## Generic unprivileged user role ######################################## ## ## Change to the generic user role. ## ## ## ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## ## ## # template(`unprivuser_role_change_template',` userdom_role_change_template($1, user) ') ######################################## ## ## Change from the generic user role. ## ## ##

## Change from the generic user role to ## the specified role. ##

##

## This is a template to support third party modules ## and its use is not allowed in upstream reference ## policy. ##

##
## ## ## The prefix of the user role (e.g., user ## is the prefix for user_r). ## ## ## # template(`unprivuser_role_change_to_template',` userdom_role_change_template(user, $1) ') ######################################## ## ## Create generic user home directories ## with automatic file type transition. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_home_filetrans_home_dir',` gen_require(` type user_home_dir_t; ') files_home_filetrans($1,user_home_dir_t,dir) ') ######################################## ## ## Search generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_search_home_dirs',` gen_require(` type user_home_dir_t; ') allow $1 user_home_dir_t:dir search_dir_perms; ') ######################################## ## ## Create objects in generic user home directories ## with automatic file type transition. ## ## ## ## Domain allowed access. ## ## ## ## ## The class of the object to be created. ## If not specified, file is used. ## ## # interface(`unprivuser_home_dir_filetrans_home_content',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) filetrans_pattern($1,user_home_dir_t,user_home_t,$2) ') ######################################## ## ## Don't audit search on the user home subdirectory. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_dontaudit_search_home_dirs',` gen_require(` type user_home_t; ') dontaudit $1 user_home_t:dir search_dir_perms; ') ######################################## ## ## Create, read, write, and delete generic user ## home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_dirs',` gen_require(` type user_home_dir_t; ') files_search_home($1) allow $1 user_home_dir_t:dir manage_dir_perms; ') ######################################## ## ## Create, read, write, and delete ## subdirectories of generic user ## home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_content_dirs',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) manage_dirs_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') ######################################## ## ## Relabel to generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_relabelto_home_dirs',` gen_require(` type user_home_dir_t; ') files_search_home($1) allow $1 user_home_dir_t:dir relabelto; ') ######################################## ## ## Read files in generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_read_home_content_files',` gen_require(` type user_home_t, user_home_dir_t; ') files_search_home($1) allow $1 user_home_t:dir list_dir_perms; read_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') ######################################## ## ## Mmap of generic user ## home files. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_mmap_home_content_files',` gen_require(` type user_home_t; ') files_search_home($1) allow $1 user_home_t:file execute; ') ######################################## ## ## Create, read, write, and delete files ## in generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_content_files',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) manage_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') ######################################## ## ## Do not audit attempts to relabel generic user ## home files. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_dontaudit_relabel_home_content_files',` gen_require(` type user_home_t; ') dontaudit $1 user_home_t:file { relabelto relabelfrom }; ') ######################################## ## ## Create, read, write, and delete symbolic ## links in generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_content_symlinks',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) manage_lnk_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') ######################################## ## ## Create, read, write, and delete named ## pipes in generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_content_pipes',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) manage_fifo_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ') ######################################## ## ## Create, read, write, and delete named ## sockets in generic user home directories. ## ## ## ## Domain allowed access. ## ## # interface(`unprivuser_manage_home_content_sockets',` gen_require(` type user_home_dir_t, user_home_t; ') files_search_home($1) manage_sock_files_pattern($1,{ user_home_dir_t user_home_t },user_home_t) ')