diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.if

--- serefpolicy-3.10.0/policy/modules/admin/usermanage.if.userdomain	2011-10-24 13:26:35.236337023 -0400

+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.if	2011-10-24 13:26:35.756337065 -0400

@@ -308,7 +308,7 @@ interface(`usermanage_run_useradd',`

 	role $2 types useradd_t;

 	# Add/remove user home directories

-	userdom_manage_home_role($2, useradd_t)

+	userdom_manage_home_role($2)

 	seutil_run_semanage(useradd_t, $2)

diff -up serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain serefpolicy-3.10.0/policy/modules/admin/usermanage.te

--- serefpolicy-3.10.0/policy/modules/admin/usermanage.te.userdomain	2011-10-24 13:26:35.711337061 -0400

+++ serefpolicy-3.10.0/policy/modules/admin/usermanage.te	2011-10-24 13:26:35.757337065 -0400

@@ -517,7 +517,7 @@ seutil_domtrans_setfiles(useradd_t)

 userdom_use_unpriv_users_fds(useradd_t)

 # Add/remove user home directories

 userdom_home_filetrans_user_home_dir(useradd_t)

-userdom_manage_home_role(system_r, useradd_t)

+userdom_manage_home(useradd_t)

 mta_manage_spool(useradd_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain serefpolicy-3.10.0/policy/modules/apps/execmem.if

--- serefpolicy-3.10.0/policy/modules/apps/execmem.if.userdomain	2011-10-24 13:26:35.736337064 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/execmem.if	2011-10-24 13:26:35.757337065 -0400

@@ -57,8 +57,6 @@ template(`execmem_role_template',`

 	role $2 types $1_execmem_t;

 	userdom_unpriv_usertype($1, $1_execmem_t)

-	userdom_manage_tmp_role($2, $1_execmem_t)

-	userdom_manage_tmpfs_role($2, $1_execmem_t)

 	allow $1_execmem_t self:process { execmem execstack };

 	allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };

diff -up serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain serefpolicy-3.10.0/policy/modules/apps/java.if

--- serefpolicy-3.10.0/policy/modules/apps/java.if.userdomain	2011-10-24 13:26:35.255337024 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/java.if	2011-10-24 13:26:35.758337065 -0400

@@ -73,7 +73,8 @@ template(`java_role_template',`

 	domain_interactive_fd($1_java_t)

 	userdom_unpriv_usertype($1, $1_java_t)

-	userdom_manage_tmpfs_role($2, $1_java_t)

+	userdom_manage_tmpfs_role($2)

+	userdom_manage_tmpfs($1_java_t)

 	allow $1_java_t self:process { ptrace signal getsched execmem execstack };

diff -up serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mono.if

--- serefpolicy-3.10.0/policy/modules/apps/mono.if.userdomain	2011-10-24 13:26:35.261337025 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/mono.if	2011-10-24 13:26:35.759337065 -0400

@@ -49,7 +49,8 @@ template(`mono_role_template',`

 	corecmd_bin_domtrans($1_mono_t, $1_t)

 	userdom_unpriv_usertype($1, $1_mono_t)

-	userdom_manage_tmpfs_role($2, $1_mono_t)

+	userdom_manage_tmpfs_role($2)

+	userdom_manage_tmpfs($1_mono_t)

 	optional_policy(`

 		xserver_role($1_r, $1_mono_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain serefpolicy-3.10.0/policy/modules/apps/mozilla.if

--- serefpolicy-3.10.0/policy/modules/apps/mozilla.if.userdomain	2011-10-24 13:26:35.262337026 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/mozilla.if	2011-10-24 13:26:35.760337065 -0400

@@ -51,7 +51,7 @@ interface(`mozilla_role',`

 	mozilla_run_plugin(mozilla_t, $1)

 	mozilla_dbus_chat($2)

-	userdom_manage_tmp_role($1, mozilla_t)

+	userdom_manage_tmp_role($1)

 	optional_policy(`

 		nsplugin_role($1, mozilla_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.if

--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.if.userdomain	2011-10-24 13:26:35.267337026 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.if	2011-10-24 13:26:35.762337066 -0400

@@ -103,7 +103,7 @@ ifdef(`hide_broken_symptoms', `

 	userdom_use_inherited_user_terminals(nsplugin_t)

 	userdom_use_inherited_user_terminals(nsplugin_config_t)

 	userdom_dontaudit_setattr_user_home_content_files(nsplugin_t)

-	userdom_manage_tmpfs_role($1, nsplugin_t)

+	userdom_manage_tmpfs_role($1)

 	optional_policy(`

 		pulseaudio_role($1, nsplugin_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain serefpolicy-3.10.0/policy/modules/apps/nsplugin.te

--- serefpolicy-3.10.0/policy/modules/apps/nsplugin.te.userdomain	2011-10-24 13:26:35.267337026 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/nsplugin.te	2011-10-24 13:26:35.763337066 -0400

@@ -281,6 +281,7 @@ userdom_search_user_home_content(nsplugi

 userdom_read_user_home_content_symlinks(nsplugin_config_t)

 userdom_read_user_home_content_files(nsplugin_config_t)

 userdom_dontaudit_search_admin_dir(nsplugin_config_t)

+userdom_manage_tmpfs(nsplugin_t)

 tunable_policy(`use_nfs_home_dirs',`

 	fs_getattr_nfs(nsplugin_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if

--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if.userdomain	2011-10-24 13:26:35.270337026 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.if	2011-10-24 13:26:35.763337066 -0400

@@ -35,9 +35,9 @@ interface(`pulseaudio_role',`

 	allow pulseaudio_t $2:unix_stream_socket connectto;

 	allow $2 pulseaudio_t:unix_stream_socket connectto;

-	userdom_manage_home_role($1, pulseaudio_t)

-	userdom_manage_tmp_role($1, pulseaudio_t)

-	userdom_manage_tmpfs_role($1, pulseaudio_t)

+	userdom_manage_home_role($1)

+	userdom_manage_tmp_role($1)

+	userdom_manage_tmpfs_role($1)

 	allow $2 pulseaudio_t:dbus send_msg;

 	allow pulseaudio_t $2:dbus { acquire_svc send_msg };

diff -up serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te

--- serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te.userdomain	2011-10-24 13:26:35.271337026 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/pulseaudio.te	2011-10-24 13:26:35.764337066 -0400

@@ -95,6 +95,10 @@ logging_send_syslog_msg(pulseaudio_t)

 miscfiles_read_localization(pulseaudio_t)

+userdom_manage_home(pulseaudio_t)

+userdom_manage_tmp(pulseaudio_t)

+userdom_manage_tmpfs(pulseaudio_t)

+

 optional_policy(`

 	alsa_read_rw_config(pulseaudio_t)

 ')

diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.if

--- serefpolicy-3.10.0/policy/modules/apps/userhelper.if.userdomain	2011-10-24 13:26:35.285337027 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.if	2011-10-24 13:26:35.765337066 -0400

@@ -294,7 +294,7 @@ template(`userhelper_console_role_templa

 	auth_use_pam($1_consolehelper_t)

-	userdom_manage_tmpfs_role($2, $1_consolehelper_t)

+	userdom_manage_tmpfs_role($2)

 	optional_policy(`

 		dbus_connect_session_bus($1_consolehelper_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain serefpolicy-3.10.0/policy/modules/apps/userhelper.te

--- serefpolicy-3.10.0/policy/modules/apps/userhelper.te.userdomain	2011-10-24 13:26:35.285337027 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/userhelper.te	2011-10-24 13:26:35.766337066 -0400

@@ -65,6 +65,7 @@ userhelper_exec(consolehelper_domain)

 userdom_use_user_ptys(consolehelper_domain)

 userdom_use_user_ttys(consolehelper_domain)

 userdom_read_user_home_content_files(consolehelper_domain)

+userdom_manage_tmpfs(consolehelper_domain)

 optional_policy(`

 	gnome_read_gconf_home_files(consolehelper_domain)

diff -up serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wine.if

--- serefpolicy-3.10.0/policy/modules/apps/wine.if.userdomain	2011-10-24 13:26:35.289337027 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/wine.if	2011-10-24 13:26:35.766337066 -0400

@@ -105,7 +105,8 @@ template(`wine_role_template',`

 	corecmd_bin_domtrans($1_wine_t, $1_t)

 	userdom_unpriv_usertype($1, $1_wine_t)

-	userdom_manage_tmpfs_role($2, $1_wine_t)

+	userdom_manage_tmpfs_role($2)

+	userdom_manage_tmpfs($1_wine_t)

 	domain_mmap_low($1_wine_t)

diff -up serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain serefpolicy-3.10.0/policy/modules/apps/wm.if

--- serefpolicy-3.10.0/policy/modules/apps/wm.if.userdomain	2011-10-24 13:26:35.291337027 -0400

+++ serefpolicy-3.10.0/policy/modules/apps/wm.if	2011-10-24 13:26:35.767337066 -0400

@@ -77,9 +77,13 @@ template(`wm_role_template',`

 	miscfiles_read_fonts($1_wm_t)

 	miscfiles_read_localization($1_wm_t)

-	userdom_manage_home_role($2, $1_wm_t)

-	userdom_manage_tmpfs_role($2, $1_wm_t)

-	userdom_manage_tmp_role($2, $1_wm_t)

+	userdom_manage_home_role($2)

+	userdom_manage_home($1_wm_t)

+	userdom_manage_tmpfs_role($2)

+	userdom_manage_tmpfs($1_wm_t)

+	userdom_manage_tmp_role($2)

+	userdom_manage_tmp($1_wm_t)

+

 	userdom_exec_user_tmp_files($1_wm_t)

 	optional_policy(`

diff -up serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain serefpolicy-3.10.0/policy/modules/roles/sysadm.te

--- serefpolicy-3.10.0/policy/modules/roles/sysadm.te.userdomain	2011-10-24 13:26:35.739337064 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/sysadm.te	2011-10-24 13:26:35.768337066 -0400

@@ -61,7 +61,8 @@ sysnet_filetrans_named_content(sysadm_t)

 # Add/remove user home directories

 userdom_manage_user_home_dirs(sysadm_t)

 userdom_home_filetrans_user_home_dir(sysadm_t)

-userdom_manage_tmp_role(sysadm_r, sysadm_t)

+userdom_manage_tmp_role(sysadm_r)

+userdom_manage_tmp(sysadm_t)

 optional_policy(`

 	alsa_filetrans_named_content(sysadm_t)

diff -up serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te

--- serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te.userdomain	2011-10-24 13:26:35.740337064 -0400

+++ serefpolicy-3.10.0/policy/modules/roles/unconfineduser.te	2011-10-24 13:26:35.777337067 -0400

@@ -45,9 +45,12 @@ gen_tunable(unconfined_login, true)

 # calls is not correct, however we dont currently

 # have another method to add access to these types

 userdom_base_user_template(unconfined)

-userdom_manage_home_role(unconfined_r, unconfined_t)

-userdom_manage_tmp_role(unconfined_r, unconfined_t)

-userdom_manage_tmpfs_role(unconfined_r, unconfined_t)

+userdom_manage_home_role(unconfined_r)

+userdom_user_home_dir_filetrans_user_home_content(unconfined_t, { dir file lnk_file sock_file fifo_file })

+userdom_manage_tmp_role(unconfined_r)

+userdom_manage_tmp(unconfined_t)

+userdom_manage_tmpfs_role(unconfined_r)

+userdom_manage_tmpfs(unconfined_t)

 userdom_unpriv_usertype(unconfined, unconfined_t)

 type unconfined_exec_t;

@@ -347,9 +350,13 @@ optional_policy(`

 	lpd_run_checkpc(unconfined_t, unconfined_r)

 ')

-#optional_policy(`

-#	mock_role(unconfined_r, unconfined_t)

-#')

+optional_policy(`

+	mock_role(unconfined_r, unconfined_t)

+')

+

+optional_policy(`

+	thumb_role(unconfined_r, unconfined_usertype)

+')

 optional_policy(`

 	modutils_run_update_mods(unconfined_t, unconfined_r)

diff -up serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain serefpolicy-3.10.0/policy/modules/services/rshd.te

--- serefpolicy-3.10.0/policy/modules/services/rshd.te.userdomain	2011-10-24 13:26:35.572337050 -0400

+++ serefpolicy-3.10.0/policy/modules/services/rshd.te	2011-10-24 13:26:35.769337066 -0400

@@ -66,7 +66,7 @@ seutil_read_config(rshd_t)

 seutil_read_default_contexts(rshd_t)

 userdom_search_user_home_content(rshd_t)

-userdom_manage_tmp_role(system_r, rshd_t)

+userdom_manage_tmp(rshd_t)

 tunable_policy(`use_nfs_home_dirs',`

 	fs_read_nfs_files(rshd_t)

diff -up serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.if

--- serefpolicy-3.10.0/policy/modules/services/ssh.if.userdomain	2011-10-24 13:26:35.601337052 -0400

+++ serefpolicy-3.10.0/policy/modules/services/ssh.if	2011-10-24 13:26:35.770337066 -0400

@@ -380,7 +380,7 @@ template(`ssh_role_template',`

 	manage_lnk_files_pattern($3, ssh_home_t, ssh_home_t)

 	manage_sock_files_pattern($3, ssh_home_t, ssh_home_t)

 	userdom_search_user_home_dirs($1_t)

-	userdom_manage_tmp_role($2, ssh_t)

+	userdom_manage_tmp(ssh_t)

 	##############################

 	#

diff -up serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain serefpolicy-3.10.0/policy/modules/services/ssh.te

--- serefpolicy-3.10.0/policy/modules/services/ssh.te.userdomain	2011-10-24 13:26:35.602337053 -0400

+++ serefpolicy-3.10.0/policy/modules/services/ssh.te	2011-10-24 13:26:35.771337066 -0400

@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)

 userdom_write_user_tmp_files(ssh_t)

 userdom_read_user_home_content_symlinks(ssh_t)

 userdom_read_home_certs(ssh_t)

+userdom_manage_tmp(ssh_t)

 tunable_policy(`allow_ssh_keysign',`

 	domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)

@@ -280,7 +281,7 @@ corenet_sendrecv_xserver_server_packets(

 userdom_read_user_home_content_files(sshd_t)

 userdom_read_user_home_content_symlinks(sshd_t)

-userdom_manage_tmp_role(system_r, sshd_t)

+userdom_manage_tmp(sshd_t)

 userdom_spec_domtrans_unpriv_users(sshd_t)

 userdom_signal_unpriv_users(sshd_t)

 userdom_dyntransition_unpriv_users(sshd_t)

diff -up serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain serefpolicy-3.10.0/policy/modules/services/sssd.te

--- serefpolicy-3.10.0/policy/modules/services/sssd.te.userdomain	2011-10-24 13:26:35.603337053 -0400

+++ serefpolicy-3.10.0/policy/modules/services/sssd.te	2011-10-24 13:26:35.772337066 -0400

@@ -93,7 +93,7 @@ miscfiles_read_generic_certs(sssd_t)

 sysnet_dns_name_resolve(sssd_t)

 sysnet_use_ldap(sssd_t)

-userdom_manage_tmp_role(system_r, sssd_t)

+userdom_manage_tmp(sssd_t)

 optional_policy(`

 	dbus_system_bus_client(sssd_t)

diff -up serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain serefpolicy-3.10.0/policy/modules/services/xserver.te

--- serefpolicy-3.10.0/policy/modules/services/xserver.te.userdomain	2011-10-24 13:26:35.746337064 -0400

+++ serefpolicy-3.10.0/policy/modules/services/xserver.te	2011-10-24 13:26:35.773337067 -0400

@@ -671,7 +671,7 @@ userdom_stream_connect(xdm_t)

 userdom_manage_user_tmp_dirs(xdm_t)

 userdom_manage_user_tmp_files(xdm_t)

 userdom_manage_user_tmp_sockets(xdm_t)

-userdom_manage_tmpfs_role(system_r, xdm_t)

+userdom_manage_tmpfs(xdm_t)

 application_signal(xdm_t)

diff -up serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain serefpolicy-3.10.0/policy/modules/system/userdomain.if

--- serefpolicy-3.10.0/policy/modules/system/userdomain.if.userdomain	2011-10-24 13:26:35.749337065 -0400

+++ serefpolicy-3.10.0/policy/modules/system/userdomain.if	2011-10-24 13:27:29.940341512 -0400

@@ -35,21 +35,14 @@ template(`userdom_base_user_template',`

 	type $1_t, userdomain, $1_usertype;

 	domain_type($1_t)

 	role $1_r;

-	corecmd_shell_entry_type($1_t)

-	corecmd_bin_entry_type($1_t)

 	domain_user_exemption_target($1_t)

 	ubac_constrained($1_t)

 	role $1_r types $1_t;

 	allow system_r $1_r;

-	term_user_pty($1_t, user_devpts_t)

-

-	term_user_tty($1_t, user_tty_device_t)

-	term_dontaudit_getattr_generic_ptys($1_t)

-

 	allow $1_usertype $1_usertype:process { ptrace signal_perms getsched setsched share getpgid setpgid getcap setcap getsession getattr };

 	allow $1_usertype $1_usertype:fd use;

-	allow $1_usertype $1_t:key { create view read write search link setattr };

+	allow $1_usertype $1_usertype:key { create view read write search link setattr };

 	allow $1_usertype $1_usertype:fifo_file rw_fifo_file_perms;

 	allow $1_usertype $1_usertype:unix_dgram_socket { create_socket_perms sendto };

@@ -61,114 +54,7 @@ template(`userdom_base_user_template',`

 	allow $1_usertype $1_usertype:context contains;

 	dontaudit $1_usertype $1_usertype:socket create;

-	allow $1_usertype user_devpts_t:chr_file { setattr rw_chr_file_perms };

-	term_create_pty($1_usertype, user_devpts_t)

-	# avoid annoying messages on terminal hangup on role change

-	dontaudit $1_usertype user_devpts_t:chr_file ioctl;

-

-	allow $1_usertype user_tty_device_t:chr_file { setattr rw_chr_file_perms };

-	# avoid annoying messages on terminal hangup on role change

-	dontaudit $1_usertype user_tty_device_t:chr_file ioctl;

-

-	application_exec_all($1_usertype)

-

-	kernel_read_kernel_sysctls($1_usertype)

-	kernel_read_all_sysctls($1_usertype)

-	kernel_dontaudit_list_unlabeled($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_files($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_symlinks($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_pipes($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_sockets($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_blk_files($1_usertype)

-	kernel_dontaudit_getattr_unlabeled_chr_files($1_usertype)

-	kernel_dontaudit_list_proc($1_usertype)

-

-	dev_dontaudit_getattr_all_blk_files($1_usertype)

-	dev_dontaudit_getattr_all_chr_files($1_usertype)

-	dev_getattr_mtrr_dev($1_t)

-

-	# When the user domain runs ps, there will be a number of access

-	# denials when ps tries to search /proc. Do not audit these denials.

-	domain_dontaudit_read_all_domains_state($1_usertype)

-	domain_dontaudit_getattr_all_domains($1_usertype)

-	domain_dontaudit_getsession_all_domains($1_usertype)

-	dev_dontaudit_all_access_check($1_usertype)

-

-	files_read_etc_files($1_usertype)

-	files_list_mnt($1_usertype)

-	files_list_var($1_usertype)

-	files_read_mnt_files($1_usertype)

-	files_dontaudit_access_check_mnt($1_usertype)

-	files_read_etc_runtime_files($1_usertype)

-	files_read_usr_files($1_usertype)

-	files_read_usr_src_files($1_usertype)

-	# Read directories and files with the readable_t type.

-	# This type is a general type for "world"-readable files.

-	files_list_world_readable($1_usertype)

-	files_read_world_readable_files($1_usertype)

-	files_read_world_readable_symlinks($1_usertype)

-	files_read_world_readable_pipes($1_usertype)

-	files_read_world_readable_sockets($1_usertype)

-	# old broswer_domain():

-	files_dontaudit_getattr_all_dirs($1_usertype)

-	files_dontaudit_list_non_security($1_usertype)

-	files_dontaudit_getattr_all_files($1_usertype)

-	files_dontaudit_getattr_non_security_symlinks($1_usertype)

-	files_dontaudit_getattr_non_security_pipes($1_usertype)

-	files_dontaudit_getattr_non_security_sockets($1_usertype)

-	files_dontaudit_setattr_etc_runtime_files($1_usertype)

-

-	files_exec_usr_files($1_t)

-

-	fs_list_cgroup_dirs($1_usertype)

-	fs_dontaudit_rw_cgroup_files($1_usertype)

-

-	storage_rw_fuse($1_usertype)

-

 	auth_use_nsswitch($1_t)

-

-	init_stream_connect($1_usertype)

-	# The library functions always try to open read-write first,

-	# then fall back to read-only if it fails. 

-	init_dontaudit_rw_utmp($1_usertype)

-

-	libs_exec_ld_so($1_usertype)

-

-	logging_send_audit_msgs($1_t)

-

-	miscfiles_read_localization($1_t)

-	miscfiles_read_generic_certs($1_t)

-

-	miscfiles_read_all_certs($1_usertype)

-	miscfiles_read_localization($1_usertype)

-	miscfiles_read_man_pages($1_usertype)

-	miscfiles_read_public_files($1_usertype)

-

-	systemd_dbus_chat_logind($1_usertype)

-

-	tunable_policy(`allow_execmem',`

-		# Allow loading DSOs that require executable stack.

-		allow $1_t self:process execmem;

-	')

-

-	tunable_policy(`allow_execmem && allow_execstack',`

-		# Allow making the stack executable via mprotect.

-		allow $1_t self:process execstack;

-	')

-

-	optional_policy(`

-		abrt_stream_connect($1_usertype)

-	')

-

-	optional_policy(`

-		fs_list_cgroup_dirs($1_usertype)

-	')

-	

-	optional_policy(`

-		ssh_rw_stream_sockets($1_usertype)

-		ssh_delete_tmp($1_t)

-		ssh_signal($1_t)

-	')

 ')

 #######################################

@@ -242,6 +128,22 @@ interface(`userdom_ro_home_role',`

 ##	The user role

 ##	</summary>

 ## </param>

+## <rolebase/>

+#

+interface(`userdom_manage_home_role',`

+	gen_require(`

+		type user_home_dir_t;

+		attribute user_home_type;

+	')

+

+	role $1 types { user_home_type user_home_dir_t };

+')

+

+#######################################

+## <summary>

+##	Allow a home directory for which the

+##	role has full access.

+## </summary>

 ## <param name="userdomain">

 ##	<summary>

 ##	The user domain

@@ -249,61 +151,58 @@ interface(`userdom_ro_home_role',`

 ## </param>

 ## <rolebase/>

 #

-interface(`userdom_manage_home_role',`

+interface(`userdom_manage_home',`

 	gen_require(`

 		type user_home_t, user_home_dir_t;

 		attribute user_home_type;

 	')

-	role $1 types { user_home_type user_home_dir_t };

-

 	##############################

 	#

 	# Domain access to home dir

 	#

-

-	type_member $2 user_home_dir_t:dir user_home_dir_t;

+	type_member $1 user_home_dir_t:dir user_home_dir_t;

 	# full control of the home directory

-	allow $2 user_home_t:dir mounton;

-	allow $2 user_home_t:file entrypoint;

+	allow $1 user_home_t:dir mounton;

+	allow $1 user_home_t:file entrypoint;

-	allow $2 user_home_type:dir_file_class_set { relabelto relabelfrom };

-	allow $2 user_home_dir_t:lnk_file read_lnk_file_perms;

-	manage_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	manage_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	manage_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	manage_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	manage_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	relabel_dirs_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	relabel_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	relabel_lnk_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	relabel_sock_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	relabel_fifo_files_pattern($2, { user_home_dir_t user_home_type }, user_home_type)

-	filetrans_pattern($2, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })

-	files_list_home($2)

+	allow $1 user_home_type:dir_file_class_set { relabelto relabelfrom };

+	allow $1 user_home_dir_t:lnk_file read_lnk_file_perms;

+	manage_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	manage_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	manage_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	manage_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	manage_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	relabel_dirs_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	relabel_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	relabel_lnk_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	relabel_sock_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	relabel_fifo_files_pattern($1, { user_home_dir_t user_home_type }, user_home_type)

+	filetrans_pattern($1, user_home_dir_t, user_home_t, { dir file lnk_file sock_file fifo_file })

+	files_list_home($1)

 	# cjp: this should probably be removed:

-	allow $2 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };

+	allow $1 user_home_dir_t:dir { manage_dir_perms relabel_dir_perms };

 	tunable_policy(`use_nfs_home_dirs',`

-		fs_mount_nfs($2)

-		fs_mounton_nfs($2)

-		fs_manage_nfs_dirs($2)

-		fs_manage_nfs_files($2)

-		fs_manage_nfs_symlinks($2)

-		fs_manage_nfs_named_sockets($2)

-		fs_manage_nfs_named_pipes($2)

+		fs_mount_nfs($1)

+		fs_mounton_nfs($1)

+		fs_manage_nfs_dirs($1)

+		fs_manage_nfs_files($1)

+		fs_manage_nfs_symlinks($1)

+		fs_manage_nfs_named_sockets($1)

+		fs_manage_nfs_named_pipes($1)

 	')

 	tunable_policy(`use_samba_home_dirs',`

-		fs_mount_cifs($2)

-		fs_mounton_cifs($2)

-		fs_manage_cifs_dirs($2)

-		fs_manage_cifs_files($2)

-		fs_manage_cifs_symlinks($2)

-		fs_manage_cifs_named_sockets($2)

-		fs_manage_cifs_named_pipes($2)

+		fs_mount_cifs($1)

+		fs_mounton_cifs($1)

+		fs_manage_cifs_dirs($1)

+		fs_manage_cifs_files($1)

+		fs_manage_cifs_symlinks($1)

+		fs_manage_cifs_named_sockets($1)

+		fs_manage_cifs_named_pipes($1)

 	')

 ')

@@ -316,6 +215,21 @@ interface(`userdom_manage_home_role',`

 ##	Role allowed access.

 ##	</summary>

 ## </param>

+## <rolebase/>

+#

+interface(`userdom_manage_tmp_role',`

+	gen_require(`

+		attribute user_tmp_type;

+		type user_tmp_t;

+	')

+

+	role $1 types user_tmp_t;

+')

+

+#######################################

+## <summary>

+##	Manage user temporary files

+## </summary>

 ## <param name="domain">

 ##	<summary>

 ##	Domain allowed access.

@@ -323,27 +237,25 @@ interface(`userdom_manage_home_role',`

 ## </param>

 ## <rolebase/>

 #

-interface(`userdom_manage_tmp_role',`

+interface(`userdom_manage_tmp',`

 	gen_require(`

 		attribute user_tmp_type;

 		type user_tmp_t;

 	')

-	role $1 types user_tmp_t;

-

-	files_poly_member_tmp($2, user_tmp_t)

+	files_poly_member_tmp($1, user_tmp_t)

-	manage_dirs_pattern($2, user_tmp_type, user_tmp_type)

-	manage_files_pattern($2, user_tmp_type, user_tmp_type)

-	manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)

-	manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)

-	manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)

-	files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file fifo_file })

-	relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)

-	relabel_files_pattern($2, user_tmp_type, user_tmp_type)

-	relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)

-	relabel_sock_files_pattern($2, user_tmp_type, user_tmp_type)

-	relabel_fifo_files_pattern($2, user_tmp_type, user_tmp_type)

+	manage_dirs_pattern($1, user_tmp_type, user_tmp_type)

+	manage_files_pattern($1, user_tmp_type, user_tmp_type)

+	manage_lnk_files_pattern($1, user_tmp_type, user_tmp_type)

+	manage_sock_files_pattern($1, user_tmp_type, user_tmp_type)

+	manage_fifo_files_pattern($1, user_tmp_type, user_tmp_type)

+	files_tmp_filetrans($1, user_tmp_t, { dir file lnk_file sock_file fifo_file })

+	relabel_dirs_pattern($1, user_tmp_type, user_tmp_type)

+	relabel_files_pattern($1, user_tmp_type, user_tmp_type)

+	relabel_lnk_files_pattern($1, user_tmp_type, user_tmp_type)

+	relabel_sock_files_pattern($1, user_tmp_type, user_tmp_type)

+	relabel_fifo_files_pattern($1, user_tmp_type, user_tmp_type)

 ')

 #######################################

@@ -424,6 +336,21 @@ interface(`userdom_exec_user_tmp_files',

 ##	Role allowed access.

 ##	</summary>

 ## </param>

+## <rolecap/>

+#

+interface(`userdom_manage_tmpfs_role',`

+	gen_require(`

+		attribute user_tmpfs_type;

+		type user_tmpfs_t;

+	')

+

+	role $1 types user_tmpfs_t;

+')

+

+#######################################

+## <summary>

+##	Allow access for the user tmpfs type

+## </summary>

 ## <param name="domain">

 ##	<summary>

 ##	Domain allowed access.

@@ -431,25 +358,23 @@ interface(`userdom_exec_user_tmp_files',

 ## </param>

 ## <rolecap/>

 #

-interface(`userdom_manage_tmpfs_role',`

+interface(`userdom_manage_tmpfs',`

 	gen_require(`

 		attribute user_tmpfs_type;

 		type user_tmpfs_t;

 	')

-	role $1 types user_tmpfs_t;

-

-	manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })

-	relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

-	relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)

+	manage_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	manage_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	manage_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	manage_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	manage_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	fs_tmpfs_filetrans($1, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })

+	relabel_dirs_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	relabel_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	relabel_lnk_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	relabel_sock_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

+	relabel_fifo_files_pattern($1, user_tmpfs_type, user_tmpfs_type)

 ')

 #######################################

@@ -578,260 +503,31 @@ template(`userdom_change_password_templa

 template(`userdom_common_user_template',`

 	gen_require(`

 		attribute unpriv_userdomain;

+		attribute common_userdomain;

 	')

-	userdom_basic_networking($1_usertype)

-

-	##############################

-	#

-	# User domain Local policy

-	#

-

-	# evolution and gnome-session try to create a netlink socket

-	dontaudit $1_t self:netlink_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown };

-	dontaudit $1_t self:netlink_route_socket { create ioctl read getattr write setattr append bind connect getopt setopt shutdown nlmsg_read nlmsg_write };

-	allow $1_t self:netlink_kobject_uevent_socket create_socket_perms;

-	allow $1_t self:socket create_socket_perms;

-

-	allow $1_usertype unpriv_userdomain:fd use;

-

-	kernel_read_system_state($1_usertype)

-	kernel_read_network_state($1_usertype)

-	kernel_read_software_raid_state($1_usertype)

-	kernel_read_net_sysctls($1_usertype)

-	# Very permissive allowing every domain to see every type:

-	kernel_get_sysvipc_info($1_usertype)

-	# Find CDROM devices:

-	kernel_read_device_sysctls($1_usertype)

-	kernel_request_load_module($1_usertype)

-

-	corenet_udp_bind_generic_node($1_usertype)

-	corenet_udp_bind_generic_port($1_usertype)

-

-	dev_read_rand($1_usertype)

-	dev_write_sound($1_usertype)

-	dev_read_sound($1_usertype)

-	dev_read_sound_mixer($1_usertype)

-	dev_write_sound_mixer($1_usertype)

-

-	files_exec_etc_files($1_usertype)

-	files_search_locks($1_usertype)

-	# Check to see if cdrom is mounted

-	files_search_mnt($1_usertype)

-	# cjp: perhaps should cut back on file reads:

-	files_read_var_files($1_usertype)

-	files_read_var_symlinks($1_usertype)

-	files_read_generic_spool($1_usertype)

-	files_read_var_lib_files($1_usertype)

-	# Stat lost+found.

-	files_getattr_lost_found_dirs($1_usertype)

-	files_read_config_files($1_usertype)

-	fs_read_noxattr_fs_files($1_usertype)

-	fs_read_noxattr_fs_symlinks($1_usertype)

-	fs_rw_cgroup_files($1_usertype)

-

-	application_getattr_socket($1_usertype)

-

-	logging_send_syslog_msg($1_usertype)

-	logging_send_audit_msgs($1_usertype)

-	selinux_get_enforce_mode($1_usertype)

-

-	# cjp: some of this probably can be removed

-	selinux_get_fs_mount($1_usertype)

-	selinux_validate_context($1_usertype)

-	selinux_compute_access_vector($1_usertype)

-	selinux_compute_create_context($1_usertype)

-	selinux_compute_relabel_context($1_usertype)

-	selinux_compute_user_contexts($1_usertype)

-

-	# for eject

-	storage_getattr_fixed_disk_dev($1_usertype)

+	typeattribute $1_t common_userdomain;

-	auth_read_login_records($1_usertype)

-	auth_run_pam($1_t,$1_r)

-	auth_run_utempter($1_t,$1_r)

-

-	init_read_utmp($1_usertype)

-

-	seutil_read_file_contexts($1_usertype)

-	seutil_read_default_contexts($1_usertype)

-	seutil_run_newrole($1_t,$1_r)

-	seutil_exec_checkpolicy($1_t)

-	seutil_exec_setfiles($1_usertype)

-	# for when the network connection is killed

-	# this is needed when a login role can change

-	# to this one.

-	seutil_dontaudit_signal_newrole($1_t)

-

-	tunable_policy(`user_direct_mouse',`

-		dev_read_mouse($1_usertype)

-	')

-

-	tunable_policy(`user_ttyfile_stat',`

-		term_getattr_all_ttys($1_t)

-	')

-

-	optional_policy(`

-		# Allow graphical boot to check battery lifespan

-		apm_stream_connect($1_usertype)

-	')

-

-	optional_policy(`

-		canna_stream_connect($1_usertype)

-	')

-

-	optional_policy(`

-		chrome_role($1_r, $1_usertype)

-	')

-

-	optional_policy(`

-		colord_read_lib_files($1_usertype)

-	')

-

-	optional_policy(`

-		dbus_system_bus_client($1_usertype)

-

-		allow $1_usertype $1_usertype:dbus  send_msg;

-

-		optional_policy(`

-			avahi_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			policykit_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			bluetooth_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			consolekit_dbus_chat($1_usertype)

-			consolekit_read_log($1_usertype)

-		')

-

-		optional_policy(`

-			devicekit_dbus_chat($1_usertype)

-			devicekit_dbus_chat_power($1_usertype)

-			devicekit_dbus_chat_disk($1_usertype)

-		')

-

-		optional_policy(`

-			evolution_dbus_chat($1_usertype)

-			evolution_alarm_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			gnome_dbus_chat_gconfdefault($1_usertype)

-		')

-

-		optional_policy(`

-			hal_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			kde_dbus_chat_backlighthelper($1_usertype)

-		')

-

-		optional_policy(`

-			modemmanager_dbus_chat($1_usertype)

-		')

-

-		optional_policy(`

-			networkmanager_dbus_chat($1_usertype)

-			networkmanager_read_lib_files($1_usertype)

-		')

-

-		optional_policy(`

-			vpn_dbus_chat($1_usertype)

-		')

-	')

-

-	optional_policy(`

-		git_session_role($1_r, $1_usertype)

-	')

-

-	optional_policy(`

-		inetd_use_fds($1_usertype)

-		inetd_rw_tcp_sockets($1_usertype)

-	')

-

-	optional_policy(`

-		inn_read_config($1_usertype)

-		inn_read_news_lib($1_usertype)

-		inn_read_news_spool($1_usertype)

-	')

-

-	optional_policy(`

-		lircd_stream_connect($1_usertype)

-	')

-

-	optional_policy(`

-		locate_read_lib_files($1_usertype)

-	')