@@ -31212,17 +31293,17 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ##
#### This template creates a user domain, types, and -@@ -1157,8 +1151,8 @@ +@@ -1157,8 +1147,8 @@ # Declarations # -+ userdom_login_user_template($1) ++ userdom_restricted_xwindows_user_template($1) # Inherit rules for ordinary users. - userdom_restricted_user_template($1) userdom_common_user_template($1) ############################## -@@ -1167,11 +1161,10 @@ +@@ -1167,11 +1157,10 @@ # # port access is audited even if dac would not have allowed it, so dontaudit it here @@ -31235,7 +31316,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # cjp: why? files_read_kernel_symbol_table($1_t) -@@ -1189,36 +1182,41 @@ +@@ -1189,36 +1178,41 @@ ') ') @@ -31290,7 +31371,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ') -@@ -1263,8 +1261,7 @@ +@@ -1263,8 +1257,7 @@ # # Inherit rules for ordinary users. @@ -31300,7 +31381,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol typeattribute $1_t privhome; domain_obj_id_change_exemption($1_t) -@@ -1295,8 +1292,6 @@ +@@ -1295,8 +1288,6 @@ # Manipulate other users crontab. allow $1_t self:passwd crontab; @@ -31309,7 +31390,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol kernel_read_software_raid_state($1_t) kernel_getattr_core_if($1_t) kernel_getattr_message_if($1_t) -@@ -1318,8 +1313,6 @@ +@@ -1318,8 +1309,6 @@ dev_getattr_generic_blk_files($1_t) dev_getattr_generic_chr_files($1_t) @@ -31318,7 +31399,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Allow MAKEDEV to work dev_create_all_blk_files($1_t) dev_create_all_chr_files($1_t) -@@ -1374,13 +1367,6 @@ +@@ -1374,13 +1363,6 @@ # But presently necessary for installing the file_contexts file. seutil_manage_bin_policy($1_t) @@ -31332,7 +31413,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` postgresql_unconfined($1_t) ') -@@ -1432,6 +1418,7 @@ +@@ -1432,6 +1414,7 @@ dev_relabel_all_dev_nodes($1) files_create_boot_flag($1) @@ -31340,7 +31421,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol # Necessary for managing /boot/efi fs_manage_dos_files($1) -@@ -1461,10 +1448,6 @@ +@@ -1461,10 +1444,6 @@ seutil_run_semanage($1,$2,$3) seutil_run_setfiles($1, $2, $3) @@ -31351,7 +31432,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol optional_policy(` aide_run($1,$2, $3) ') -@@ -1484,6 +1467,14 @@ +@@ -1484,6 +1463,14 @@ optional_policy(` netlabel_run_mgmt($1,$2, $3) ') @@ -31366,7 +31447,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1741,11 +1732,15 @@ +@@ -1741,11 +1728,15 @@ # template(`userdom_user_home_content',` gen_require(` @@ -31385,7 +31466,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1841,11 +1836,11 @@ +@@ -1841,11 +1832,11 @@ # template(`userdom_search_user_home_dirs',` gen_require(` @@ -31399,7 +31480,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1875,11 +1870,11 @@ +@@ -1875,11 +1866,11 @@ # template(`userdom_list_user_home_dirs',` gen_require(` @@ -31413,7 +31494,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1923,12 +1918,12 @@ +@@ -1923,12 +1914,12 @@ # template(`userdom_user_home_domtrans',` gen_require(` @@ -31429,7 +31510,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1958,10 +1953,11 @@ +@@ -1958,10 +1949,11 @@ # template(`userdom_dontaudit_list_user_home_dirs',` gen_require(` @@ -31443,7 +31524,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -1993,11 +1989,47 @@ +@@ -1993,11 +1985,47 @@ # template(`userdom_manage_user_home_content_dirs',` gen_require(` @@ -31493,7 +31574,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2029,10 +2061,10 @@ +@@ -2029,10 +2057,10 @@ # template(`userdom_dontaudit_setattr_user_home_content_files',` gen_require(` @@ -31506,7 +31587,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2062,11 +2094,11 @@ +@@ -2062,11 +2090,11 @@ # template(`userdom_read_user_home_content_files',` gen_require(` @@ -31520,7 +31601,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2096,11 +2128,11 @@ +@@ -2096,11 +2124,11 @@ # template(`userdom_dontaudit_read_user_home_content_files',` gen_require(` @@ -31535,7 +31616,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2130,10 +2162,14 @@ +@@ -2130,10 +2158,14 @@ # template(`userdom_dontaudit_write_user_home_content_files',` gen_require(` @@ -31552,7 +31633,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2163,11 +2199,11 @@ +@@ -2163,11 +2195,11 @@ # template(`userdom_read_user_home_content_symlinks',` gen_require(` @@ -31566,7 +31647,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2197,11 +2233,11 @@ +@@ -2197,11 +2229,11 @@ # template(`userdom_exec_user_home_content_files',` gen_require(` @@ -31580,7 +31661,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2231,10 +2267,10 @@ +@@ -2231,10 +2263,10 @@ # template(`userdom_dontaudit_exec_user_home_content_files',` gen_require(` @@ -31593,7 +31674,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2266,12 +2302,12 @@ +@@ -2266,12 +2298,12 @@ # template(`userdom_manage_user_home_content_files',` gen_require(` @@ -31609,7 +31690,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2303,10 +2339,10 @@ +@@ -2303,10 +2335,10 @@ # template(`userdom_dontaudit_manage_user_home_content_dirs',` gen_require(` @@ -31622,7 +31703,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2338,12 +2374,12 @@ +@@ -2338,12 +2370,12 @@ # template(`userdom_manage_user_home_content_symlinks',` gen_require(` @@ -31638,7 +31719,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2375,12 +2411,12 @@ +@@ -2375,12 +2407,12 @@ # template(`userdom_manage_user_home_content_pipes',` gen_require(` @@ -31654,7 +31735,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2412,12 +2448,12 @@ +@@ -2412,12 +2444,12 @@ # template(`userdom_manage_user_home_content_sockets',` gen_require(` @@ -31670,7 +31751,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2462,11 +2498,11 @@ +@@ -2462,11 +2494,11 @@ # template(`userdom_user_home_dir_filetrans',` gen_require(` @@ -31684,7 +31765,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2511,11 +2547,11 @@ +@@ -2511,11 +2543,11 @@ # template(`userdom_user_home_content_filetrans',` gen_require(` @@ -31698,7 +31779,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2555,11 +2591,11 @@ +@@ -2555,11 +2587,11 @@ # template(`userdom_user_home_dir_filetrans_user_home_content',` gen_require(` @@ -31712,7 +31793,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2589,11 +2625,11 @@ +@@ -2589,11 +2621,11 @@ # template(`userdom_write_user_tmp_sockets',` gen_require(` @@ -31726,7 +31807,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2623,11 +2659,11 @@ +@@ -2623,11 +2655,11 @@ # template(`userdom_list_user_tmp',` gen_require(` @@ -31740,7 +31821,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2659,10 +2695,10 @@ +@@ -2659,10 +2691,10 @@ # template(`userdom_dontaudit_list_user_tmp',` gen_require(` @@ -31753,7 +31834,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2694,10 +2730,10 @@ +@@ -2694,10 +2726,10 @@ # template(`userdom_dontaudit_manage_user_tmp_dirs',` gen_require(` @@ -31766,7 +31847,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2727,12 +2763,12 @@ +@@ -2727,12 +2759,12 @@ # template(`userdom_read_user_tmp_files',` gen_require(` @@ -31782,7 +31863,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2764,10 +2800,10 @@ +@@ -2764,10 +2796,10 @@ # template(`userdom_dontaudit_read_user_tmp_files',` gen_require(` @@ -31795,7 +31876,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2799,10 +2835,10 @@ +@@ -2799,10 +2831,10 @@ # template(`userdom_dontaudit_append_user_tmp_files',` gen_require(` @@ -31808,7 +31889,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2832,12 +2868,12 @@ +@@ -2832,12 +2864,12 @@ # template(`userdom_rw_user_tmp_files',` gen_require(` @@ -31824,7 +31905,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2869,10 +2905,10 @@ +@@ -2869,10 +2901,10 @@ # template(`userdom_dontaudit_manage_user_tmp_files',` gen_require(` @@ -31837,7 +31918,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2904,12 +2940,12 @@ +@@ -2904,12 +2936,12 @@ # template(`userdom_read_user_tmp_symlinks',` gen_require(` @@ -31853,7 +31934,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2941,11 +2977,11 @@ +@@ -2941,11 +2973,11 @@ # template(`userdom_manage_user_tmp_dirs',` gen_require(` @@ -31867,7 +31948,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -2977,11 +3013,11 @@ +@@ -2977,11 +3009,11 @@ # template(`userdom_manage_user_tmp_files',` gen_require(` @@ -31881,7 +31962,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -3013,11 +3049,11 @@ +@@ -3013,11 +3045,11 @@ # template(`userdom_manage_user_tmp_symlinks',` gen_require(` @@ -31895,7 +31976,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -3049,11 +3085,11 @@ +@@ -3049,11 +3081,11 @@ # template(`userdom_manage_user_tmp_pipes',` gen_require(` @@ -31909,7 +31990,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -3085,11 +3121,11 @@ +@@ -3085,11 +3117,11 @@ # template(`userdom_manage_user_tmp_sockets',` gen_require(` @@ -31923,7 +32004,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ') ######################################## -@@ -3134,10 +3170,10 @@ +@@ -3134,10 +3166,10 @@ # template(`userdom_user_tmp_filetrans',` gen_require(` @@ -31936,7 +32017,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol files_search_tmp($2) ') -@@ -3178,19 +3214,19 @@ +@@ -3178,19 +3210,19 @@ # template(`userdom_tmp_filetrans_user_tmp',` gen_require(` @@ -31960,7 +32041,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol ##
##
## This is a templated interface, and should only
-@@ -3211,13 +3247,13 @@
+@@ -3211,13 +3243,13 @@
#
template(`userdom_rw_user_tmpfs_files',`
gen_require(`
@@ -31978,7 +32059,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4616,11 +4652,11 @@
+@@ -4616,11 +4648,11 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -31992,7 +32073,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4640,6 +4676,14 @@
+@@ -4640,6 +4672,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -32007,7 +32088,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4677,6 +4721,8 @@
+@@ -4677,6 +4717,8 @@
')
dontaudit $1 { home_dir_type home_type }:dir search_dir_perms;
@@ -32016,7 +32097,7 @@ diff -b -B --ignore-all-space --exclude-from=exclude -N -u -r nsaserefpolicy/pol
')
########################################
-@@ -4721,6 +4767,25 @@
+@@ -4721,6 +4763,25 @@
########################################
##