## Miscelaneous files. ######################################## ## ## Read system SSL certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_certs',` gen_require(` type cert_t; ') allow $1 cert_t:dir list_dir_perms; read_files_pattern($1, cert_t, cert_t) read_lnk_files_pattern($1, cert_t, cert_t) ') ######################################## ## ## manange system SSL certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_cert_dirs',` gen_require(` type cert_t; ') manage_dirs_pattern($1, cert_t, cert_t) ') ######################################## ## ## manange system SSL certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_cert_files',` gen_require(` type cert_t; ') manage_files_pattern($1, cert_t, cert_t) read_lnk_files_pattern($1, cert_t, cert_t) ') ######################################## ## ## Read fonts. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_fonts',` gen_require(` type fonts_t, fonts_cache_t; ') # cjp: fonts can be in either of these dirs files_search_usr($1) libs_search_lib($1) allow $1 fonts_t:dir list_dir_perms; read_files_pattern($1, fonts_t, fonts_t) read_lnk_files_pattern($1, fonts_t, fonts_t) allow $1 fonts_cache_t:dir list_dir_perms; read_files_pattern($1, fonts_cache_t, fonts_cache_t) read_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t) ') ######################################## ## ## Set the attributes on a fonts directory. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_setattr_fonts_dirs',` gen_require(` type fonts_t; ') allow $1 fonts_t:dir setattr; ') ######################################## ## ## Do not audit attempts to set the attributes ## on a fonts directory. ## ## ## ## Domain to not audit. ## ## ## # interface(`miscfiles_dontaudit_setattr_fonts_dirs',` gen_require(` type fonts_t; ') dontaudit $1 fonts_t:dir setattr; ') ######################################## ## ## Do not audit attempts to write fonts. ## ## ## ## Domain to not audit. ## ## ## # interface(`miscfiles_dontaudit_write_fonts',` gen_require(` type fonts_t; ') dontaudit $1 fonts_t:dir { write setattr }; dontaudit $1 fonts_t:file write; ') ######################################## ## ## Create, read, write, and delete fonts. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_fonts',` gen_require(` type fonts_t; ') # cjp: fonts can be in either of these dirs files_search_usr($1) libs_search_lib($1) manage_dirs_pattern($1, fonts_t, fonts_t) manage_files_pattern($1, fonts_t, fonts_t) manage_lnk_files_pattern($1, fonts_t, fonts_t) ') ######################################## ## ## Set the attributes on a fonts cache directory. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_setattr_fonts_cache_dirs',` gen_require(` type fonts_cache_t; ') allow $1 fonts_cache_t:dir setattr; ') ######################################## ## ## Do not audit attempts to set the attributes ## on a fonts cache directory. ## ## ## ## Domain to not audit. ## ## # interface(`miscfiles_dontaudit_setattr_fonts_cache_dirs',` gen_require(` type fonts_cache_t; ') dontaudit $1 fonts_cache_t:dir setattr; ') ######################################## ## ## Create, read, write, and delete fonts cache. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_fonts_cache',` gen_require(` type fonts_cache_t; ') files_search_var($1) manage_dirs_pattern($1, fonts_cache_t, fonts_cache_t) manage_files_pattern($1, fonts_cache_t, fonts_cache_t) manage_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t) ') ######################################## ## ## Read hardware identification data. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_hwdata',` gen_require(` type hwdata_t; ') allow $1 hwdata_t:dir list_dir_perms; read_files_pattern($1, hwdata_t, hwdata_t) read_lnk_files_pattern($1, hwdata_t, hwdata_t) ') ######################################## ## ## Allow process to setattr localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_setattr_localization',` gen_require(` type locale_t; ') files_search_usr($1) allow $1 locale_t:dir list_dir_perms; allow $1 locale_t:file setattr; ') ######################################## ## ## Allow process to read localization information. ## ## ##

## Allow the specified domain to read the localization files. ## This is typically for time zone configuration files, such as ## /etc/localtime and files in /usr/share/zoneinfo. ## Typically, any domain which needs to know the GMT/UTC ## offset of the current timezone will need access ## to these files. Generally, it should be safe for any ## domain to read these files. ##

##
## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_localization',` gen_require(` type locale_t; ') files_read_etc_symlinks($1) files_search_usr($1) allow $1 locale_t:dir list_dir_perms; read_files_pattern($1, locale_t, locale_t) read_lnk_files_pattern($1, locale_t, locale_t) # why? libs_read_lib_files($1) ') ######################################## ## ## Allow process to write localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_rw_localization',` gen_require(` type locale_t; ') files_search_usr($1) allow $1 locale_t:dir list_dir_perms; rw_files_pattern($1, locale_t, locale_t) ') ######################################## ## ## Allow process to relabel localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_relabel_localization',` gen_require(` type locale_t; ') files_search_usr($1) relabel_files_pattern($1, locale_t, locale_t) ') ######################################## ## ## Allow process to read legacy time localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_legacy_read_localization',` gen_require(` type locale_t; ') miscfiles_read_localization($1) allow $1 locale_t:file execute; ') ######################################## ## ## Search man pages. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_search_man_pages',` gen_require(` type man_t; ') allow $1 man_t:dir search_dir_perms; files_search_usr($1) ') ######################################## ## ## Do not audit attempts to search man pages. ## ## ## ## Domain to not audit. ## ## # interface(`miscfiles_dontaudit_search_man_pages',` gen_require(` type man_t; ') dontaudit $1 man_t:dir search_dir_perms; ') ######################################## ## ## Read man pages ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_man_pages',` gen_require(` type man_t; ') files_search_usr($1) allow $1 man_t:dir list_dir_perms; read_files_pattern($1, man_t, man_t) read_lnk_files_pattern($1, man_t, man_t) ') ######################################## ## ## Delete man pages ## ## ## ## Domain allowed access. ## ## # cjp: added for tmpreaper # interface(`miscfiles_delete_man_pages',` gen_require(` type man_t; ') files_search_usr($1) allow $1 man_t:dir setattr; # RH bug #309351 allow $1 man_t:dir list_dir_perms; delete_dirs_pattern($1, man_t, man_t) delete_files_pattern($1, man_t, man_t) delete_lnk_files_pattern($1, man_t, man_t) ') ######################################## ## ## Create, read, write, and delete man pages ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_manage_man_pages',` gen_require(` type man_t; ') files_search_usr($1) manage_dirs_pattern($1, man_t, man_t) manage_files_pattern($1, man_t, man_t) read_lnk_files_pattern($1, man_t, man_t) ') ######################################## ## ## Read public files used for file ## transfer services. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_public_files',` gen_require(` type public_content_t, public_content_rw_t; ') allow $1 { public_content_t public_content_rw_t }:dir list_dir_perms; read_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t }) read_lnk_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t }) ') ######################################## ## ## Create, read, write, and delete public files ## and directories used for file transfer services. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_public_files',` gen_require(` type public_content_rw_t; ') manage_dirs_pattern($1, public_content_rw_t, public_content_rw_t) manage_files_pattern($1, public_content_rw_t, public_content_rw_t) manage_lnk_files_pattern($1, public_content_rw_t, public_content_rw_t) ') ######################################## ## ## Read TeX data ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_tetex_data',` gen_require(` type tetex_data_t; ') files_search_var($1) files_search_var_lib($1) # cjp: TeX data can be in either of the above dirs allow $1 tetex_data_t:dir list_dir_perms; read_files_pattern($1, tetex_data_t, tetex_data_t) read_lnk_files_pattern($1, tetex_data_t, tetex_data_t) ') ######################################## ## ## Execute TeX data programs in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_exec_tetex_data',` gen_require(` type fonts_t; type tetex_data_t; ') files_search_var($1) files_search_var_lib($1) # cjp: TeX data can be in either of the above dirs allow $1 tetex_data_t:dir list_dir_perms; exec_files_pattern($1, tetex_data_t, tetex_data_t) ') ######################################## ## ## Let test files be an entry point for ## a specified domain. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_domain_entry_test_files',` gen_require(` type test_file_t; ') domain_entry_file($1, test_file_t) ') ######################################## ## ## Read test files and directories. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_test_files',` gen_require(` type test_file_t; ') read_files_pattern($1, test_file_t, test_file_t) read_lnk_files_pattern($1, test_file_t, test_file_t) ') ######################################## ## ## Execute test files. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_exec_test_files',` gen_require(` type test_file_t; ') exec_files_pattern($1, test_file_t, test_file_t) read_lnk_files_pattern($1, test_file_t, test_file_t) ') ######################################## ## ## Execute test files. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_etc_filetrans_localization',` gen_require(` type locale_t; ') files_etc_filetrans($1, locale_t, file) ') ######################################## ## ## Create, read, write, and delete localization ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_localization',` gen_require(` type locale_t; ') manage_dirs_pattern($1, locale_t, locale_t) manage_files_pattern($1, locale_t, locale_t) manage_lnk_files_pattern($1, locale_t, locale_t) ')