From bf806fd5891129a32fd7abc59205524f884efcae Mon Sep 17 00:00:00 2001
From: Guido Trentalancia <guido@trentalancia.com>
Date: Thu, 19 Mar 2020 05:50:42 +0100
Subject: [PATCH] userdomain: add watch perms

Signed-off-by: Guido Trentalancia <guido@trentalancia.com>
--
 policy/modules/system/miscfiles.if  |   19 +++++++++++++++++++
 policy/modules/system/userdomain.if |    6 ++++++
 2 files changed, 25 insertions(+)
---
 policy/modules/system/miscfiles.if  | 19 +++++++++++++++++++
 policy/modules/system/userdomain.if |  6 ++++++
 2 files changed, 25 insertions(+)

diff --git a/policy/modules/system/miscfiles.if b/policy/modules/system/miscfiles.if
index 833862acf..51e51e6c3 100644
--- a/policy/modules/system/miscfiles.if
+++ b/policy/modules/system/miscfiles.if
@@ -367,6 +367,25 @@ interface(`miscfiles_manage_fonts',`
 	manage_lnk_files_pattern($1, fonts_t, fonts_t)
 ')
 
+########################################
+## <summary>
+##	Watch fonts directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`miscfiles_watch_fonts_dirs',`
+	gen_require(`
+		type fonts_t;
+	')
+
+	allow $1 fonts_t:dir watch;
+')
+
 ########################################
 ## <summary>
 ##	Set the attributes on a fonts cache directory.
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 3ef0f7d6a..e4a592116 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -92,8 +92,11 @@ template(`userdom_base_user_template',`
 	domain_dontaudit_getsession_all_domains($1_t)
 
 	files_read_etc_files($1_t)
+	files_watch_etc_dirs($1_t)
 	files_read_etc_runtime_files($1_t)
 	files_read_usr_files($1_t)
+	files_watch_usr_dirs($1_t)
+	files_watch_runtime_dirs($1_t)
 	# Read directories and files with the readable_t type.
 	# This type is a general type for "world"-readable files.
 	files_list_world_readable($1_t)
@@ -112,6 +115,7 @@ template(`userdom_base_user_template',`
 
 	miscfiles_read_localization($1_t)
 	miscfiles_read_generic_certs($1_t)
+	miscfiles_watch_fonts_dirs($1_t)
 
 	sysnet_read_config($1_t)
 
@@ -364,6 +368,8 @@ interface(`userdom_manage_home_role',`
 	# cjp: this should probably be removed:
 	allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };
 
+	allow $2 user_home_dir_t:dir watch;
+
 	userdom_manage_user_certs($2)
 	userdom_user_home_dir_filetrans($2, user_cert_t, dir, ".pki")