From: jason@perfinion.com (Jason Zaman) Date: Sat, 28 May 2016 04:35:25 +0800 Subject: [refpolicy] [PATCH v3 3/4] userdomain: user_tmp requires searching /run/user In-Reply-To: <1464381326-24198-1-git-send-email-jason@perfinion.com> References: <1464381326-24198-1-git-send-email-jason@perfinion.com> Message-ID: <1464381326-24198-3-git-send-email-jason@perfinion.com> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com --- policy/modules/system/userdomain.if | 51 +++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if index d604147..2528ee3 100644 --- a/policy/modules/system/userdomain.if +++ b/policy/modules/system/userdomain.if @@ -318,6 +318,7 @@ interface(`userdom_exec_user_tmp_files',` exec_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ####################################### @@ -2327,6 +2328,7 @@ interface(`userdom_write_user_tmp_sockets',` allow $1 user_tmp_t:sock_file write_sock_file_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2345,7 +2347,9 @@ interface(`userdom_list_user_tmp',` ') allow $1 user_tmp_t:dir list_dir_perms; + allow $1 user_runtime_dir_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2404,6 +2408,7 @@ interface(`userdom_read_user_tmp_files',` read_files_pattern($1, user_tmp_t, user_tmp_t) allow $1 user_tmp_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2462,6 +2467,7 @@ interface(`userdom_rw_user_tmp_files',` allow $1 user_tmp_t:dir list_dir_perms; rw_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2501,6 +2507,7 @@ interface(`userdom_read_user_tmp_symlinks',` read_lnk_files_pattern($1, user_tmp_t, user_tmp_t) allow $1 user_tmp_t:dir list_dir_perms; files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2521,6 +2528,7 @@ interface(`userdom_manage_user_tmp_dirs',` manage_dirs_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2541,6 +2549,7 @@ interface(`userdom_manage_user_tmp_files',` manage_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2561,6 +2570,7 @@ interface(`userdom_manage_user_tmp_symlinks',` manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2581,6 +2591,7 @@ interface(`userdom_manage_user_tmp_pipes',` manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2601,6 +2612,7 @@ interface(`userdom_manage_user_tmp_sockets',` manage_sock_files_pattern($1, user_tmp_t, user_tmp_t) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2637,6 +2649,7 @@ interface(`userdom_user_tmp_filetrans',` filetrans_pattern($1, user_tmp_t, $2, $3, $4) files_search_tmp($1) + userdom_search_user_runtime($1) ') ######################################## @@ -2691,6 +2704,44 @@ interface(`userdom_read_user_tmpfs_files',` ######################################## ## +## Search users runtime directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_search_user_runtime',` + gen_require(` + type user_runtime_dir_t; + ') + + allow $1 user_runtime_dir_t:dir search_dir_perms; + userdom_search_user_runtime_root_dirs($1) +') + +######################################## +## +## Search user runtime root directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`userdom_search_user_runtime_root_dirs',` + gen_require(` + type user_runtime_root_t; + ') + + allow $1 user_runtime_root_t:dir search_dir_perms; + files_search_pids($1) +') + +######################################## +## ## Read and write user tmpfs files. ## ## -- 2.7.3