|
 |
2a89dff |
diff --git a/policy/modules/admin/usermanage.if b/policy/modules/admin/usermanage.if
|
|
|
2a89dff |
index 66cf96c..a6d907b 100644
|
|
|
2a89dff |
--- a/policy/modules/admin/usermanage.if
|
|
|
2a89dff |
+++ b/policy/modules/admin/usermanage.if
|
|
|
2a89dff |
@@ -308,7 +308,7 @@ interface(`usermanage_run_useradd',`
|
|
|
2a89dff |
role $2 types useradd_t;
|
|
|
2a89dff |
|
|
|
2a89dff |
# Add/remove user home directories
|
|
|
2a89dff |
- userdom_manage_home_role($2, useradd_t)
|
|
|
2a89dff |
+ userdom_manage_home_role($2)
|
|
|
2a89dff |
|
|
|
2a89dff |
seutil_run_semanage(useradd_t, $2)
|
|
|
2a89dff |
|
|
|
2a89dff |
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
|
|
|
2a89dff |
index 4779a8d..7d7efd7 100644
|
|
|
2a89dff |
--- a/policy/modules/admin/usermanage.te
|
|
|
2a89dff |
+++ b/policy/modules/admin/usermanage.te
|
|
|
2a89dff |
@@ -509,7 +509,7 @@ seutil_domtrans_setfiles(useradd_t)
|
|
|
2a89dff |
userdom_use_unpriv_users_fds(useradd_t)
|
|
|
2a89dff |
# Add/remove user home directories
|
|
|
2a89dff |
userdom_home_filetrans_user_home_dir(useradd_t)
|
|
|
2a89dff |
-userdom_manage_home_role(system_r, useradd_t)
|
|
|
2a89dff |
+userdom_manage_home(useradd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
mta_manage_spool(useradd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if
|
|
|
2a89dff |
index e23f640..182d6d1 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/execmem.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/execmem.if
|
|
|
2a89dff |
@@ -57,8 +57,6 @@ template(`execmem_role_template',`
|
|
|
2a89dff |
role $2 types $1_execmem_t;
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_unpriv_usertype($1, $1_execmem_t)
|
|
|
2a89dff |
- userdom_manage_tmp_role($2, $1_execmem_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_execmem_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
allow $1_execmem_t self:process { execmem execstack };
|
|
|
2a89dff |
allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };
|
|
|
2a89dff |
diff --git a/policy/modules/apps/java.if b/policy/modules/apps/java.if
|
|
|
2a89dff |
index 7c398c0..c64cced 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/java.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/java.if
|
|
|
2a89dff |
@@ -73,7 +73,8 @@ template(`java_role_template',`
|
|
|
2a89dff |
domain_interactive_fd($1_java_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_unpriv_usertype($1, $1_java_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_java_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($2)
|
|
|
2a89dff |
+ userdom_manage_tmpfs($1_java_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
allow $1_java_t self:process { ptrace signal getsched execmem execstack };
|
|
|
2a89dff |
|
|
|
2a89dff |
diff --git a/policy/modules/apps/mono.if b/policy/modules/apps/mono.if
|
|
|
2a89dff |
index 1fa8573..8179185 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/mono.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/mono.if
|
|
|
2a89dff |
@@ -49,7 +49,8 @@ template(`mono_role_template',`
|
|
|
2a89dff |
corecmd_bin_domtrans($1_mono_t, $1_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_unpriv_usertype($1, $1_mono_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_mono_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($2)
|
|
|
2a89dff |
+ userdom_manage_tmpfs($1_mono_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
xserver_role($1_r, $1_mono_t)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
|
|
|
2a89dff |
index 83fc139..596232f 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/mozilla.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/mozilla.if
|
|
|
2a89dff |
@@ -51,7 +51,7 @@ interface(`mozilla_role',`
|
|
|
2a89dff |
mozilla_run_plugin(mozilla_t, $1)
|
|
|
2a89dff |
mozilla_dbus_chat($2)
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_manage_tmp_role($1, mozilla_t)
|
|
|
2a89dff |
+ userdom_manage_tmp_role($1)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
nsplugin_role($1, mozilla_t)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/nsplugin.if b/policy/modules/apps/nsplugin.if
|
|
|
2a89dff |
index 1925bd9..0a794bc 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/nsplugin.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/nsplugin.if
|
|
|
2a89dff |
@@ -103,7 +103,7 @@ ifdef(`hide_broken_symptoms', `
|
|
|
2a89dff |
userdom_use_inherited_user_terminals(nsplugin_t)
|
|
|
2a89dff |
userdom_use_inherited_user_terminals(nsplugin_config_t)
|
|
|
2a89dff |
userdom_dontaudit_setattr_user_home_content_files(nsplugin_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($1, nsplugin_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($1)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
pulseaudio_role($1, nsplugin_t)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
|
|
|
2a89dff |
index 9bf1dd8..564d1ea 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/nsplugin.te
|
|
|
2a89dff |
+++ b/policy/modules/apps/nsplugin.te
|
|
|
2a89dff |
@@ -284,6 +284,7 @@ userdom_search_user_home_content(nsplugin_config_t)
|
|
|
2a89dff |
userdom_read_user_home_content_symlinks(nsplugin_config_t)
|
|
|
2a89dff |
userdom_read_user_home_content_files(nsplugin_config_t)
|
|
|
2a89dff |
userdom_dontaudit_search_admin_dir(nsplugin_config_t)
|
|
|
2a89dff |
+userdom_manage_tmpfs(nsplugin_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
tunable_policy(`use_nfs_home_dirs',`
|
|
|
2a89dff |
fs_getattr_nfs(nsplugin_t)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if
|
|
|
2a89dff |
index 9a5e99c..1e6cf7d 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/pulseaudio.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/pulseaudio.if
|
|
|
2a89dff |
@@ -35,9 +35,9 @@ interface(`pulseaudio_role',`
|
|
|
2a89dff |
allow pulseaudio_t $2:unix_stream_socket connectto;
|
|
|
2a89dff |
allow $2 pulseaudio_t:unix_stream_socket connectto;
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_manage_home_role($1, pulseaudio_t)
|
|
|
2a89dff |
- userdom_manage_tmp_role($1, pulseaudio_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($1, pulseaudio_t)
|
|
|
2a89dff |
+ userdom_manage_home_role($1)
|
|
|
2a89dff |
+ userdom_manage_tmp_role($1)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($1)
|
|
|
2a89dff |
|
|
|
2a89dff |
allow $2 pulseaudio_t:dbus send_msg;
|
|
|
2a89dff |
allow pulseaudio_t $2:dbus { acquire_svc send_msg };
|
|
|
2a89dff |
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
|
|
|
2a89dff |
index 8522ab4..6941c29 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/pulseaudio.te
|
|
|
2a89dff |
+++ b/policy/modules/apps/pulseaudio.te
|
|
|
2a89dff |
@@ -95,6 +95,10 @@ logging_send_syslog_msg(pulseaudio_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
miscfiles_read_localization(pulseaudio_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
+userdom_manage_home(pulseaudio_t)
|
|
|
2a89dff |
+userdom_manage_tmp(pulseaudio_t)
|
|
|
2a89dff |
+userdom_manage_tmpfs(pulseaudio_t)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
alsa_read_rw_config(pulseaudio_t)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
diff --git a/policy/modules/apps/userhelper.if b/policy/modules/apps/userhelper.if
|
|
|
2a89dff |
index 8895098..19438a5 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/userhelper.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/userhelper.if
|
|
|
2a89dff |
@@ -294,7 +294,7 @@ template(`userhelper_console_role_template',`
|
|
|
2a89dff |
|
|
|
2a89dff |
auth_use_pam($1_consolehelper_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_consolehelper_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($2)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
dbus_connect_session_bus($1_consolehelper_t)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/userhelper.te b/policy/modules/apps/userhelper.te
|
|
|
2a89dff |
index 8ce8577..f967898 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/userhelper.te
|
|
|
2a89dff |
+++ b/policy/modules/apps/userhelper.te
|
|
|
2a89dff |
@@ -65,6 +65,7 @@ userhelper_exec(consolehelper_domain)
|
|
|
2a89dff |
userdom_use_user_ptys(consolehelper_domain)
|
|
|
2a89dff |
userdom_use_user_ttys(consolehelper_domain)
|
|
|
2a89dff |
userdom_read_user_home_content_files(consolehelper_domain)
|
|
|
2a89dff |
+userdom_manage_tmpfs(consolehelper_domain)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
gnome_read_gconf_home_files(consolehelper_domain)
|
|
|
2a89dff |
diff --git a/policy/modules/apps/wine.if b/policy/modules/apps/wine.if
|
|
|
2a89dff |
index e10101a..cf453e6 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/wine.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/wine.if
|
|
|
2a89dff |
@@ -105,7 +105,8 @@ template(`wine_role_template',`
|
|
|
2a89dff |
corecmd_bin_domtrans($1_wine_t, $1_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_unpriv_usertype($1, $1_wine_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_wine_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($2)
|
|
|
2a89dff |
+ userdom_manage_tmpfs($1_wine_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
domain_mmap_low($1_wine_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
diff --git a/policy/modules/apps/wm.if b/policy/modules/apps/wm.if
|
|
|
2a89dff |
index 50c1a74..d618395 100644
|
|
|
2a89dff |
--- a/policy/modules/apps/wm.if
|
|
|
2a89dff |
+++ b/policy/modules/apps/wm.if
|
|
|
2a89dff |
@@ -77,9 +77,13 @@ template(`wm_role_template',`
|
|
|
2a89dff |
miscfiles_read_fonts($1_wm_t)
|
|
|
2a89dff |
miscfiles_read_localization($1_wm_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_manage_home_role($2, $1_wm_t)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($2, $1_wm_t)
|
|
|
2a89dff |
- userdom_manage_tmp_role($2, $1_wm_t)
|
|
|
2a89dff |
+ userdom_manage_home_role($2)
|
|
|
2a89dff |
+ userdom_manage_home($1_wm_t)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($2)
|
|
|
2a89dff |
+ userdom_manage_tmpfs($1_wm_t)
|
|
|
2a89dff |
+ userdom_manage_tmp_role($2)
|
|
|
2a89dff |
+ userdom_manage_tmp($1_wm_t)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
userdom_exec_user_tmp_files($1_wm_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
|
|
|
2a89dff |
index e1113e0..5bcd298 100644
|
|
|
2a89dff |
--- a/policy/modules/roles/unconfineduser.te
|
|
|
2a89dff |
+++ b/policy/modules/roles/unconfineduser.te
|
|
|
2a89dff |
@@ -45,9 +45,12 @@ gen_tunable(unconfined_login, true)
|
|
|
2a89dff |
# calls is not correct, however we dont currently
|
|
|
2a89dff |
# have another method to add access to these types
|
|
|
2a89dff |
userdom_base_user_template(unconfined)
|
|
|
2a89dff |
-userdom_manage_home_role(unconfined_r, unconfined_t)
|
|
|
2a89dff |
-userdom_manage_tmp_role(unconfined_r, unconfined_t)
|
|
|
2a89dff |
-userdom_manage_tmpfs_role(unconfined_r, unconfined_t)
|
|
|
2a89dff |
+userdom_manage_home_role(unconfined_r)
|
|
|
2a89dff |
+userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
+userdom_manage_tmp_role(unconfined_r)
|
|
|
2a89dff |
+userdom_manage_tmp(unconfined_t)
|
|
|
2a89dff |
+userdom_manage_tmpfs_role(unconfined_r)
|
|
|
2a89dff |
+userdom_manage_tmpfs(unconfined_t)
|
|
|
2a89dff |
userdom_unpriv_usertype(unconfined, unconfined_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
type unconfined_exec_t;
|
|
|
2a89dff |
diff --git a/policy/modules/services/rshd.te b/policy/modules/services/rshd.te
|
|
|
2a89dff |
index 49a4283..7a3ea96 100644
|
|
|
2a89dff |
--- a/policy/modules/services/rshd.te
|
|
|
2a89dff |
+++ b/policy/modules/services/rshd.te
|
|
|
2a89dff |
@@ -66,7 +66,7 @@ seutil_read_config(rshd_t)
|
|
|
2a89dff |
seutil_read_default_contexts(rshd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_search_user_home_content(rshd_t)
|
|
|
2a89dff |
-userdom_manage_tmp_role(system_r, rshd_t)
|
|
|
2a89dff |
+userdom_manage_tmp(rshd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
tunable_policy(`use_nfs_home_dirs',`
|
|
|
2a89dff |
fs_read_nfs_files(rshd_t)
|
|
|
2a89dff |
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
|
|
|
2a89dff |
index 8e3e9de..862e108 100644
|
|
|
2a89dff |
--- a/policy/modules/services/ssh.if
|
|
|
2a89dff |
+++ b/policy/modules/services/ssh.if
|
|
|
2a89dff |
@@ -380,7 +380,7 @@ template(`ssh_role_template',`
|
|
|
2a89dff |
manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
|
2a89dff |
manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)
|
|
|
2a89dff |
userdom_search_user_home_dirs($1_t)
|
|
|
2a89dff |
- userdom_manage_tmp_role($2, ssh_t)
|
|
|
2a89dff |
+ userdom_manage_tmp(ssh_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
##############################
|
|
|
2a89dff |
#
|
|
|
2a89dff |
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
|
|
|
2a89dff |
index d81a09f..3fdc1df 100644
|
|
|
2a89dff |
--- a/policy/modules/services/ssh.te
|
|
|
2a89dff |
+++ b/policy/modules/services/ssh.te
|
|
|
2a89dff |
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
|
|
|
2a89dff |
userdom_write_user_tmp_files(ssh_t)
|
|
|
2a89dff |
userdom_read_user_home_content_symlinks(ssh_t)
|
|
|
2a89dff |
userdom_read_home_certs(ssh_t)
|
|
|
2a89dff |
+userdom_manage_tmp(ssh_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
tunable_policy(`allow_ssh_keysign',`
|
|
|
2a89dff |
domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
|
|
|
2a89dff |
@@ -280,7 +281,7 @@ corenet_sendrecv_xserver_server_packets(sshd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_read_user_home_content_files(sshd_t)
|
|
|
2a89dff |
userdom_read_user_home_content_symlinks(sshd_t)
|
|
|
2a89dff |
-userdom_manage_tmp_role(system_r, sshd_t)
|
|
|
2a89dff |
+userdom_manage_tmp(sshd_t)
|
|
|
2a89dff |
userdom_spec_domtrans_unpriv_users(sshd_t)
|
|
|
2a89dff |
userdom_signal_unpriv_users(sshd_t)
|
|
|
2a89dff |
userdom_dyntransition_unpriv_users(sshd_t)
|
|
|
2a89dff |
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
|
|
|
2a89dff |
index 7d5a298..36b8a4c 100644
|
|
|
2a89dff |
--- a/policy/modules/services/sssd.te
|
|
|
2a89dff |
+++ b/policy/modules/services/sssd.te
|
|
|
2a89dff |
@@ -92,7 +92,7 @@ miscfiles_read_generic_certs(sssd_t)
|
|
|
2a89dff |
sysnet_dns_name_resolve(sssd_t)
|
|
|
2a89dff |
sysnet_use_ldap(sssd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
-userdom_manage_tmp_role(system_r, sssd_t)
|
|
|
2a89dff |
+userdom_manage_tmp(sssd_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
dbus_system_bus_client(sssd_t)
|
|
|
2a89dff |
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
|
|
|
2a89dff |
index 60e0e2d..fcf2f38 100644
|
|
|
2a89dff |
--- a/policy/modules/services/xserver.te
|
|
|
2a89dff |
+++ b/policy/modules/services/xserver.te
|
|
|
2a89dff |
@@ -671,7 +671,7 @@ userdom_stream_connect(xdm_t)
|
|
|
2a89dff |
userdom_manage_user_tmp_dirs(xdm_t)
|
|
|
2a89dff |
userdom_manage_user_tmp_files(xdm_t)
|
|
|
2a89dff |
userdom_manage_user_tmp_sockets(xdm_t)
|
|
|
2a89dff |
-userdom_manage_tmpfs_role(system_r, xdm_t)
|
|
|
2a89dff |
+userdom_manage_tmpfs(xdm_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
application_signal(xdm_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
|
|
|
2a89dff |
index e7a65ae..6974244 100644
|
|
|
2a89dff |
--- a/policy/modules/system/userdomain.if
|
|
|
2a89dff |
+++ b/policy/modules/system/userdomain.if
|
|
|
2a89dff |
@@ -35,21 +35,14 @@ template(`userdom_base_user_template',`
|
|
|
2a89dff |
type $1_t, userdomain, $1_usertype;
|
|
|
2a89dff |
domain_type($1_t)
|
|
|
2a89dff |
role $1_r;
|
|
|
2a89dff |
- corecmd_shell_entry_type($1_t)
|
|
|
2a89dff |
- corecmd_bin_entry_type($1_t)
|
|
|
2a89dff |
domain_user_exemption_target($1_t)
|
|
|
2a89dff |
ubac_constrained($1_t)
|
|
|
2a89dff |
role $1_r types $1_t;
|
|
|
2a89dff |
allow system_r $1_r;
|
|
|
2a89dff |
|
|
|
2a89dff |
- term_user_pty($1_t, user_devpts_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- term_user_tty($1_t, user_tty_device_t)
|
|
|
2a89dff |
- term_dontaudit_getattr_generic_ptys($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };
|
|
|
2a89dff |
allow $1_usertype $1_usertype:fd use;
|
|
|
2a89dff |
- allow $1_usertype $1_t:key { create view read write search link setattr };
|
|
|
2a89dff |
+ allow $1_usertype $1_usertype:key { create view read write search link setattr };
|
|
|
2a89dff |
|
|
|
2a89dff |
allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;
|
|
|
2a89dff |
allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };
|
|
|
2a89dff |
@@ -61,114 +54,7 @@ template(`userdom_base_user_template',`
|
|
|
2a89dff |
allow $1_usertype $1_usertype:context contains;
|
|
|
2a89dff |
dontaudit $1_usertype $1_usertype:socket create;
|
|
|
2a89dff |
|
|
|
2a89dff |
- allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };
|
|
|
2a89dff |
- term_create_pty($1_usertype, user_devpts_t)
|
|
|
2a89dff |
- # avoid annoying messages on terminal hangup on role change
|
|
|
2a89dff |
- dontaudit $1_usertype user_devpts_t:chr_file ioctl;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };
|
|
|
2a89dff |
- # avoid annoying messages on terminal hangup on role change
|
|
|
2a89dff |
- dontaudit $1_usertype user_tty_device_t:chr_file ioctl;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- application_exec_all($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- kernel_read_kernel_sysctls($1_usertype)
|
|
|
2a89dff |
- kernel_read_all_sysctls($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_list_unlabeled($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_files($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)
|
|
|
2a89dff |
- kernel_dontaudit_list_proc($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- dev_dontaudit_getattr_all_blk_files($1_usertype)
|
|
|
2a89dff |
- dev_dontaudit_getattr_all_chr_files($1_usertype)
|
|
|
2a89dff |
- dev_getattr_mtrr_dev($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- # When the user domain runs ps, there will be a number of access
|
|
|
2a89dff |
- # denials when ps tries to search /proc. Do not audit these denials.
|
|
|
2a89dff |
- domain_dontaudit_read_all_domains_state($1_usertype)
|
|
|
2a89dff |
- domain_dontaudit_getattr_all_domains($1_usertype)
|
|
|
2a89dff |
- domain_dontaudit_getsession_all_domains($1_usertype)
|
|
|
2a89dff |
- dev_dontaudit_all_access_check($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- files_read_etc_files($1_usertype)
|
|
|
2a89dff |
- files_list_mnt($1_usertype)
|
|
|
2a89dff |
- files_list_var($1_usertype)
|
|
|
2a89dff |
- files_read_mnt_files($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_access_check_mnt($1_usertype)
|
|
|
2a89dff |
- files_read_etc_runtime_files($1_usertype)
|
|
|
2a89dff |
- files_read_usr_files($1_usertype)
|
|
|
2a89dff |
- files_read_usr_src_files($1_usertype)
|
|
|
2a89dff |
- # Read directories and files with the readable_t type.
|
|
|
2a89dff |
- # This type is a general type for "world"-readable files.
|
|
|
2a89dff |
- files_list_world_readable($1_usertype)
|
|
|
2a89dff |
- files_read_world_readable_files($1_usertype)
|
|
|
2a89dff |
- files_read_world_readable_symlinks($1_usertype)
|
|
|
2a89dff |
- files_read_world_readable_pipes($1_usertype)
|
|
|
2a89dff |
- files_read_world_readable_sockets($1_usertype)
|
|
|
2a89dff |
- # old broswer_domain():
|
|
|
2a89dff |
- files_dontaudit_getattr_all_dirs($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_list_non_security($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_getattr_all_files($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_getattr_non_security_symlinks($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_getattr_non_security_pipes($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_getattr_non_security_sockets($1_usertype)
|
|
|
2a89dff |
- files_dontaudit_setattr_etc_runtime_files($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- files_exec_usr_files($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- fs_list_cgroup_dirs($1_usertype)
|
|
|
2a89dff |
- fs_dontaudit_rw_cgroup_files($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- storage_rw_fuse($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
auth_use_nsswitch($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- init_stream_connect($1_usertype)
|
|
|
2a89dff |
- # The library functions always try to open read-write first,
|
|
|
2a89dff |
- # then fall back to read-only if it fails.
|
|
|
2a89dff |
- init_dontaudit_rw_utmp($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- libs_exec_ld_so($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- logging_send_audit_msgs($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- miscfiles_read_localization($1_t)
|
|
|
2a89dff |
- miscfiles_read_generic_certs($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- miscfiles_read_all_certs($1_usertype)
|
|
|
2a89dff |
- miscfiles_read_localization($1_usertype)
|
|
|
2a89dff |
- miscfiles_read_man_pages($1_usertype)
|
|
|
2a89dff |
- miscfiles_read_public_files($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- systemd_dbus_chat_logind($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- tunable_policy(`allow_execmem',`
|
|
|
2a89dff |
- # Allow loading DSOs that require executable stack.
|
|
|
2a89dff |
- allow $1_t self:process execmem;
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- tunable_policy(`allow_execmem && allow_execstack',`
|
|
|
2a89dff |
- # Allow making the stack executable via mprotect.
|
|
|
2a89dff |
- allow $1_t self:process execstack;
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- abrt_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- fs_list_cgroup_dirs($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- ssh_rw_stream_sockets($1_usertype)
|
|
|
2a89dff |
- ssh_delete_tmp($1_t)
|
|
|
2a89dff |
- ssh_signal($1_t)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
#######################################
|
|
|
2a89dff |
@@ -242,6 +128,22 @@ interface(`userdom_ro_home_role',`
|
|
|
2a89dff |
## The user role
|
|
|
2a89dff |
## </summary>
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
+## <rolebase/>
|
|
|
2a89dff |
+#
|
|
|
2a89dff |
+interface(`userdom_manage_home_role',`
|
|
|
2a89dff |
+ gen_require(`
|
|
|
2a89dff |
+ type user_home_dir_t;
|
|
|
2a89dff |
+ attribute user_home_type;
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ role $1 types { user_home_type user_home_dir_t };
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+#######################################
|
|
|
2a89dff |
+## <summary>
|
|
|
2a89dff |
+## Allow a home directory for which the
|
|
|
2a89dff |
+## role has full access.
|
|
|
2a89dff |
+## </summary>
|
|
|
2a89dff |
## <param name="userdomain">
|
|
|
2a89dff |
## <summary>
|
|
|
2a89dff |
## The user domain
|
|
|
2a89dff |
@@ -249,61 +151,58 @@ interface(`userdom_ro_home_role',`
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
## <rolebase/>
|
|
|
2a89dff |
#
|
|
|
2a89dff |
-interface(`userdom_manage_home_role',`
|
|
|
2a89dff |
+interface(`userdom_manage_home',`
|
|
|
2a89dff |
gen_require(`
|
|
|
2a89dff |
type user_home_t, user_home_dir_t;
|
|
|
2a89dff |
attribute user_home_type;
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
- role $1 types { user_home_type user_home_dir_t };
|
|
|
2a89dff |
-
|
|
|
2a89dff |
##############################
|
|
|
2a89dff |
#
|
|
|
2a89dff |
# Domain access to home dir
|
|
|
2a89dff |
#
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- type_member $2 user_home_dir_t:dir user_home_dir_t;
|
|
|
2a89dff |
+ type_member $1 user_home_dir_t:dir user_home_dir_t;
|
|
|
2a89dff |
|
|
|
2a89dff |
# full control of the home directory
|
|
|
2a89dff |
- allow $2 user_home_t:dir mounton;
|
|
|
2a89dff |
- allow $2 user_home_t:file entrypoint;
|
|
|
2a89dff |
+ allow $1 user_home_t:dir mounton;
|
|
|
2a89dff |
+ allow $1 user_home_t:file entrypoint;
|
|
|
2a89dff |
|
|
|
2a89dff |
- allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };
|
|
|
2a89dff |
- allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;
|
|
|
2a89dff |
- manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
- filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
- files_list_home($2)
|
|
|
2a89dff |
+ allow $1 user_home_type:dir_file_class_set { relabelto relabelfrom };
|
|
|
2a89dff |
+ allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;
|
|
|
2a89dff |
+ manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ relabel_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ relabel_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ relabel_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ relabel_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ relabel_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)
|
|
|
2a89dff |
+ filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
+ files_list_home($1)
|
|
|
2a89dff |
|
|
|
2a89dff |
# cjp: this should probably be removed:
|
|
|
2a89dff |
- allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
|
|
|
2a89dff |
+ allow $1 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
|
|
|
2a89dff |
|
|
|
2a89dff |
tunable_policy(`use_nfs_home_dirs',`
|
|
|
2a89dff |
- fs_mount_nfs($2)
|
|
|
2a89dff |
- fs_mounton_nfs($2)
|
|
|
2a89dff |
- fs_manage_nfs_dirs($2)
|
|
|
2a89dff |
- fs_manage_nfs_files($2)
|
|
|
2a89dff |
- fs_manage_nfs_symlinks($2)
|
|
|
2a89dff |
- fs_manage_nfs_named_sockets($2)
|
|
|
2a89dff |
- fs_manage_nfs_named_pipes($2)
|
|
|
2a89dff |
+ fs_mount_nfs($1)
|
|
|
2a89dff |
+ fs_mounton_nfs($1)
|
|
|
2a89dff |
+ fs_manage_nfs_dirs($1)
|
|
|
2a89dff |
+ fs_manage_nfs_files($1)
|
|
|
2a89dff |
+ fs_manage_nfs_symlinks($1)
|
|
|
2a89dff |
+ fs_manage_nfs_named_sockets($1)
|
|
|
2a89dff |
+ fs_manage_nfs_named_pipes($1)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
tunable_policy(`use_samba_home_dirs',`
|
|
|
2a89dff |
- fs_mount_cifs($2)
|
|
|
2a89dff |
- fs_mounton_cifs($2)
|
|
|
2a89dff |
- fs_manage_cifs_dirs($2)
|
|
|
2a89dff |
- fs_manage_cifs_files($2)
|
|
|
2a89dff |
- fs_manage_cifs_symlinks($2)
|
|
|
2a89dff |
- fs_manage_cifs_named_sockets($2)
|
|
|
2a89dff |
- fs_manage_cifs_named_pipes($2)
|
|
|
2a89dff |
+ fs_mount_cifs($1)
|
|
|
2a89dff |
+ fs_mounton_cifs($1)
|
|
|
2a89dff |
+ fs_manage_cifs_dirs($1)
|
|
|
2a89dff |
+ fs_manage_cifs_files($1)
|
|
|
2a89dff |
+ fs_manage_cifs_symlinks($1)
|
|
|
2a89dff |
+ fs_manage_cifs_named_sockets($1)
|
|
|
2a89dff |
+ fs_manage_cifs_named_pipes($1)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
@@ -316,6 +215,21 @@ interface(`userdom_manage_home_role',`
|
|
|
2a89dff |
## Role allowed access.
|
|
|
2a89dff |
## </summary>
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
+## <rolebase/>
|
|
|
2a89dff |
+#
|
|
|
2a89dff |
+interface(`userdom_manage_tmp_role',`
|
|
|
2a89dff |
+ gen_require(`
|
|
|
2a89dff |
+ attribute user_tmp_type;
|
|
|
2a89dff |
+ type user_tmp_t;
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ role $1 types user_tmp_t;
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+#######################################
|
|
|
2a89dff |
+## <summary>
|
|
|
2a89dff |
+## Manage user temporary files
|
|
|
2a89dff |
+## </summary>
|
|
|
2a89dff |
## <param name="domain">
|
|
|
2a89dff |
## <summary>
|
|
|
2a89dff |
## Domain allowed access.
|
|
|
2a89dff |
@@ -323,27 +237,25 @@ interface(`userdom_manage_home_role',`
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
## <rolebase/>
|
|
|
2a89dff |
#
|
|
|
2a89dff |
-interface(`userdom_manage_tmp_role',`
|
|
|
2a89dff |
+interface(`userdom_manage_tmp',`
|
|
|
2a89dff |
gen_require(`
|
|
|
2a89dff |
attribute user_tmp_type;
|
|
|
2a89dff |
type user_tmp_t;
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
- role $1 types user_tmp_t;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- files_poly_member_tmp($2, user_tmp_t)
|
|
|
2a89dff |
+ files_poly_member_tmp($1, user_tmp_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
- manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- manage_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
- relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- relabel_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
- relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ manage_dirs_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ manage_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ files_tmp_filetrans($1, user_tmp_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
+ relabel_dirs_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ relabel_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ relabel_lnk_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ relabel_sock_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
+ relabel_fifo_files_pattern($1, user_tmp_type, user_tmp_type)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
#######################################
|
|
|
2a89dff |
@@ -424,6 +336,21 @@ interface(`userdom_exec_user_tmp_files',`
|
|
|
2a89dff |
## Role allowed access.
|
|
|
2a89dff |
## </summary>
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
+## <rolecap/>
|
|
|
2a89dff |
+#
|
|
|
2a89dff |
+interface(`userdom_manage_tmpfs_role',`
|
|
|
2a89dff |
+ gen_require(`
|
|
|
2a89dff |
+ attribute user_tmpfs_type;
|
|
|
2a89dff |
+ type user_tmpfs_t;
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ role $1 types user_tmpfs_t;
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+#######################################
|
|
|
2a89dff |
+## <summary>
|
|
|
2a89dff |
+## Allow access for the user tmpfs type
|
|
|
2a89dff |
+## </summary>
|
|
|
2a89dff |
## <param name="domain">
|
|
|
2a89dff |
## <summary>
|
|
|
2a89dff |
## Domain allowed access.
|
|
|
2a89dff |
@@ -431,25 +358,23 @@ interface(`userdom_exec_user_tmp_files',`
|
|
|
2a89dff |
## </param>
|
|
|
2a89dff |
## <rolecap/>
|
|
|
2a89dff |
#
|
|
|
2a89dff |
-interface(`userdom_manage_tmpfs_role',`
|
|
|
2a89dff |
+interface(`userdom_manage_tmpfs',`
|
|
|
2a89dff |
gen_require(`
|
|
|
2a89dff |
attribute user_tmpfs_type;
|
|
|
2a89dff |
type user_tmpfs_t;
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
- role $1 types user_tmpfs_t;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
- relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
- relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ fs_tmpfs_filetrans($1, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
|
|
|
2a89dff |
+ relabel_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ relabel_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ relabel_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ relabel_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
+ relabel_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
#######################################
|
|
|
2a89dff |
@@ -578,260 +503,31 @@ template(`userdom_change_password_template',`
|
|
|
2a89dff |
template(`userdom_common_user_template',`
|
|
|
2a89dff |
gen_require(`
|
|
|
2a89dff |
attribute unpriv_userdomain;
|
|
|
2a89dff |
+ attribute common_userdomain;
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_basic_networking($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- ##############################
|
|
|
2a89dff |
- #
|
|
|
2a89dff |
- # User domain Local policy
|
|
|
2a89dff |
- #
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- # evolution and gnome-session try to create a netlink socket
|
|
|
2a89dff |
- dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
|
2a89dff |
- dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
|
|
|
2a89dff |
- allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;
|
|
|
2a89dff |
- allow $1_t self:socket create_socket_perms;
|
|
|
2a89dff |
+ typeattribute $1_t common_userdomain;
|
|
|
2a89dff |
|
|
|
2a89dff |
- allow $1_usertype unpriv_userdomain:fd use;
|
|
|
2a89dff |
+ userdom_basic_networking(common_userdomain)
|
|
|
2a89dff |
|
|
|
2a89dff |
- kernel_read_system_state($1_usertype)
|
|
|
2a89dff |
- kernel_read_network_state($1_usertype)
|
|
|
2a89dff |
- kernel_read_software_raid_state($1_usertype)
|
|
|
2a89dff |
- kernel_read_net_sysctls($1_usertype)
|
|
|
2a89dff |
- # Very permissive allowing every domain to see every type:
|
|
|
2a89dff |
- kernel_get_sysvipc_info($1_usertype)
|
|
|
2a89dff |
- # Find CDROM devices:
|
|
|
2a89dff |
- kernel_read_device_sysctls($1_usertype)
|
|
|
2a89dff |
- kernel_request_load_module($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- corenet_udp_bind_generic_node($1_usertype)
|
|
|
2a89dff |
- corenet_udp_bind_generic_port($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- dev_read_rand($1_usertype)
|
|
|
2a89dff |
- dev_write_sound($1_usertype)
|
|
|
2a89dff |
- dev_read_sound($1_usertype)
|
|
|
2a89dff |
- dev_read_sound_mixer($1_usertype)
|
|
|
2a89dff |
- dev_write_sound_mixer($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- files_exec_etc_files($1_usertype)
|
|
|
2a89dff |
- files_search_locks($1_usertype)
|
|
|
2a89dff |
- # Check to see if cdrom is mounted
|
|
|
2a89dff |
- files_search_mnt($1_usertype)
|
|
|
2a89dff |
- # cjp: perhaps should cut back on file reads:
|
|
|
2a89dff |
- files_read_var_files($1_usertype)
|
|
|
2a89dff |
- files_read_var_symlinks($1_usertype)
|
|
|
2a89dff |
- files_read_generic_spool($1_usertype)
|
|
|
2a89dff |
- files_read_var_lib_files($1_usertype)
|
|
|
2a89dff |
- # Stat lost+found.
|
|
|
2a89dff |
- files_getattr_lost_found_dirs($1_usertype)
|
|
|
2a89dff |
- files_read_config_files($1_usertype)
|
|
|
2a89dff |
- fs_read_noxattr_fs_files($1_usertype)
|
|
|
2a89dff |
- fs_read_noxattr_fs_symlinks($1_usertype)
|
|
|
2a89dff |
- fs_rw_cgroup_files($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- application_getattr_socket($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- logging_send_syslog_msg($1_usertype)
|
|
|
2a89dff |
- logging_send_audit_msgs($1_usertype)
|
|
|
2a89dff |
- selinux_get_enforce_mode($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- # cjp: some of this probably can be removed
|
|
|
2a89dff |
- selinux_get_fs_mount($1_usertype)
|
|
|
2a89dff |
- selinux_validate_context($1_usertype)
|
|
|
2a89dff |
- selinux_compute_access_vector($1_usertype)
|
|
|
2a89dff |
- selinux_compute_create_context($1_usertype)
|
|
|
2a89dff |
- selinux_compute_relabel_context($1_usertype)
|
|
|
2a89dff |
- selinux_compute_user_contexts($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- # for eject
|
|
|
2a89dff |
- storage_getattr_fixed_disk_dev($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- auth_read_login_records($1_usertype)
|
|
|
2a89dff |
- auth_run_pam($1_t,$1_r)
|
|
|
2a89dff |
- auth_run_utempter($1_t,$1_r)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- init_read_utmp($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- seutil_read_file_contexts($1_usertype)
|
|
|
2a89dff |
- seutil_read_default_contexts($1_usertype)
|
|
|
2a89dff |
- seutil_run_newrole($1_t,$1_r)
|
|
|
2a89dff |
- seutil_exec_checkpolicy($1_t)
|
|
|
2a89dff |
- seutil_exec_setfiles($1_usertype)
|
|
|
2a89dff |
- # for when the network connection is killed
|
|
|
2a89dff |
- # this is needed when a login role can change
|
|
|
2a89dff |
- # to this one.
|
|
|
2a89dff |
- seutil_dontaudit_signal_newrole($1_t)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- tunable_policy(`user_direct_mouse',`
|
|
|
2a89dff |
- dev_read_mouse($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- tunable_policy(`user_ttyfile_stat',`
|
|
|
2a89dff |
- term_getattr_all_ttys($1_t)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- # Allow graphical boot to check battery lifespan
|
|
|
2a89dff |
- apm_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
+ auth_run_pam(common_userdomain,$1_r)
|
|
|
2a89dff |
+ auth_run_utempter(common_userdomain,$1_r)
|
|
|
2a89dff |
+ seutil_run_newrole(common_userdomain,$1_r)
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
- canna_stream_connect($1_usertype)
|
|
|
2a89dff |
+ chrome_role($1_r, common_userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
- chrome_role($1_r, $1_usertype)
|
|
|
2a89dff |
+ git_session_role($1_r, common_userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
- colord_read_lib_files($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- dbus_system_bus_client($1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- allow $1_usertype $1_usertype:dbus send_msg;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- avahi_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- policykit_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- bluetooth_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- consolekit_dbus_chat($1_usertype)
|
|
|
2a89dff |
- consolekit_read_log($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- devicekit_dbus_chat($1_usertype)
|
|
|
2a89dff |
- devicekit_dbus_chat_power($1_usertype)
|
|
|
2a89dff |
- devicekit_dbus_chat_disk($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- evolution_dbus_chat($1_usertype)
|
|
|
2a89dff |
- evolution_alarm_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- gnome_dbus_chat_gconfdefault($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- hal_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- kde_dbus_chat_backlighthelper($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- modemmanager_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- networkmanager_dbus_chat($1_usertype)
|
|
|
2a89dff |
- networkmanager_read_lib_files($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- vpn_dbus_chat($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
+ nsplugin_role($1_r, common_userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
- git_session_role($1_r, $1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- inetd_use_fds($1_usertype)
|
|
|
2a89dff |
- inetd_rw_tcp_sockets($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- inn_read_config($1_usertype)
|
|
|
2a89dff |
- inn_read_news_lib($1_usertype)
|
|
|
2a89dff |
- inn_read_news_spool($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- lircd_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- locate_read_lib_files($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- # for running depmod as part of the kernel packaging process
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- modutils_read_module_config($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- mta_rw_spool($1_usertype)
|
|
|
2a89dff |
- mta_manage_queue($1_usertype)
|
|
|
2a89dff |
- mta_filetrans_home_content($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- nsplugin_role($1_r, $1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- tunable_policy(`allow_user_mysql_connect',`
|
|
|
2a89dff |
- mysql_stream_connect($1_t)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- oident_manage_user_content($1_t)
|
|
|
2a89dff |
- oident_relabel_user_content($1_t)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- # to allow monitoring of pcmcia status
|
|
|
2a89dff |
- pcmcia_read_pid($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- pcscd_read_pub_files($1_usertype)
|
|
|
2a89dff |
- pcscd_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- tunable_policy(`allow_user_postgresql_connect',`
|
|
|
2a89dff |
- postgresql_stream_connect($1_usertype)
|
|
|
2a89dff |
- postgresql_tcp_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- resmgr_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- rpc_dontaudit_getattr_exports($1_usertype)
|
|
|
2a89dff |
- rpc_manage_nfs_rw_content($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- rpcbind_stream_connect($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- samba_stream_connect_winbind($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- sandbox_transition($1_usertype, $1_r)
|
|
|
2a89dff |
+ sandbox_transition(common_userdomain, $1_r)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
@@ -839,11 +535,7 @@ template(`userdom_common_user_template',`
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
- slrnpull_search_spool($1_usertype)
|
|
|
2a89dff |
- ')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- optional_policy(`
|
|
|
2a89dff |
- thumb_role($1_r, $1_usertype)
|
|
|
2a89dff |
+ thumb_role($1_r, common_userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
@@ -872,10 +564,9 @@ template(`userdom_login_user_template', `
|
|
|
2a89dff |
|
|
|
2a89dff |
userdom_base_user_template($1)
|
|
|
2a89dff |
|
|
|
2a89dff |
- userdom_manage_home_role($1_r, $1_usertype)
|
|
|
2a89dff |
-
|
|
|
2a89dff |
- userdom_manage_tmp_role($1_r, $1_usertype)
|
|
|
2a89dff |
- userdom_manage_tmpfs_role($1_r, $1_usertype)
|
|
|
2a89dff |
+ userdom_manage_home_role($1_r)
|
|
|
2a89dff |
+ userdom_manage_tmp_role($1_r)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($1_r)
|
|
|
2a89dff |
|
|
|
2a89dff |
ifelse(`$1',`unconfined',`',`
|
|
|
2a89dff |
gen_tunable(allow_$1_exec_content, true)
|
|
|
2a89dff |
@@ -1010,9 +701,6 @@ template(`userdom_restricted_user_template',`
|
|
|
2a89dff |
typeattribute $1_t unpriv_userdomain;
|
|
|
2a89dff |
domain_interactive_fd($1_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
- allow $1_usertype self:netlink_kobject_uevent_socket create_socket_perms;
|
|
|
2a89dff |
- dontaudit $1_usertype self:netlink_audit_socket create_socket_perms;
|
|
|
2a89dff |
-
|
|
|
2a89dff |
##############################
|
|
|
2a89dff |
#
|
|
|
2a89dff |
# Local policy
|
|
|
2a89dff |
@@ -3918,6 +3606,10 @@ template(`userdom_unpriv_usertype',`
|
|
|
2a89dff |
|
|
|
2a89dff |
auth_use_nsswitch($2)
|
|
|
2a89dff |
ubac_constrained($2)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ userdom_manage_home_role($1_r)
|
|
|
2a89dff |
+ userdom_manage_tmp_role($1_r)
|
|
|
2a89dff |
+ userdom_manage_tmpfs_role($1_r)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
########################################
|
|
|
2a89dff |
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
|
|
|
2a89dff |
index 04d748b..c636356 100644
|
|
|
2a89dff |
--- a/policy/modules/system/userdomain.te
|
|
|
2a89dff |
+++ b/policy/modules/system/userdomain.te
|
|
|
2a89dff |
@@ -69,6 +69,8 @@ attribute userdomain;
|
|
|
2a89dff |
|
|
|
2a89dff |
# unprivileged user domains
|
|
|
2a89dff |
attribute unpriv_userdomain;
|
|
|
2a89dff |
+# common user domains
|
|
|
2a89dff |
+attribute common_userdomain;
|
|
|
2a89dff |
|
|
|
2a89dff |
attribute untrusted_content_type;
|
|
|
2a89dff |
attribute untrusted_content_tmp_type;
|
|
|
2a89dff |
@@ -141,16 +143,17 @@ miscfiles_cert_type(home_cert_t)
|
|
|
2a89dff |
userdom_user_home_content(home_cert_t)
|
|
|
2a89dff |
ubac_constrained(home_cert_t)
|
|
|
2a89dff |
|
|
|
2a89dff |
-tunable_policy(`allow_console_login',`
|
|
|
2a89dff |
- term_use_console(userdomain)
|
|
|
2a89dff |
-')
|
|
|
2a89dff |
-
|
|
|
2a89dff |
-allow userdomain userdomain:process signull;
|
|
|
2a89dff |
+allow unpriv_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
|
|
|
2a89dff |
+dontaudit unpriv_userdomain self:netlink_audit_socket create_socket_perms;
|
|
|
2a89dff |
|
|
|
2a89dff |
# Nautilus causes this avc
|
|
|
2a89dff |
dontaudit unpriv_userdomain self:dir setattr;
|
|
|
2a89dff |
allow unpriv_userdomain self:key manage_key_perms;
|
|
|
2a89dff |
|
|
|
2a89dff |
+userdom_manage_home(unpriv_userdomain)
|
|
|
2a89dff |
+userdom_manage_tmp(unpriv_userdomain)
|
|
|
2a89dff |
+userdom_manage_tmpfs(unpriv_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
alsa_read_rw_config(unpriv_userdomain)
|
|
|
2a89dff |
alsa_manage_home_files(unpriv_userdomain)
|
|
|
2a89dff |
@@ -158,6 +161,125 @@ optional_policy(`
|
|
|
2a89dff |
alsa_filetrans_named_content(unpriv_userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
|
|
|
2a89dff |
+tunable_policy(`allow_console_login',`
|
|
|
2a89dff |
+ term_use_console(userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+allow userdomain userdomain:process signull;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+allow userdomain user_devpts_t:chr_file { setattr rw_chr_file_perms };
|
|
|
2a89dff |
+term_create_pty(userdomain, user_devpts_t)
|
|
|
2a89dff |
+# avoid annoying messages on terminal hangup on role change
|
|
|
2a89dff |
+dontaudit userdomain user_devpts_t:chr_file ioctl;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+allow userdomain user_tty_device_t:chr_file { setattr rw_chr_file_perms };
|
|
|
2a89dff |
+# avoid annoying messages on terminal hangup on role change
|
|
|
2a89dff |
+dontaudit userdomain user_tty_device_t:chr_file ioctl;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+corecmd_shell_entry_type(userdomain)
|
|
|
2a89dff |
+corecmd_bin_entry_type(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+term_user_pty(userdomain, user_devpts_t)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+term_user_tty(userdomain, user_tty_device_t)
|
|
|
2a89dff |
+term_dontaudit_getattr_generic_ptys(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+application_exec_all(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+kernel_read_kernel_sysctls(userdomain)
|
|
|
2a89dff |
+kernel_read_all_sysctls(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_list_unlabeled(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_files(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_symlinks(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_pipes(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_sockets(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_blk_files(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_getattr_unlabeled_chr_files(userdomain)
|
|
|
2a89dff |
+kernel_dontaudit_list_proc(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+dev_dontaudit_getattr_all_blk_files(userdomain)
|
|
|
2a89dff |
+dev_dontaudit_getattr_all_chr_files(userdomain)
|
|
|
2a89dff |
+dev_getattr_mtrr_dev(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+# When the user domain runs ps, there will be a number of access
|
|
|
2a89dff |
+# denials when ps tries to search /proc. Do not audit these denials.
|
|
|
2a89dff |
+domain_dontaudit_read_all_domains_state(userdomain)
|
|
|
2a89dff |
+domain_dontaudit_getattr_all_domains(userdomain)
|
|
|
2a89dff |
+domain_dontaudit_getsession_all_domains(userdomain)
|
|
|
2a89dff |
+dev_dontaudit_all_access_check(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+files_read_etc_files(userdomain)
|
|
|
2a89dff |
+files_list_mnt(userdomain)
|
|
|
2a89dff |
+files_list_var(userdomain)
|
|
|
2a89dff |
+files_read_mnt_files(userdomain)
|
|
|
2a89dff |
+files_dontaudit_access_check_mnt(userdomain)
|
|
|
2a89dff |
+files_read_etc_runtime_files(userdomain)
|
|
|
2a89dff |
+files_read_usr_files(userdomain)
|
|
|
2a89dff |
+files_read_usr_src_files(userdomain)
|
|
|
2a89dff |
+# Read directories and files with the readable_t type.
|
|
|
2a89dff |
+# This type is a general type for "world"-readable files.
|
|
|
2a89dff |
+files_list_world_readable(userdomain)
|
|
|
2a89dff |
+files_read_world_readable_files(userdomain)
|
|
|
2a89dff |
+files_read_world_readable_symlinks(userdomain)
|
|
|
2a89dff |
+files_read_world_readable_pipes(userdomain)
|
|
|
2a89dff |
+files_read_world_readable_sockets(userdomain)
|
|
|
2a89dff |
+# old broswer_domain():
|
|
|
2a89dff |
+files_dontaudit_getattr_all_dirs(userdomain)
|
|
|
2a89dff |
+files_dontaudit_list_non_security(userdomain)
|
|
|
2a89dff |
+files_dontaudit_getattr_all_files(userdomain)
|
|
|
2a89dff |
+files_dontaudit_getattr_non_security_symlinks(userdomain)
|
|
|
2a89dff |
+files_dontaudit_getattr_non_security_pipes(userdomain)
|
|
|
2a89dff |
+files_dontaudit_getattr_non_security_sockets(userdomain)
|
|
|
2a89dff |
+files_dontaudit_setattr_etc_runtime_files(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+files_exec_usr_files(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+fs_list_cgroup_dirs(userdomain)
|
|
|
2a89dff |
+fs_dontaudit_rw_cgroup_files(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+storage_rw_fuse(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+init_stream_connect(userdomain)
|
|
|
2a89dff |
+# The library functions always try to open read-write first,
|
|
|
2a89dff |
+# then fall back to read-only if it fails.
|
|
|
2a89dff |
+init_dontaudit_rw_utmp(userdomain)
|
|
|
2a89dff |
+libs_exec_ld_so(userdomain)
|
|
|
2a89dff |
+logging_send_audit_msgs(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+miscfiles_read_localization(userdomain)
|
|
|
2a89dff |
+miscfiles_read_generic_certs(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+miscfiles_read_all_certs(userdomain)
|
|
|
2a89dff |
+miscfiles_read_localization(userdomain)
|
|
|
2a89dff |
+miscfiles_read_man_pages(userdomain)
|
|
|
2a89dff |
+miscfiles_read_public_files(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+systemd_dbus_chat_logind(userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+tunable_policy(`allow_execmem',`
|
|
|
2a89dff |
+ # Allow loading DSOs that require executable stack.
|
|
|
2a89dff |
+ allow userdomain self:process execmem;
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+tunable_policy(`allow_execmem && allow_execstack',`
|
|
|
2a89dff |
+ # Allow making the stack executable via mprotect.
|
|
|
2a89dff |
+ allow userdomain self:process execstack;
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ abrt_stream_connect(userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ fs_list_cgroup_dirs(userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ ssh_rw_stream_sockets(userdomain)
|
|
|
2a89dff |
+ ssh_delete_tmp(userdomain)
|
|
|
2a89dff |
+ ssh_signal(userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
gnome_filetrans_home_content(userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
@@ -173,3 +295,240 @@ optional_policy(`
|
|
|
2a89dff |
optional_policy(`
|
|
|
2a89dff |
xserver_filetrans_home_content(userdomain)
|
|
|
2a89dff |
')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+##############################
|
|
|
2a89dff |
+#
|
|
|
2a89dff |
+# Common User domain Local policy
|
|
|
2a89dff |
+#
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+# evolution and gnome-session try to create a netlink socket
|
|
|
2a89dff |
+dontaudit common_userdomain self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };
|
|
|
2a89dff |
+dontaudit common_userdomain self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };
|
|
|
2a89dff |
+allow common_userdomain self:netlink_kobject_uevent_socket create_socket_perms;
|
|
|
2a89dff |
+allow common_userdomain self:socket create_socket_perms;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+allow common_userdomain unpriv_userdomain:fd use;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+kernel_read_system_state(common_userdomain)
|
|
|
2a89dff |
+kernel_read_network_state(common_userdomain)
|
|
|
2a89dff |
+kernel_read_software_raid_state(common_userdomain)
|
|
|
2a89dff |
+kernel_read_net_sysctls(common_userdomain)
|
|
|
2a89dff |
+# Very permissive allowing every domain to see every type:
|
|
|
2a89dff |
+kernel_get_sysvipc_info(common_userdomain)
|
|
|
2a89dff |
+# Find CDROM devices:
|
|
|
2a89dff |
+kernel_read_device_sysctls(common_userdomain)
|
|
|
2a89dff |
+kernel_request_load_module(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+corenet_udp_bind_generic_node(common_userdomain)
|
|
|
2a89dff |
+corenet_udp_bind_generic_port(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+dev_read_rand(common_userdomain)
|
|
|
2a89dff |
+dev_write_sound(common_userdomain)
|
|
|
2a89dff |
+dev_read_sound(common_userdomain)
|
|
|
2a89dff |
+dev_read_sound_mixer(common_userdomain)
|
|
|
2a89dff |
+dev_write_sound_mixer(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+files_exec_etc_files(common_userdomain)
|
|
|
2a89dff |
+files_search_locks(common_userdomain)
|
|
|
2a89dff |
+# Check to see if cdrom is mounted
|
|
|
2a89dff |
+files_search_mnt(common_userdomain)
|
|
|
2a89dff |
+# cjp: perhaps should cut back on file reads:
|
|
|
2a89dff |
+files_read_var_files(common_userdomain)
|
|
|
2a89dff |
+files_read_var_symlinks(common_userdomain)
|
|
|
2a89dff |
+files_read_generic_spool(common_userdomain)
|
|
|
2a89dff |
+files_read_var_lib_files(common_userdomain)
|
|
|
2a89dff |
+# Stat lost+found.
|
|
|
2a89dff |
+files_getattr_lost_found_dirs(common_userdomain)
|
|
|
2a89dff |
+files_read_config_files(common_userdomain)
|
|
|
2a89dff |
+fs_read_noxattr_fs_files(common_userdomain)
|
|
|
2a89dff |
+fs_read_noxattr_fs_symlinks(common_userdomain)
|
|
|
2a89dff |
+fs_rw_cgroup_files(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+application_getattr_socket(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+logging_send_syslog_msg(common_userdomain)
|
|
|
2a89dff |
+logging_send_audit_msgs(common_userdomain)
|
|
|
2a89dff |
+selinux_get_enforce_mode(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+# cjp: some of this probably can be removed
|
|
|
2a89dff |
+selinux_get_fs_mount(common_userdomain)
|
|
|
2a89dff |
+selinux_validate_context(common_userdomain)
|
|
|
2a89dff |
+selinux_compute_access_vector(common_userdomain)
|
|
|
2a89dff |
+selinux_compute_create_context(common_userdomain)
|
|
|
2a89dff |
+selinux_compute_relabel_context(common_userdomain)
|
|
|
2a89dff |
+selinux_compute_user_contexts(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+# for eject
|
|
|
2a89dff |
+storage_getattr_fixed_disk_dev(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+auth_read_login_records(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+init_read_utmp(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+seutil_read_file_contexts(common_userdomain)
|
|
|
2a89dff |
+seutil_read_default_contexts(common_userdomain)
|
|
|
2a89dff |
+seutil_exec_checkpolicy(common_userdomain)
|
|
|
2a89dff |
+seutil_exec_setfiles(common_userdomain)
|
|
|
2a89dff |
+# for when the network connection is killed
|
|
|
2a89dff |
+# this is needed when a login role can change
|
|
|
2a89dff |
+# to this one.
|
|
|
2a89dff |
+seutil_dontaudit_signal_newrole(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+tunable_policy(`user_direct_mouse',`
|
|
|
2a89dff |
+ dev_read_mouse(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+tunable_policy(`user_ttyfile_stat',`
|
|
|
2a89dff |
+ term_getattr_all_ttys(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ # Allow graphical boot to check battery lifespan
|
|
|
2a89dff |
+ apm_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ canna_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ colord_read_lib_files(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ dbus_system_bus_client(common_userdomain)
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ allow common_userdomain common_userdomain:dbus send_msg;
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ avahi_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ policykit_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ bluetooth_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ consolekit_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ consolekit_read_log(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ devicekit_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ devicekit_dbus_chat_power(common_userdomain)
|
|
|
2a89dff |
+ devicekit_dbus_chat_disk(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ evolution_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ evolution_alarm_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ gnome_dbus_chat_gconfdefault(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ hal_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ kde_dbus_chat_backlighthelper(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ modemmanager_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ networkmanager_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ networkmanager_read_lib_files(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+ optional_policy(`
|
|
|
2a89dff |
+ vpn_dbus_chat(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ inetd_use_fds(common_userdomain)
|
|
|
2a89dff |
+ inetd_rw_tcp_sockets(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ inn_read_config(common_userdomain)
|
|
|
2a89dff |
+ inn_read_news_lib(common_userdomain)
|
|
|
2a89dff |
+ inn_read_news_spool(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ lircd_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ locate_read_lib_files(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+# for running depmod as part of the kernel packaging process
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ modutils_read_module_config(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ mta_rw_spool(common_userdomain)
|
|
|
2a89dff |
+ mta_manage_queue(common_userdomain)
|
|
|
2a89dff |
+ mta_filetrans_home_content(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ tunable_policy(`allow_user_mysql_connect',`
|
|
|
2a89dff |
+ mysql_stream_connect(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ oident_manage_user_content(common_userdomain)
|
|
|
2a89dff |
+ oident_relabel_user_content(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ # to allow monitoring of pcmcia status
|
|
|
2a89dff |
+ pcmcia_read_pid(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ pcscd_read_pub_files(common_userdomain)
|
|
|
2a89dff |
+ pcscd_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ tunable_policy(`allow_user_postgresql_connect',`
|
|
|
2a89dff |
+ postgresql_stream_connect(common_userdomain)
|
|
|
2a89dff |
+ postgresql_tcp_connect(common_userdomain)
|
|
|
2a89dff |
+ ')
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ resmgr_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ rpc_dontaudit_getattr_exports(common_userdomain)
|
|
|
2a89dff |
+ rpc_manage_nfs_rw_content(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ rpcbind_stream_connect(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ samba_stream_connect_winbind(common_userdomain)
|
|
|
2a89dff |
+')
|
|
|
2a89dff |
+
|
|
|
2a89dff |
+optional_policy(`
|
|
|
2a89dff |
+ slrnpull_search_spool(common_userdomain)
|
|
|
2a89dff |
+')
|