140 lines
3.4 KiB
Plaintext
140 lines
3.4 KiB
Plaintext
|
# Home macros
|
||
|
|
|
||
|
|
################################################
|
||
|
|
# network_home(source)
|
||
|
|
#
|
||
|
|
# Allows source domain to use a network home
|
||
|
|
# This includes privileges of create and execute
|
||
|
|
# as well as the ability to create sockets and fifo
|
||
|
|
|
||
|
|
define(`network_home', `
|
||
|
|
allow $1 autofs_t:dir { search getattr };
|
||
|
|
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
create_dir_file($1, nfs_t)
|
||
|
|
can_exec($1, nfs_t)
|
||
|
|
allow $1 nfs_t:{ sock_file fifo_file } create_file_perms;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
create_dir_file($1, cifs_t)
|
||
|
|
can_exec($1, cifs_t)
|
||
|
|
allow $1 cifs_t:{ sock_file fifo_file } create_file_perms;
|
||
|
|
}
|
||
|
|
') dnl network_home
|
||
|
|
|
||
|
|
################################################
|
||
|
|
# write_network_home(source)
|
||
|
|
#
|
||
|
|
# Allows source domain to create directories and
|
||
|
|
# files on network file system
|
||
|
|
|
||
|
|
define(`write_network_home', `
|
||
|
|
allow $1 home_root_t:dir search;
|
||
|
|
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
create_dir_file($1, nfs_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
create_dir_file($1, cifs_t)
|
||
|
|
}
|
||
|
|
allow $1 autofs_t:dir { search getattr };
|
||
|
|
') dnl write_network_home
|
||
|
|
|
||
|
|
################################################
|
||
|
|
# read_network_home(source)
|
||
|
|
#
|
||
|
|
# Allows source domain to read directories and
|
||
|
|
# files on network file system
|
||
|
|
|
||
|
|
define(`read_network_home', `
|
||
|
|
allow $1 home_root_t:dir search;
|
||
|
|
|
||
|
|
if (use_nfs_home_dirs) {
|
||
|
|
r_dir_file($1, nfs_t)
|
||
|
|
}
|
||
|
|
if (use_samba_home_dirs) {
|
||
|
|
r_dir_file($1, cifs_t)
|
||
|
|
}
|
||
|
|
allow $1 autofs_t:dir { search getattr };
|
||
|
|
') dnl read_network_home
|
||
|
|
|
||
|
|
##################################################
|
||
|
|
# home_domain_ro_access(source, user, app)
|
||
|
|
#
|
||
|
|
# Gives source access to the read-only home
|
||
|
|
# domain of app for the given user type
|
||
|
|
|
||
|
|
define(`home_domain_ro_access', `
|
||
|
|
allow $1 { home_root_t $2_home_dir_t }:dir { search getattr };
|
||
|
|
read_network_home($1)
|
||
|
|
ifelse($3, `', `
|
||
|
|
r_dir_file($1, $2_home_t)
|
||
|
|
', `
|
||
|
|
r_dir_file($1, $2_$3_ro_home_t)
|
||
|
|
')
|
||
|
|
') dnl home_domain_ro_access
|
||
|
|
|
||
|
|
#################################################
|
||
|
|
# home_domain_access(source, user, app)
|
||
|
|
#
|
||
|
|
# Gives source full access to the home
|
||
|
|
# domain of app for the given user type
|
||
|
|
#
|
||
|
|
# Requires transition in caller
|
||
|
|
|
||
|
|
define(`home_domain_access', `
|
||
|
|
allow $1 { home_root_t $2_home_dir_t }:dir { search getattr };
|
||
|
|
write_network_home($1)
|
||
|
|
ifelse($3, `', `
|
||
|
|
file_type_auto_trans($1, $2_home_dir_t, $2_home_t)
|
||
|
|
create_dir_file($1, $2_home_t)
|
||
|
|
', `
|
||
|
|
create_dir_file($1, $2_$3_home_t)
|
||
|
|
')
|
||
|
|
') dnl home_domain_access
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain (prefix, app)
|
||
|
|
#
|
||
|
|
# Creates a domain in the prefix home where an application can
|
||
|
|
# store its settings. It is accessible by the prefix domain.
|
||
|
|
#
|
||
|
|
# Requires transition in caller
|
||
|
|
|
||
|
|
define(`home_domain', `
|
||
|
|
|
||
|
|
# Declare home domain
|
||
|
|
type $1_$2_home_t, file_type, $1_file_type, sysadmfile, polymember;
|
||
|
|
typealias $1_$2_home_t alias $1_$2_rw_t;
|
||
|
|
|
||
|
|
# User side access
|
||
|
|
create_dir_file($1_t, $1_$2_home_t)
|
||
|
|
allow $1_t $1_$2_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
||
|
|
|
||
|
|
# App side access
|
||
|
|
home_domain_access($1_$2_t, $1, $2)
|
||
|
|
')
|
||
|
|
|
||
|
|
####################################################################
|
||
|
|
# home_domain_ro (user, app)
|
||
|
|
#
|
||
|
|
# Creates a read-only domain in the user home where an application can
|
||
|
|
# store its settings. It is fully accessible by the user, but
|
||
|
|
# it is read-only for the application.
|
||
|
|
#
|
||
|
|
|
||
|
|
define(`home_domain_ro', `
|
||
|
|
|
||
|
|
# Declare home domain
|
||
|
|
type $1_$2_ro_home_t, file_type, $1_file_type, sysadmfile;
|
||
|
|
typealias $1_$2_ro_home_t alias $1_$2_ro_t;
|
||
|
|
|
||
|
|
# User side access
|
||
|
|
create_dir_file($1_t, $1_$2_ro_home_t)
|
||
|
|
allow $1_t $1_$2_ro_home_t:{ dir file lnk_file } { relabelfrom relabelto };
|
||
|
|
|
||
|
|
# App side access
|
||
|
|
home_domain_ro_access($1_$2_t, $1, $2)
|
||
|
|
')
|