(chroot_user_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
-    fs_read_fusefs_files(chroot_user_t)
-')
+userdom_home_manager(chroot_user_t)
 
 optional_policy(`
     ssh_rw_dgram_sockets(chroot_user_t)

diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
index 5c32a9941fe94965697d88826a1cf30109f3ba5e..eb8979dbd6c7b9352892a8fb6d3000453818b024 100644 (file)
--- a/policy/modules/services/sssd.te
+++ b/policy/modules/services/sssd.te
@@ -117,17 +117,7 @@ optional_policy(`
        ldap_stream_connect(sssd_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(sssd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(sssd_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
-       fs_read_fusefs_files(sssd_t)
-')
+userdom_home_reader(sssd_t)
 
 
 

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 918721c4db64802cc536965d20e00852f52fe561..ab908aad9c18582e9d75993d938af49281c1b32e 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -286,18 +286,7 @@ fs_search_auto_mountpoints(iceauth_t)
 userdom_use_inherited_user_terminals(iceauth_t)
 userdom_read_user_tmp_files(iceauth_t)
 userdom_read_all_users_state(iceauth_t)
-
-tunable_policy(`use_fusefs_home_dirs',`
-       fs_manage_fusefs_files(iceauth_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_files(iceauth_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_files(iceauth_t)
-')
+userdom_home_manager(iceauth_t)
 
 ifdef(`hide_broken_symptoms',`
        dev_dontaudit_read_urand(iceauth_t)
@@ -388,14 +377,7 @@ tunable_policy(`use_fusefs_home_dirs',`
        fs_manage_fusefs_files(xauth_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_files(xauth_t)
-       fs_read_nfs_symlinks(xauth_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_files(xauth_t)
-')
+userdom_home_manager(xauth_t)
 
 ifdef(`hide_broken_symptoms',`
        term_dontaudit_use_unallocated_ttys(xauth_t)
@@ -679,6 +661,7 @@ userdom_manage_user_tmp_dirs(xdm_t)
 userdom_manage_user_tmp_files(xdm_t)
 userdom_manage_user_tmp_sockets(xdm_t)
 userdom_manage_tmpfs_role(system_r, xdm_t)
+userdom_home_manager(xdm_t)
 
 application_signal(xdm_t)
 
@@ -700,16 +683,10 @@ tunable_policy(`use_fusefs_home_dirs',`
 ')
 
 tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(xdm_t)
-       fs_manage_nfs_files(xdm_t)
-       fs_manage_nfs_symlinks(xdm_t)
        fs_exec_nfs_files(xdm_t)
 ')
 
 tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(xdm_t)
-       fs_manage_cifs_files(xdm_t)
-       fs_manage_cifs_symlinks(xdm_t)
        fs_exec_cifs_files(xdm_t)
 ')
 
@@ -1228,26 +1205,10 @@ init_use_fds(xserver_t)
 # (xauth?)
 userdom_read_user_home_content_files(xserver_t)
 userdom_read_all_users_state(xserver_t)
+userdom_home_manager(xserver_t)
 
 xserver_use_user_fonts(xserver_t)
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_manage_nfs_dirs(xserver_t)
-       fs_manage_nfs_files(xserver_t)
-       fs_manage_nfs_symlinks(xserver_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
-       fs_manage_fusefs_dirs(xserver_t)
-       fs_manage_fusefs_files(xserver_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_manage_cifs_dirs(xserver_t)
-       fs_manage_cifs_files(xserver_t)
-       fs_manage_cifs_symlinks(xserver_t)
-')
-
 optional_policy(`
        dbus_system_bus_client(xserver_t)
 

diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 37a5bb44588ca5d3234b8dbb589689ec1538705d..2291a13255f5898e6ada78eda33acc8b3004e0e9 100644 (file)
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -154,15 +154,7 @@ tunable_policy(`console_login',`
        term_relabel_console(local_login_t)
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(local_login_t)
-       fs_read_nfs_symlinks(local_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(local_login_t)
-       fs_read_cifs_symlinks(local_login_t)
-')
+userdom_home_reader(local_login_t)
 
 tunable_policy(`allow_console_login',`
      term_use_console(local_login_t)

diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 2273e1a0ca20f6e2b0a214b49a12f5b51b0a9ceb..6b397569429e2732870adc83e55ede0cbde2e3cd 100644 (file)
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -78,6 +78,7 @@ userdom_use_inherited_user_terminals(depmod_t)
 files_list_home(depmod_t)
 userdom_read_user_home_content_files(depmod_t)
 userdom_manage_user_tmp_files(depmod_t)
+userdom_home_reader(depmod_t)
 
 ifdef(`distro_ubuntu',`
        optional_policy(`
@@ -85,14 +86,6 @@ ifdef(`distro_ubuntu',`
        ')
 ')
 
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(depmod_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(depmod_t)
-')
-
 optional_policy(`
        bootloader_rw_tmp_files(insmod_t)
 ')

diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 3ee9ea82772bc2af2369a825a8beffd09b49238a..ac8b21413ee9f8c5d2a556ad123784a19345597a 100644 (file)
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -492,14 +492,7 @@ seutil_manage_default_contexts(semanage_t)
 # Handle pp files created in homedir and /tmp
 userdom_read_user_home_content_files(semanage_t)
 userdom_read_user_tmp_files(semanage_t)
-
-tunable_policy(`use_nfs_home_dirs',`
-       fs_read_nfs_files(semanage_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
-       fs_read_cifs_files(semanage_t)
-')
+userdom_home_reader(semanage_t)
 
 ifdef(`distro_debian',`
        files_read_var_lib_files(semanage_t)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 3fc47c58795cb8e1ab137c5dd0896bed97695f74..0bb4d1e6195e30724cce4067e689afe6c9010385 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -5057,3 +5057,41 @@ interface(`userdom_filetrans_home_content',`
        #       gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
        #')
 ')
+
+########################################
+## <summary>
+##     Make the specified type able to read content in user home dirs
+## </summary>
+## <param name="type">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_home_reader',`
+       gen_require(`
+               attribute userdom_home_reader_type;
+       ')
+
+       typeattribute $1 userdom_home_reader_type;
+')
+
+
+########################################
+## <summary>
+##     Make the specified type able to manage content in user home dirs
+## </summary>
+## <param name="type">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_home_manager',`
+       gen_require(`
+               attribute userdom_home_manager_type;
+       ')
+
+       typeattribute $1 userdom_home_manager_type;
+')
+

diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index d6c38607d2ac9e36a163fd36822bb75f0cfac955..ced52ff5aeb82a3e3210d514cdb1a2733cbd71b9 100644 (file)
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -73,6 +73,9 @@ attribute unpriv_userdomain;
 attribute untrusted_content_type;
 attribute untrusted_content_tmp_type;
 
+attribute userdom_home_reader_type;
+attribute userdom_home_manager_type;
+
 # unprivileged user domains
 attribute user_home_type;
 attribute user_tmp_type;
@@ -172,3 +175,36 @@ optional_policy(`
 optional_policy(`
        xserver_filetrans_home_content(userdomain)
 ')
+
+
+tunable_policy(`use_nfs_home_dirs',`
+    fs_read_nfs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+    fs_read_cifs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+    fs_read_fusefs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+    fs_list_auto_mountpoints(userdom_home_manager_type)
+    fs_manage_nfs_dirs(userdom_home_manager_type)
+    fs_manage_nfs_files(userdom_home_manager_type)
+    fs_manage_nfs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+    fs_manage_cifs_dirs(userdom_home_manager_type)
+    fs_manage_cifs_files(userdom_home_manager_type)
+    fs_manage_cifs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+    fs_manage_fusefs_dirs(userdom_home_manager_type)
+    fs_manage_fusefs_files(userdom_home_manager_type)
+    fs_manage_fusefs_symlinks(userdom_home_manager_type)
+')
+