diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index b487fd42f..49ac3fd9c 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -1582,6 +1582,24 @@ interface(`userdom_manage_user_home_content_dirs',` files_search_home($1) ') +######################################## +## +## Delete directories in a user home subdirectory. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_delete_user_home_content_dirs',` + gen_require(` + type user_home_t; + ') + + allow $1 user_home_t:dir delete_dir_perms; +') + ######################################## ## ## Do not audit attempts to set the @@ -1694,6 +1712,24 @@ interface(`userdom_dontaudit_write_user_home_content_files',` dontaudit $1 user_home_t:file write; ') +######################################## +## +## Delete files in a user home subdirectory. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_delete_user_home_content_files',` + gen_require(` + type user_home_t; + ') + + allow $1 user_home_t:file delete_file_perms; +') + ######################################## ## ## Do not audit attempts to write user home files. @@ -1838,6 +1874,24 @@ interface(`userdom_manage_user_home_content_symlinks',` files_search_home($1) ') +######################################## +## +## Delete symbolic links in a user home directory. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_delete_user_home_content_symlinks',` + gen_require(` + type user_home_t; + ') + + allow $1 user_home_t:lnk_file delete_lnk_file_perms; +') + ######################################## ## ## Create, read, write, and delete named pipes