policy_module(userdomain, 4.3.3) ######################################## # # Declarations # ## ##

## Allow users to connect to mysql ##

##
gen_tunable(allow_user_mysql_connect, false) ## ##

## Allow users to connect to PostgreSQL ##

##
gen_tunable(allow_user_postgresql_connect, false) ## ##

## Allow regular users direct mouse access ##

##
gen_tunable(user_direct_mouse, false) ## ##

## Allow users to read system messages. ##

##
gen_tunable(user_dmesg, false) ## ##

## Allow user to r/w files on filesystems ## that do not have extended attributes (FAT, CDROM, FLOPPY) ##

##
gen_tunable(user_rw_noexattrfile, false) ## ##

## Allow w to display everyone ##

##
gen_tunable(user_ttyfile_stat, false) attribute admindomain; # all user domains attribute userdomain; # unprivileged user domains attribute unpriv_userdomain; attribute untrusted_content_type; attribute untrusted_content_tmp_type; type user_home_dir_t alias { staff_home_dir_t sysadm_home_dir_t secadm_home_dir_t auditadm_home_dir_t unconfined_home_dir_t }; fs_associate_tmpfs(user_home_dir_t) files_type(user_home_dir_t) files_mountpoint(user_home_dir_t) files_associate_tmp(user_home_dir_t) files_poly(user_home_dir_t) files_poly_member(user_home_dir_t) files_poly_parent(user_home_dir_t) ubac_constrained(user_home_dir_t) type user_home_t alias { staff_home_t sysadm_home_t secadm_home_t auditadm_home_t unconfined_home_t }; typealias user_home_t alias { staff_untrusted_content_t sysadm_untrusted_content_t secadm_untrusted_content_t auditadm_untrusted_content_t unconfined_untrusted_content_t }; userdom_user_home_content(user_home_t) fs_associate_tmpfs(user_home_t) files_associate_tmp(user_home_t) files_poly_member(user_home_t) files_poly_parent(user_home_t) files_mountpoint(user_home_t) ubac_constrained(user_home_t) type user_devpts_t alias { staff_devpts_t sysadm_devpts_t secadm_devpts_t auditadm_devpts_t unconfined_devpts_t }; dev_node(user_devpts_t) files_type(user_devpts_t) ubac_constrained(user_devpts_t) type user_tmp_t alias { staff_tmp_t sysadm_tmp_t secadm_tmp_t auditadm_tmp_t unconfined_tmp_t }; typealias user_tmp_t alias { staff_untrusted_content_tmp_t sysadm_untrusted_content_tmp_t secadm_untrusted_content_tmp_t auditadm_untrusted_content_tmp_t unconfined_untrusted_content_tmp_t }; files_tmp_file(user_tmp_t) userdom_user_home_content(user_tmp_t) type user_tmpfs_t alias { staff_tmpfs_t sysadm_tmpfs_t secadm_tmpfs_t auditadm_tmpfs_t unconfined_tmpfs_t }; files_tmpfs_file(user_tmpfs_t) userdom_user_home_content(user_tmpfs_t) type user_tty_device_t alias { staff_tty_device_t sysadm_tty_device_t secadm_tty_device_t auditadm_tty_device_t unconfined_tty_device_t }; dev_node(user_tty_device_t) ubac_constrained(user_tty_device_t)