This patch curbs on userdomain file read and/or write permissions
for the i18n_input module.
It aims to ensure user data confidentiality.
A boolean has been introduced to revert the previous read/write
behavior.
Signed-off-by: Guido Trentalancia <[email protected]>
---
policy/modules/contrib/i18n_input.te | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- refpolicy-2.20170204-orig/policy/modules/contrib/i18n_input.te 2017-02-04 19:30:41.000000000 +0100
+++ refpolicy-2.20170204/policy/modules/contrib/i18n_input.te 2017-04-19 23:13:57.668201537 +0200
@@ -5,6 +5,15 @@ policy_module(i18n_input, 1.11.0)
# Declarations
#
+## <desc>
+## <p>
+## Determine whether i18n_input can
+## read the user home directories
+## and files.
+## </p>
+## </desc>
+gen_tunable(i18n_input_enable_home_dirs, false)
+
type i18n_input_t;
type i18n_input_exec_t;
init_daemon_domain(i18n_input_t, i18n_input_exec_t)
@@ -79,7 +88,10 @@ logging_send_syslog_msg(i18n_input_t)
miscfiles_read_localization(i18n_input_t)
userdom_dontaudit_use_unpriv_user_fds(i18n_input_t)
-userdom_read_user_home_content_files(i18n_input_t)
+
+tunable_policy(`i18n_input_enable_home_dirs',`
+ userdom_read_user_home_content_files(i18n_input_t)
+')
tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(i18n_input_t)