841 lines
16 KiB
Text
841 lines
16 KiB
Text
## <summary>Unconfined user role</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Change from the unconfineduser role.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Change from the unconfineduser role to
|
|
## the specified role.
|
|
## </p>
|
|
## <p>
|
|
## This is an interface to support third party modules
|
|
## and its use is not allowed in upstream reference
|
|
## policy.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`unconfined_role_change_to',`
|
|
gen_require(`
|
|
role unconfined_r;
|
|
')
|
|
|
|
allow unconfined_r $1;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Transition to the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_domtrans',`
|
|
gen_require(`
|
|
type unconfined_t, unconfined_exec_t;
|
|
')
|
|
|
|
domtrans_pattern($1,unconfined_exec_t,unconfined_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute specified programs in the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## The type of the process performing this action.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to allow the unconfined domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_run',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
unconfined_domtrans($1)
|
|
role $2 types unconfined_t;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Transition to the unconfined domain by executing a shell.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_shell_domtrans',`
|
|
gen_require(`
|
|
attribute unconfined_login_domain;
|
|
')
|
|
typeattribute $1 unconfined_login_domain;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute an Xserver session in unconfined domain. This
|
|
## is an explicit transition, requiring the
|
|
## caller to use setexeccon().
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_xsession_spec_domtrans',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
xserver_xsession_spec_domtrans($1, unconfined_t)
|
|
allow unconfined_t $1:fd use;
|
|
allow unconfined_t $1:fifo_file rw_file_perms;
|
|
allow unconfined_t $1:process sigchld;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow unconfined to execute the specified program in
|
|
## the specified domain.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Allow unconfined to execute the specified program in
|
|
## the specified domain.
|
|
## </p>
|
|
## <p>
|
|
## This is a interface to support third party modules
|
|
## and its use is not allowed in upstream reference
|
|
## policy.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to execute in.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="entry_file">
|
|
## <summary>
|
|
## Domain entry point file.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_domtrans_to',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
domtrans_pattern(unconfined_t,$2,$1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow unconfined to execute the specified program in
|
|
## the specified domain. Allow the specified domain the
|
|
## unconfined role and use of unconfined user terminals.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Allow unconfined to execute the specified program in
|
|
## the specified domain. Allow the specified domain the
|
|
## unconfined role and use of unconfined user terminals.
|
|
## </p>
|
|
## <p>
|
|
## This is a interface to support third party modules
|
|
## and its use is not allowed in upstream reference
|
|
## policy.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to execute in.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="entry_file">
|
|
## <summary>
|
|
## Domain entry point file.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_run_to',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
role unconfined_r;
|
|
')
|
|
|
|
domtrans_pattern(unconfined_t,$2,$1)
|
|
role unconfined_r types $1;
|
|
userdom_use_user_terminals($1)
|
|
')
|
|
|
|
######################################
|
|
## <summary>
|
|
## Stub unconfined role.
|
|
## </summary>
|
|
## <param name="domain_prefix">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_stub_role',`
|
|
gen_require(`
|
|
role unconfined_r;
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Inherit file descriptors from the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_use_fds',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:fd use;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a SIGCHLD signal to the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_sigchld',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process sigchld;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a SIGNULL signal to the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_signull',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process signull;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send generic signals to the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_signal',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process signal;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read unconfined domain unnamed pipes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_read_pipes',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:fifo_file read_fifo_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read unconfined domain unnamed pipes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_read_pipes',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:fifo_file read;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write unconfined domain unnamed pipes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_rw_pipes',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:fifo_file rw_fifo_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read and write
|
|
## unconfined domain unnamed pipes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_rw_pipes',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:fifo_file rw_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read and write
|
|
## unconfined domain stream.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_rw_stream',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:unix_stream_socket rw_socket_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to the unconfined domain using
|
|
## a unix domain stream socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_stream_connect',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:unix_stream_socket connectto;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read or write
|
|
## unconfined domain tcp sockets.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Do not audit attempts to read or write
|
|
## unconfined domain tcp sockets.
|
|
## </p>
|
|
## <p>
|
|
## This interface was added due to a broken
|
|
## symptom in ldconfig.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_rw_tcp_sockets',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:tcp_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Do not audit attempts to read or write
|
|
## unconfined domain packet sockets.
|
|
## </summary>
|
|
## <desc>
|
|
## <p>
|
|
## Do not audit attempts to read or write
|
|
## unconfined domain packet sockets.
|
|
## </p>
|
|
## <p>
|
|
## This interface was added due to a broken
|
|
## symptom.
|
|
## </p>
|
|
## </desc>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to not audit.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_rw_packet_sockets',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:packet_socket { read write };
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create keys for the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_create_keys',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:key create;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Dontaudit write process information for unconfined process.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_write_state',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:file write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Dontaudit read process information for unconfined process.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dontaudit_read_state',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
dontaudit $1 unconfined_t:dir list_dir_perms;
|
|
dontaudit $1 unconfined_t:file read_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Write keys for the unconfined domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_write_keys',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:key write;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send messages to the unconfined domain over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dbus_send',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 unconfined_t:dbus send_msg;
|
|
allow unconfined_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Create communication channel with unconfined domain over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dbus_acquire_svc',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
class dbus acquire_svc;
|
|
')
|
|
|
|
allow $1 unconfined_t:dbus acquire_svc;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send and receive messages from
|
|
## unconfined_t over dbus.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dbus_chat',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
class dbus send_msg;
|
|
')
|
|
|
|
allow $1 unconfined_t:dbus send_msg;
|
|
allow unconfined_t $1:dbus send_msg;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Connect to the the unconfined DBUS
|
|
## for service (acquire_svc).
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dbus_connect',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
class dbus acquire_svc;
|
|
')
|
|
|
|
allow $1 unconfined_t:dbus acquire_svc;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow ptrace of unconfined domain
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_ptrace',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process ptrace;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write to unconfined shared memory.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## The type of the process performing this action.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_rw_shm',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:shm rw_shm_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow apps to set rlimits on unconfined user
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_set_rlimitnh',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process rlimitinh;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow apps to setsched on unconfined user
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_setsched',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process setsched;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Get the process group of unconfined.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_getpgid',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:process getpgid;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Change to the unconfined role.
|
|
## </summary>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`unconfined_role_change',`
|
|
gen_require(`
|
|
role unconfined_r;
|
|
')
|
|
|
|
allow $1 unconfined_r;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow domain to attach to TUN devices created by unconfined_t users.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_attach_tun_iface',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:tun_socket relabelfrom;
|
|
allow $1 self:tun_socket relabelto;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow domain to transition to unconfined_t user
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="entrypoint">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_transition',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
domtrans_pattern($1,$2,unconfined_t)
|
|
allow unconfined_t $2:file entrypoint;
|
|
allow $1 unconfined_t:process signal_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## unconfined_t domain typebounds calling domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to be typebound.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_typebounds',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
typebounds unconfined_t $1;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## unconfined_exec_t domain typebounds file_type.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## File type to be typebound.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_exec_typebounds',`
|
|
gen_require(`
|
|
type unconfined_exec_t;
|
|
')
|
|
|
|
typebounds unconfined_exec_t $1;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Send a message to unconfined user over a unix domain datagram socket.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_dgram_send',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:unix_dgram_socket sendto;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Destroy unconfined user's message queue entries.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_destroy_msgq',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:msgq destroy;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Destroy unconfined user's SysV shared memory segments.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`unconfined_destroy_shm',`
|
|
gen_require(`
|
|
type unconfined_t;
|
|
')
|
|
|
|
allow $1 unconfined_t:shm destroy;
|
|
')
|