## Miscellaneous files. ######################################## ## ## Make the specified type usable as a cert file. ## ## ##

## Make the specified type usable for cert files. ## This will also make the type usable for files, making ## calls to files_type() redundant. Failure to use this interface ## for a temporary file may result in problems with ## cert management tools. ##

##

## Related interfaces: ##

## ##

## Example: ##

##

## type mycertfile_t; ## cert_type(mycertfile_t) ## allow mydomain_t mycertfile_t:file read_file_perms; ## files_search_etc(mydomain_t) ##

##
## ## ## Type to be used for files. ## ## ## # interface(`miscfiles_cert_type',` gen_require(` attribute cert_type; ') typeattribute $1 cert_type; files_type($1) ') ######################################## ## ## Make the specified type usable ## as a SSL/TLS private key file. ## ## ##

## Make the specified type usable for SSL/TLS private key files. ## This will also make the type usable for files, making ## calls to files_type() redundant. Failure to use this interface ## for a temporary file may result in problems with ## SSL/TLS private key management tools. ##

##

## Related interfaces: ##

## ##

## Example: ##

##

## type mytlsprivkeyfile_t; ## tls_privkey_type(mytlsprivkeyfile_t) ## allow mydomain_t mytlsprivkeyfile_t:file read_file_perms; ## files_search_etc(mydomain_t) ##

##
## ## ## Type to be used for files. ## ## ## # interface(`miscfiles_tls_privkey_type',` gen_require(` attribute tls_privkey_type; ') typeattribute $1 tls_privkey_type; files_type($1) ') ######################################## ## ## Read all SSL/TLS certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_all_certs',` gen_require(` attribute cert_type; ') allow $1 cert_type:dir list_dir_perms; read_files_pattern($1, cert_type, cert_type) read_lnk_files_pattern($1, cert_type, cert_type) ') ######################################## ## ## Read generic SSL/TLS certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_generic_certs',` gen_require(` type cert_t; ') allow $1 cert_t:dir list_dir_perms; read_files_pattern($1, cert_t, cert_t) read_lnk_files_pattern($1, cert_t, cert_t) ') ######################################## ## ## Do not audit attempts to read generic SSL/TLS certificates. ## ## ## ## Domain to not audit. ## ## ## # interface(`miscfiles_dontaudit_read_generic_certs',` gen_require(` type cert_t; ') dontaudit $1 cert_t:dir list_dir_perms; dontaudit $1 cert_t:file read_file_perms; dontaudit $1 cert_t:lnk_file read_lnk_file_perms; ') ######################################## ## ## Manage generic SSL/TLS certificates. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_manage_generic_cert_dirs',` gen_require(` type cert_t; ') manage_dirs_pattern($1, cert_t, cert_t) ') ######################################## ## ## Manage generic SSL/TLS certificates. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_generic_cert_files',` gen_require(` type cert_t; ') manage_files_pattern($1, cert_t, cert_t) read_lnk_files_pattern($1, cert_t, cert_t) ') ######################################## ## ## Read generic SSL/TLS private ## keys. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_generic_tls_privkey',` gen_require(` type tls_privkey_t; ') allow $1 tls_privkey_t:dir list_dir_perms; read_files_pattern($1, tls_privkey_t, tls_privkey_t) read_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t) ') ######################################## ## ## Manage generic SSL/TLS private ## keys. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_manage_generic_tls_privkey_dirs',` gen_require(` type tls_privkey_t; ') manage_dirs_pattern($1, tls_privkey_t, tls_privkey_t) ') ######################################## ## ## Manage generic SSL/TLS private ## keys. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_generic_tls_privkey_files',` gen_require(` type tls_privkey_t; ') manage_files_pattern($1, tls_privkey_t, tls_privkey_t) read_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t) ') ######################################## ## ## Manage generic SSL/TLS private ## keys. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_generic_tls_privkey_symlinks',` gen_require(` type tls_privkey_t; ') manage_lnk_files_pattern($1, tls_privkey_t, tls_privkey_t) ') ######################################## ## ## Read fonts. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_fonts',` gen_require(` type fonts_t, fonts_cache_t; ') # cjp: fonts can be in either of these dirs files_search_usr($1) libs_search_lib($1) allow $1 fonts_t:dir list_dir_perms; read_files_pattern($1, fonts_t, fonts_t) allow $1 fonts_t:file map; read_lnk_files_pattern($1, fonts_t, fonts_t) allow $1 fonts_cache_t:dir list_dir_perms; read_files_pattern($1, fonts_cache_t, fonts_cache_t) allow $1 fonts_cache_t:file map; read_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t) ') ######################################## ## ## Set the attributes on a fonts directory. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_setattr_fonts_dirs',` gen_require(` type fonts_t; ') allow $1 fonts_t:dir setattr; ') ######################################## ## ## Do not audit attempts to set the attributes ## on a fonts directory. ## ## ## ## Domain to not audit. ## ## ## # interface(`miscfiles_dontaudit_setattr_fonts_dirs',` gen_require(` type fonts_t; ') dontaudit $1 fonts_t:dir setattr; ') ######################################## ## ## Do not audit attempts to write fonts. ## ## ## ## Domain to not audit. ## ## ## # interface(`miscfiles_dontaudit_write_fonts',` gen_require(` type fonts_t; ') dontaudit $1 fonts_t:dir { write setattr }; dontaudit $1 fonts_t:file write; ') ######################################## ## ## Create, read, write, and delete fonts. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_fonts',` gen_require(` type fonts_t; ') # cjp: fonts can be in either of these dirs files_search_usr($1) libs_search_lib($1) manage_dirs_pattern($1, fonts_t, fonts_t) manage_files_pattern($1, fonts_t, fonts_t) manage_lnk_files_pattern($1, fonts_t, fonts_t) ') ######################################## ## ## Watch fonts directories. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_watch_fonts_dirs',` gen_require(` type fonts_t; ') allow $1 fonts_t:dir watch; ') ######################################## ## ## Set the attributes on a fonts cache directory. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_setattr_fonts_cache_dirs',` gen_require(` type fonts_cache_t; ') allow $1 fonts_cache_t:dir setattr; ') ######################################## ## ## Do not audit attempts to set the attributes ## on a fonts cache directory. ## ## ## ## Domain to not audit. ## ## # interface(`miscfiles_dontaudit_setattr_fonts_cache_dirs',` gen_require(` type fonts_cache_t; ') dontaudit $1 fonts_cache_t:dir setattr; ') ######################################## ## ## Create, read, write, and delete fonts cache. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_fonts_cache',` gen_require(` type fonts_cache_t; ') files_search_var($1) manage_dirs_pattern($1, fonts_cache_t, fonts_cache_t) manage_files_pattern($1, fonts_cache_t, fonts_cache_t) manage_lnk_files_pattern($1, fonts_cache_t, fonts_cache_t) ') ######################################## ## ## Read hardware identification data. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_hwdata',` gen_require(` type hwdata_t; ') allow $1 hwdata_t:dir list_dir_perms; read_files_pattern($1, hwdata_t, hwdata_t) read_lnk_files_pattern($1, hwdata_t, hwdata_t) ') ######################################## ## ## Allow process to setattr localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_setattr_localization',` gen_require(` type locale_t; ') files_search_usr($1) allow $1 locale_t:dir list_dir_perms; allow $1 locale_t:file setattr; ') ######################################## ## ## Allow process to read localization information. ## ## ##

## Allow the specified domain to read the localization files. ## This is typically for time zone configuration files, such as ## /etc/localtime and files in /usr/share/zoneinfo. ## Typically, any domain which needs to know the GMT/UTC ## offset of the current timezone will need access ## to these files. Generally, it should be safe for any ## domain to read these files. ##

##
## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_localization',` gen_require(` type locale_t; ') files_read_etc_symlinks($1) files_search_usr($1) allow $1 locale_t:dir list_dir_perms; read_files_pattern($1, locale_t, locale_t) read_lnk_files_pattern($1, locale_t, locale_t) allow $1 locale_t:file map; ') ######################################## ## ## Allow process to write localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_rw_localization',` gen_require(` type locale_t; ') files_search_usr($1) allow $1 locale_t:dir list_dir_perms; rw_files_pattern($1, locale_t, locale_t) ') ######################################## ## ## Allow process to relabel localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_relabel_localization',` gen_require(` type locale_t; ') files_search_usr($1) relabel_files_pattern($1, locale_t, locale_t) ') ######################################## ## ## Allow process to read legacy time localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_legacy_read_localization',` gen_require(` type locale_t; ') miscfiles_read_localization($1) allow $1 locale_t:file execute; ') ######################################## ## ## Watch time localization info ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_watch_localization',` gen_require(` type locale_t; ') allow $1 locale_t:file watch; ') ######################################## ## ## Search man pages. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_search_man_pages',` gen_require(` type man_t, man_cache_t; ') allow $1 { man_cache_t man_t }:dir search_dir_perms; files_search_usr($1) ') ######################################## ## ## Do not audit attempts to search man pages. ## ## ## ## Domain to not audit. ## ## # interface(`miscfiles_dontaudit_search_man_pages',` gen_require(` type man_t, man_cache_t; ') dontaudit $1 { man_cache_t man_t }:dir search_dir_perms; ') ######################################## ## ## Read man pages ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_man_pages',` gen_require(` type man_t, man_cache_t; ') files_search_usr($1) allow $1 { man_cache_t man_t }:dir list_dir_perms; read_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) read_lnk_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) ') ######################################## ## ## Delete man pages ## ## ## ## Domain allowed access. ## ## # cjp: added for tmpreaper # interface(`miscfiles_delete_man_pages',` gen_require(` type man_t, man_cache_t; ') files_search_usr($1) allow $1 { man_cache_t man_t }:dir { setattr_dir_perms list_dir_perms }; delete_dirs_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) delete_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) delete_lnk_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) ') ######################################## ## ## Create, read, write, and delete man pages ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_manage_man_pages',` gen_require(` type man_t, man_cache_t; ') files_search_usr($1) manage_dirs_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) manage_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) read_lnk_files_pattern($1, { man_cache_t man_t }, { man_cache_t man_t }) ') ######################################## ## ## Read man cache content. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_man_cache',` gen_require(` type man_cache_t; ') files_search_var($1) allow $1 man_cache_t:dir list_dir_perms; allow $1 man_cache_t:file read_file_perms; allow $1 man_cache_t:lnk_file read_lnk_file_perms; ') ######################################## ## ## Map man cache content. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_map_man_cache',` gen_require(` type man_cache_t; ') allow $1 man_cache_t:file map; ') ######################################## ## ## Create, read, write, and delete ## man cache content. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_manage_man_cache',` gen_require(` type man_cache_t; ') files_search_var($1) allow $1 man_cache_t:dir manage_dir_perms; allow $1 man_cache_t:file manage_file_perms; allow $1 man_cache_t:lnk_file manage_lnk_file_perms; ') ######################################## ## ## Relabel from and to man cache. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_relabel_man_cache',` gen_require(` type man_cache_t; ') relabel_dirs_pattern($1, man_cache_t, man_cache_t) relabel_files_pattern($1, man_cache_t, man_cache_t) ') ######################################## ## ## Read public files used for file ## transfer services. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_read_public_files',` gen_require(` type public_content_t, public_content_rw_t; ') allow $1 { public_content_t public_content_rw_t }:dir list_dir_perms; read_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t }) read_lnk_files_pattern($1, { public_content_t public_content_rw_t }, { public_content_t public_content_rw_t }) ') ######################################## ## ## Create, read, write, and delete public files ## and directories used for file transfer services. ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_public_files',` gen_require(` type public_content_rw_t; ') manage_dirs_pattern($1, public_content_rw_t, public_content_rw_t) manage_files_pattern($1, public_content_rw_t, public_content_rw_t) manage_lnk_files_pattern($1, public_content_rw_t, public_content_rw_t) ') ######################################## ## ## Watch public files ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_watch_public_dirs',` gen_require(` type public_content_rw_t; ') allow $1 public_content_rw_t:dir watch; ') ######################################## ## ## Read TeX data ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_tetex_data',` gen_require(` type tetex_data_t; ') files_search_var($1) files_search_var_lib($1) # cjp: TeX data can be in either of the above dirs allow $1 tetex_data_t:dir list_dir_perms; read_files_pattern($1, tetex_data_t, tetex_data_t) read_lnk_files_pattern($1, tetex_data_t, tetex_data_t) ') ######################################## ## ## Execute TeX data programs in the caller domain. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_exec_tetex_data',` gen_require(` type tetex_data_t; ') files_search_var($1) files_search_var_lib($1) # cjp: TeX data can be in either of the above dirs allow $1 tetex_data_t:dir list_dir_perms; exec_files_pattern($1, tetex_data_t, tetex_data_t) ') ######################################## ## ## Let test files be an entry point for ## a specified domain. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_domain_entry_test_files',` gen_require(` type test_file_t; ') domain_entry_file($1, test_file_t) ') ######################################## ## ## Read test files and directories. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_read_test_files',` gen_require(` type test_file_t; ') read_files_pattern($1, test_file_t, test_file_t) read_lnk_files_pattern($1, test_file_t, test_file_t) ') ######################################## ## ## Execute test files. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_exec_test_files',` gen_require(` type test_file_t; ') exec_files_pattern($1, test_file_t, test_file_t) read_lnk_files_pattern($1, test_file_t, test_file_t) ') ######################################## ## ## Create files in etc directories ## with localization file type. ## ## ## ## Domain allowed access. ## ## # interface(`miscfiles_etc_filetrans_localization',` gen_require(` type locale_t; ') files_etc_filetrans($1, locale_t, file) ') ######################################## ## ## Create, read, write, and delete localization ## ## ## ## Domain allowed access. ## ## ## # interface(`miscfiles_manage_localization',` gen_require(` type locale_t; ') manage_dirs_pattern($1, locale_t, locale_t) manage_files_pattern($1, locale_t, locale_t) manage_lnk_files_pattern($1, locale_t, locale_t) ')