From: jason@perfinion.com (Jason Zaman)
Date: Thu,  2 Jun 2016 00:08:55 +0800
Subject: [refpolicy] [PATCH 3/4] userdomain: user_tmp requires searching
	/run/user
In-Reply-To: <1464797336-5363-1-git-send-email-jason@perfinion.com>
References: <1464797336-5363-1-git-send-email-jason@perfinion.com>
Message-ID: <1464797336-5363-3-git-send-email-jason@perfinion.com>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

---
 policy/modules/system/userdomain.if | 51 +++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index d604147..7910984 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -318,6 +318,7 @@ interface(`userdom_exec_user_tmp_files',`
 
 	exec_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 #######################################
@@ -2327,6 +2328,7 @@ interface(`userdom_write_user_tmp_sockets',`
 
 	allow $1 user_tmp_t:sock_file write_sock_file_perms;
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2345,7 +2347,9 @@ interface(`userdom_list_user_tmp',`
 	')
 
 	allow $1 user_tmp_t:dir list_dir_perms;
+	allow $1 user_runtime_t:dir list_dir_perms;
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2404,6 +2408,7 @@ interface(`userdom_read_user_tmp_files',`
 	read_files_pattern($1, user_tmp_t, user_tmp_t)
 	allow $1 user_tmp_t:dir list_dir_perms;
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2462,6 +2467,7 @@ interface(`userdom_rw_user_tmp_files',`
 	allow $1 user_tmp_t:dir list_dir_perms;
 	rw_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2501,6 +2507,7 @@ interface(`userdom_read_user_tmp_symlinks',`
 	read_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
 	allow $1 user_tmp_t:dir list_dir_perms;
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2521,6 +2528,7 @@ interface(`userdom_manage_user_tmp_dirs',`
 
 	manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2541,6 +2549,7 @@ interface(`userdom_manage_user_tmp_files',`
 
 	manage_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2561,6 +2570,7 @@ interface(`userdom_manage_user_tmp_symlinks',`
 
 	manage_lnk_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2581,6 +2591,7 @@ interface(`userdom_manage_user_tmp_pipes',`
 
 	manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2601,6 +2612,7 @@ interface(`userdom_manage_user_tmp_sockets',`
 
 	manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2637,6 +2649,7 @@ interface(`userdom_user_tmp_filetrans',`
 
 	filetrans_pattern($1, user_tmp_t, $2, $3, $4)
 	files_search_tmp($1)
+	userdom_search_user_runtime($1)
 ')
 
 ########################################
@@ -2691,6 +2704,44 @@ interface(`userdom_read_user_tmpfs_files',`
 
 ########################################
 ## <summary>
+##	Search users runtime directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_runtime',`
+	gen_require(`
+		type user_runtime_t;
+	')
+
+	allow $1 user_runtime_t:dir search_dir_perms;
+	userdom_search_user_runtime_root($1)
+')
+
+########################################
+## <summary>
+##	Search user runtime root directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_search_user_runtime_root',`
+	gen_require(`
+		type user_runtime_root_t;
+	')
+
+	allow $1 user_runtime_root_t:dir search_dir_perms;
+	files_search_pids($1)
+')
+
+########################################
+## <summary>
 ##	Read and write user tmpfs files.
 ## </summary>
 ## <param name="domain">
-- 
2.7.3