## <summary>User-based access control policy</summary>

## <required val="true">

##	Contains attributes used in UBAC policy.

## </required>

########################################

## <summary>

##	Constrain by user-based access control (UBAC).

## </summary>

## <desc>

##	

##	Constrain the specified type by user-based

##	access control (UBAC).  Typically, these are

##	user processes or user files that need to be

##	differentiated by SELinux user.  Normally this

##	does not include administrative or privileged

##	programs. For the UBAC rules to be enforced,

##	both the subject (source) type and the object

##	(target) types must be UBAC constrained.

##	

## </desc>

## <param name="type">

##	<summary>

##	Type to be constrained by UBAC.

##	</summary>

## </param>

## <infoflow type="none"/>

#

interface(`ubac_constrained',`

	gen_require(`

		attribute ubac_constrained_type;

	')

	typeattribute $1 ubac_constrained_type;

')

########################################

## <summary>

##	Exempt user-based access control for files.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_file_exempt',`

	gen_require(`

		attribute ubacfile;

	')

	typeattribute $1 ubacfile;

')

########################################

## <summary>

##	Exempt user-based access control for processes.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_process_exempt',`

	gen_require(`

		attribute ubacproc;

	')

	typeattribute $1 ubacproc;

')

########################################

## <summary>

##	Exempt user-based access control for file descriptors.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_fd_exempt',`

	gen_require(`

		attribute ubacfd;

	')

	typeattribute $1 ubacfd;

')

########################################

## <summary>

##	Exempt user-based access control for sockets.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_socket_exempt',`

	gen_require(`

		attribute ubacsock;

	')

	typeattribute $1 ubacsock;

')

########################################

## <summary>

##	Exempt user-based access control for SysV IPC.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_sysvipc_exempt',`

	gen_require(`

		attribute ubacipc;

	')

	typeattribute $1 ubacipc;

')

########################################

## <summary>

##	Exempt user-based access control for X Windows.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_xwin_exempt',`

	gen_require(`

		attribute ubacxwin;

	')

	typeattribute $1 ubacxwin;

')

########################################

## <summary>

##	Exempt user-based access control for dbus.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_dbus_exempt',`

	gen_require(`

		attribute ubacdbus;

	')

	typeattribute $1 ubacdbus;

')

########################################

## <summary>

##	Exempt user-based access control for keys.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_key_exempt',`

	gen_require(`

		attribute ubackey;

	')

	typeattribute $1 ubackey;

')

########################################

## <summary>

##	Exempt user-based access control for databases.

## </summary>

## <param name="domain">

##	<summary>

##	Domain to be exempted.

##	</summary>

## </param>

#

interface(`ubac_db_exempt',`

	gen_require(`

		attribute ubacdb;

	')

	typeattribute $1 ubacdb;

')