From: guido@trentalancia.net (Guido Trentalancia) Date: Thu, 20 Apr 2017 03:01:16 +0200 Subject: [refpolicy] [PATCH 11/33] i18n_input: curb on userdom permissions Message-ID: <1492650076.14733.81.camel@trentalancia.net> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This patch curbs on userdomain file read and/or write permissions for the i18n_input module. It aims to ensure user data confidentiality. A boolean has been introduced to revert the previous read/write behavior. Signed-off-by: Guido Trentalancia --- policy/modules/contrib/i18n_input.te | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) --- refpolicy-2.20170204-orig/policy/modules/contrib/i18n_input.te 2017-02-04 19:30:41.000000000 +0100 +++ refpolicy-2.20170204/policy/modules/contrib/i18n_input.te 2017-04-19 23:13:57.668201537 +0200 @@ -5,6 +5,15 @@ policy_module(i18n_input, 1.11.0) # Declarations # +## +##

+## Determine whether i18n_input can +## read the user home directories +## and files. +##

+## +gen_tunable(i18n_input_enable_home_dirs, false) + type i18n_input_t; type i18n_input_exec_t; init_daemon_domain(i18n_input_t, i18n_input_exec_t) @@ -79,7 +88,10 @@ logging_send_syslog_msg(i18n_input_t) miscfiles_read_localization(i18n_input_t) userdom_dontaudit_use_unpriv_user_fds(i18n_input_t) -userdom_read_user_home_content_files(i18n_input_t) + +tunable_policy(`i18n_input_enable_home_dirs',` + userdom_read_user_home_content_files(i18n_input_t) +') tunable_policy(`use_nfs_home_dirs',` fs_read_nfs_files(i18n_input_t)