++## Read/write unconfined tmpfs files. ++##
++##+-## List users untrusted directories. ++## Read/write user tmpfs files. + ##
+ ##
+ ## This is a templated interface, and should only
+@@ -3290,23 +3393,24 @@
+ ##
+ ##
+ #
+-template(`userdom_list_user_untrusted_content',`
++template(`userdom_rw_user_tmpfs_files',`
+ gen_require(`
+- type $1_untrusted_content_t;
+ type $1_tmpfs_t;
-+ ')
-+
+ ')
+
+- allow $2 $1_untrusted_content_t:dir list_dir_perms;
+ fs_search_tmpfs($2)
+ allow $2 $1_tmpfs_t:dir list_dir_perms;
-+ read_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
++ rw_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
+ read_lnk_files_pattern($2,$1_tmpfs_t,$1_tmpfs_t)
+ ')
+
+ ########################################
+ ##
+-## Do not audit attempts to read user
+-## untrusted directories.
++## Read/write user tmpfs files.
+ ##
+ ## This is a templated interface, and should only
+@@ -3321,25 +3425,28 @@
+ ##
+ ##
+ ##
+-## Read user untrusted files.
++## List users untrusted directories.
+ ##
+ ## This is a templated interface, and should only
+@@ -3358,18 +3465,86 @@
+ ##
+ ##
+ #
+-template(`userdom_read_user_untrusted_content_files',`
++template(`userdom_list_user_untrusted_content',`
+ gen_require(`
+ type $1_untrusted_content_t;
+ ')
+
+ allow $2 $1_untrusted_content_t:dir list_dir_perms;
+- read_files_pattern($2,$1_untrusted_content_t,$1_untrusted_content_t)
+ ')
+
+ ########################################
+ ##
++## Do not audit attempts to read user
++## untrusted directories.
++##
++## This is a templated interface, and should only
++## be called from a per-userdomain template.
++##
-+## Read/write user tmpfs files.
++## Read user untrusted files.
+##
+## This is a templated interface, and should only
@@ -32311,10 +32471,22 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
+##
+##
+#
- template(`userdom_rw_user_tmpfs_files',`
- gen_require(`
- type $1_tmpfs_t;
-@@ -4231,11 +4370,11 @@
++template(`userdom_read_user_untrusted_content_files',`
++ gen_require(`
++ type $1_untrusted_content_t;
++ ')
++
++ allow $2 $1_untrusted_content_t:dir list_dir_perms;
++ read_files_pattern($2,$1_untrusted_content_t,$1_untrusted_content_t)
++')
++
++########################################
++##
+@@ -4231,11 +4406,11 @@
#
interface(`userdom_search_staff_home_dirs',`
gen_require(`
@@ -32328,7 +32500,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4251,10 +4390,10 @@
+@@ -4251,10 +4426,10 @@
#
interface(`userdom_dontaudit_search_staff_home_dirs',`
gen_require(`
@@ -32341,7 +32513,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4270,11 +4409,11 @@
+@@ -4270,11 +4445,11 @@
#
interface(`userdom_manage_staff_home_dirs',`
gen_require(`
@@ -32355,7 +32527,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4289,16 +4428,16 @@
+@@ -4289,16 +4464,16 @@
#
interface(`userdom_relabelto_staff_home_dirs',`
gen_require(`
@@ -32375,7 +32547,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
## users home directory.
##
##
-@@ -4307,12 +4446,27 @@
+@@ -4307,12 +4482,27 @@
##
##
#
@@ -32406,7 +32578,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4327,13 +4481,13 @@
+@@ -4327,13 +4517,13 @@
#
interface(`userdom_read_staff_home_content_files',`
gen_require(`
@@ -32424,7 +32596,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4531,10 +4685,10 @@
+@@ -4531,10 +4721,10 @@
#
interface(`userdom_getattr_sysadm_home_dirs',`
gen_require(`
@@ -32437,7 +32609,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4551,10 +4705,10 @@
+@@ -4551,10 +4741,10 @@
#
interface(`userdom_dontaudit_getattr_sysadm_home_dirs',`
gen_require(`
@@ -32450,7 +32622,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4569,10 +4723,10 @@
+@@ -4569,10 +4759,10 @@
#
interface(`userdom_search_sysadm_home_dirs',`
gen_require(`
@@ -32463,7 +32635,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4588,10 +4742,10 @@
+@@ -4588,10 +4778,10 @@
#
interface(`userdom_dontaudit_search_sysadm_home_dirs',`
gen_require(`
@@ -32476,7 +32648,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4606,10 +4760,10 @@
+@@ -4606,10 +4796,10 @@
#
interface(`userdom_list_sysadm_home_dirs',`
gen_require(`
@@ -32489,7 +32661,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4625,10 +4779,10 @@
+@@ -4625,10 +4815,10 @@
#
interface(`userdom_dontaudit_list_sysadm_home_dirs',`
gen_require(`
@@ -32502,7 +32674,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4644,12 +4798,11 @@
+@@ -4644,12 +4834,11 @@
#
interface(`userdom_dontaudit_read_sysadm_home_content_files',`
gen_require(`
@@ -32518,7 +32690,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4676,10 +4829,10 @@
+@@ -4676,10 +4865,10 @@
#
interface(`userdom_sysadm_home_dir_filetrans',`
gen_require(`
@@ -32531,7 +32703,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4694,10 +4847,10 @@
+@@ -4694,10 +4883,10 @@
#
interface(`userdom_search_sysadm_home_content_dirs',`
gen_require(`
@@ -32544,7 +32716,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4712,13 +4865,13 @@
+@@ -4712,13 +4901,13 @@
#
interface(`userdom_read_sysadm_home_content_files',`
gen_require(`
@@ -32562,7 +32734,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4754,11 +4907,49 @@
+@@ -4754,11 +4943,49 @@
#
interface(`userdom_search_all_users_home_dirs',`
gen_require(`
@@ -32613,7 +32785,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4778,6 +4969,14 @@
+@@ -4778,6 +5005,14 @@
files_list_home($1)
allow $1 home_dir_type:dir list_dir_perms;
@@ -32628,7 +32800,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/userdo
')
########################################
-@@ -4839,6 +5038,26 @@
+@@ -4839,6 +5074,26 @@
########################################
##