RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

userdomain: user_tmp requires searching /run/user

This commit is contained in:
Jason Zaman 2016-06-02 00:08:55 +08:00 committed by Chris PeBenito
parent 0f43a7b826
commit cff5a53cde
1 changed files with 51 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
policy/modules/system/userdomain.if
View File

@ -318,6 +318,7 @@ interface(`userdom_exec_user_tmp_files',`
exec_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
#######################################
@ -2327,6 +2328,7 @@ interface(`userdom_write_user_tmp_sockets',`
allow $1 user_tmp_t:sock_file write_sock_file_perms;
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2345,7 +2347,9 @@ interface(`userdom_list_user_tmp',`
')
allow $1 user_tmp_t:dir list_dir_perms;
allow $1 user_runtime_t:dir list_dir_perms;
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2404,6 +2408,7 @@ interface(`userdom_read_user_tmp_files',`
read_files_pattern($1, user_tmp_t, user_tmp_t)
allow $1 user_tmp_t:dir list_dir_perms;
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2462,6 +2467,7 @@ interface(`userdom_rw_user_tmp_files',`
allow $1 user_tmp_t:dir list_dir_perms;
rw_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2501,6 +2507,7 @@ interface(`userdom_read_user_tmp_symlinks',`
read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
allow $1 user_tmp_t:dir list_dir_perms;
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2521,6 +2528,7 @@ interface(`userdom_manage_user_tmp_dirs',`
manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2541,6 +2549,7 @@ interface(`userdom_manage_user_tmp_files',`
manage_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2561,6 +2570,7 @@ interface(`userdom_manage_user_tmp_symlinks',`
manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2581,6 +2591,7 @@ interface(`userdom_manage_user_tmp_pipes',`
manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2601,6 +2612,7 @@ interface(`userdom_manage_user_tmp_sockets',`
manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2637,6 +2649,7 @@ interface(`userdom_user_tmp_filetrans',`
filetrans_pattern($1, user_tmp_t, $2, $3, $4)
files_search_tmp($1)
userdom_search_user_runtime($1)
')
########################################
@ -2689,6 +2702,44 @@ interface(`userdom_read_user_tmpfs_files',`
fs_search_tmpfs($1)
')
########################################
## <summary>
## Search users runtime directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`userdom_search_user_runtime',`
gen_require(`
type user_runtime_t;
')
allow $1 user_runtime_t:dir search_dir_perms;
userdom_search_user_runtime_root($1)
')
########################################
## <summary>
## Search user runtime root directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`userdom_search_user_runtime_root',`
gen_require(`
type user_runtime_root_t;
')
allow $1 user_runtime_root_t:dir search_dir_perms;
files_search_pids($1)
')
########################################
## <summary>
## Read and write user tmpfs files.