## GNU network object model environment (GNOME) ######################################## ## ## The per role template for the gnome module. ## ## ##

## This template creates a derived domain which is used ## for gconf sessions. ##

##

## This template is invoked automatically for each role, and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## ## ## ## The role associated with the user domain. ## ## # template(`gnome_per_role_template',` gen_require(` type gconfd_exec_t; attribute gnomedomain; ') ############################## # # Declarations # type $1_gconfd_t, gnomedomain; application_domain($1_gconfd_t, gconfd_exec_t) role $3 types $1_gconfd_t; type $1_gconf_home_t; userdom_user_home_content($1, $1_gconf_home_t) type $1_gnome_home_t; userdom_user_home_content($1, $1_gnome_home_t) type $1_gconf_tmp_t; files_tmp_file($1_gconf_tmp_t) ############################## # # Local Policy # allow $1_gconfd_t self:process getsched; allow $1_gconfd_t self:fifo_file rw_fifo_file_perms; manage_dirs_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t) manage_files_pattern($1_gconfd_t,$1_gconf_home_t,$1_gconf_home_t) userdom_user_home_dir_filetrans($1, $1_gconfd_t, $1_gconf_home_t, dir) manage_dirs_pattern($1_gconfd_t,$1_gconf_tmp_t,$1_gconf_tmp_t) manage_files_pattern($1_gconfd_t,$1_gconf_tmp_t,$1_gconf_tmp_t) userdom_user_tmp_filetrans($1,$1_gconfd_t,$1_gconf_tmp_t,{ dir file }) domain_auto_trans($2, gconfd_exec_t, $1_gconfd_t) allow $1_gconfd_t $2:fd use; allow $1_gconfd_t $2:fifo_file write; allow $1_gconfd_t $2:unix_stream_socket connectto; allow $1_gconfd_t gconf_etc_t:dir list_dir_perms; read_files_pattern($1_gconfd_t,gconf_etc_t,gconf_etc_t) ps_process_pattern($2,$1_gconfd_t) dev_read_urand($1_gconfd_t) files_read_etc_files($1_gconfd_t) libs_use_ld_so($1_gconfd_t) libs_use_shared_libs($1_gconfd_t) miscfiles_read_localization($1_gconfd_t) logging_send_syslog_msg($1_gconfd_t) userdom_manage_user_tmp_sockets($1, $1_gconfd_t) userdom_manage_user_tmp_dirs($1,$1_gconfd_t) userdom_tmp_filetrans_user_tmp($1,$1_gconfd_t,dir) gnome_stream_connect_gconf_template($1,$2) optional_policy(` nscd_dontaudit_search_pid($1_gconfd_t) ') optional_policy(` xserver_use_xdm_fds($1_gconfd_t) xserver_rw_xdm_pipes($1_gconfd_t) ') ') ######################################## ## ## gconf connection template. ## ## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## # template(`gnome_stream_connect_gconf_template',` gen_require(` type $1_gconfd_t; type $1_gconf_tmp_t; ') read_files_pattern($2,$1_gconf_tmp_t,$1_gconf_tmp_t) allow $2 $1_gconfd_t:unix_stream_socket connectto; ') ######################################## ## ## Run gconfd in the role-specific gconfd domain. ## ## ##

## Run gconfd in the role-specfic gconfd domain. ##

##

## This is a templated interface, and should only ## be called from a per-userdomain template. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## # template(`gnome_domtrans_user_gconf',` gen_require(` type $1_gconfd_t, gconfd_exec_t; ') domtrans_pattern($2,gconfd_exec_t,$1_gconfd_t) ') ######################################## ## ## manage gnome homedir content (.config) ## ## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## # template(`gnome_manage_user_gnome_config',` gen_require(` type $1_gnome_home_t; ') allow $2 $1_gnome_home_t:dir manage_dir_perms; allow $2 $1_gnome_home_t:file manage_file_perms; ')