diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index d60414784..79109846a 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -318,6 +318,7 @@ interface(`userdom_exec_user_tmp_files',` exec_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ####################################### @@ -2327,6 +2328,7 @@ interface(`userdom_write_user_tmp_sockets',` allow $1 user_tmp_t:sock_file write_sock_file_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2345,7 +2347,9 @@ interface(`userdom_list_user_tmp',` ') allow $1 user_tmp_t:dir list_dir_perms; + allow $1 user_runtime_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2404,6 +2408,7 @@ interface(`userdom_read_user_tmp_files',` read_files_pattern($1, user_tmp_t, user_tmp_t) allow $1 user_tmp_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2462,6 +2467,7 @@ interface(`userdom_rw_user_tmp_files',` allow $1 user_tmp_t:dir list_dir_perms; rw_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2501,6 +2507,7 @@ interface(`userdom_read_user_tmp_symlinks',` read_lnk_files_pattern($1, user_tmp_t, user_tmp_t) allow $1 user_tmp_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2521,6 +2528,7 @@ interface(`userdom_manage_user_tmp_dirs',` manage_dirs_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2541,6 +2549,7 @@ interface(`userdom_manage_user_tmp_files',` manage_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2561,6 +2570,7 @@ interface(`userdom_manage_user_tmp_symlinks',` manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2581,6 +2591,7 @@ interface(`userdom_manage_user_tmp_pipes',` manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2601,6 +2612,7 @@ interface(`userdom_manage_user_tmp_sockets',` manage_sock_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2637,6 +2649,7 @@ interface(`userdom_user_tmp_filetrans',` filetrans_pattern($1, user_tmp_t, $2, $3, $4) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2689,6 +2702,44 @@ interface(`userdom_read_user_tmpfs_files',` fs_search_tmpfs($1) ') +######################################## +## +## Search users runtime directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_search_user_runtime',` + gen_require(` + type user_runtime_t; + ') + + allow $1 user_runtime_t:dir search_dir_perms; + userdom_search_user_runtime_root($1) +') + +######################################## +## +## Search user runtime root directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_search_user_runtime_root',` + gen_require(` + type user_runtime_root_t; + ') + + allow $1 user_runtime_root_t:dir search_dir_perms; + files_search_pids($1) +') + ######################################## ## ## Read and write user tmpfs files.