diff --git a/policy/modules/admin/rpm.te b/policy/modules/admin/rpm.te
index 17b5426..a485d76 100644
--- a/policy/modules/admin/rpm.te
+++ b/policy/modules/admin/rpm.te
@@ -419,7 +419,6 @@ optional_policy(`
optional_policy(`
unconfined_domain_noaudit(rpm_script_t)
unconfined_domtrans(rpm_script_t)
- unconfined_execmem_domtrans(rpm_script_t)
optional_policy(`
java_domtrans_unconfined(rpm_script_t)
diff --git a/policy/modules/admin/sudo.if b/policy/modules/admin/sudo.if
index 634c47a..748db5b 100644
--- a/policy/modules/admin/sudo.if
+++ b/policy/modules/admin/sudo.if
@@ -47,6 +47,7 @@ template(`sudo_role_template',`
domain_role_change_exemption($1_sudo_t)
ubac_constrained($1_sudo_t)
role $2 types $1_sudo_t;
+ userdom_home_manager($1_sudo_t)
type $1_sudo_tmp_t;
files_tmp_file($1_sudo_tmp_t)
diff --git a/policy/modules/admin/sudo.te b/policy/modules/admin/sudo.te
index 71bf5e8..9ce39dd 100644
--- a/policy/modules/admin/sudo.te
+++ b/policy/modules/admin/sudo.te
@@ -101,14 +101,6 @@ userdom_search_user_home_content(sudodomain)
userdom_search_admin_dir(sudodomain)
userdom_manage_all_users_keys(sudodomain)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(sudodomain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(sudodomain)
-')
-
optional_policy(`
dbus_system_bus_client(sudodomain)
')
diff --git a/policy/modules/apps/cdrecord.te b/policy/modules/apps/cdrecord.te
index f7183ef..49ce279 100644
--- a/policy/modules/apps/cdrecord.te
+++ b/policy/modules/apps/cdrecord.te
@@ -109,11 +109,7 @@ tunable_policy(`cdrecord_read_content',`
userdom_dontaudit_read_user_home_content_files(cdrecord_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- files_search_mnt(cdrecord_t)
- fs_read_nfs_files(cdrecord_t)
- fs_read_nfs_symlinks(cdrecord_t)
-')
+userdom_home_manager(cdrecord_t)
optional_policy(`
resmgr_stream_connect(cdrecord_t)
diff --git a/policy/modules/apps/chrome.te b/policy/modules/apps/chrome.te
index 6c642a2..acb325c 100644
--- a/policy/modules/apps/chrome.te
+++ b/policy/modules/apps/chrome.te
@@ -92,11 +92,6 @@ miscfiles_read_fonts(chrome_sandbox_t)
sysnet_dns_name_resolve(chrome_sandbox_t)
optional_policy(`
- execmem_exec(chrome_sandbox_t)
- execmem_execmod(chrome_sandbox_t)
-')
-
-optional_policy(`
gnome_rw_inherited_config(chrome_sandbox_t)
gnome_read_home_config(chrome_sandbox_t)
')
diff --git a/policy/modules/apps/execmem.fc b/policy/modules/apps/execmem.fc
deleted file mode 100644
index 5e09952..0000000
--- a/policy/modules/apps/execmem.fc
+++ /dev/null
@@ -1,49 +0,0 @@
-
-/usr/bin/aticonfig -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/darcs -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/dosbox -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/haddock.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/hasktags -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/plasma-desktop -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/runghc -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/runhaskell -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/sbcl -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/skype -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/bin/valgrind -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/sbin/vboxadd-service -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/sbin/VBox.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-ifdef(`distro_gentoo',`
-/usr/lib32/openoffice/program/[^/]+\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-')
-/usr/lib/chromium-browser/chromium-browser gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/erlang/erts-[^/]+/bin/beam.smp -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/R/bin/exec/R -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/libexec/ghc-[^/]+/.*bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/libexec/ghc-[^/]+/ghc.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/ghc-[^/]+/ghc.* -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/ia32el/ia32x_loader -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/virtualbox/VirtualBox -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/real/(.*/)?realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/secondlife-install/bin/SLPlugin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/real/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/local/RealPlayer/realplay\.bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/usr/lib/gimp/[^/]+/plug-ins/help-browser -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/wingide-[^/]+/bin/PyCore/python -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/lib/thunderbird-[^/]+/thunderbird-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/Adobe.*AIR/.*/Resources/Adobe.AIR.Updater -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Adobe.*AIR/.*/Resources/Adobe.AIR.Application -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/likewise/bin/domainjoin-cli -- gen_context(system_u:object_r:execmem_exec_t,s0)
-
-/opt/google/chrome/chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/google/chrome/google-chrome -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Komodo-Edit-5/lib/mozilla/komodo-bin -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/opt/Adobe/Reader9/Reader/intellinux/bin/acroread -- gen_context(system_u:object_r:execmem_exec_t,s0)
-/usr/local/Wolfram/Mathematica(/.*)?MathKernel -- gen_context(system_u:object_r:execmem_exec_t,s0)
diff --git a/policy/modules/apps/execmem.if b/policy/modules/apps/execmem.if
deleted file mode 100644
index e23f640..0000000
--- a/policy/modules/apps/execmem.if
+++ /dev/null
@@ -1,132 +0,0 @@
-## <summary>execmem domain</summary>
-
-########################################
-## <summary>
-## Execute the execmem program
-## in the caller domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`execmem_exec',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- can_exec($1, execmem_exec_t)
-')
-
-#######################################
-## <summary>
-## The role template for the execmem module.
-## </summary>
-## <desc>
-## <p>
-## This template creates a derived domains which are used
-## for execmem applications.
-## </p>
-## </desc>
-## <param name="role_prefix">
-## <summary>
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-## </summary>
-## </param>
-## <param name="user_role">
-## <summary>
-## The role associated with the user domain.
-## </summary>
-## </param>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-template(`execmem_role_template',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- type $1_execmem_t;
- domain_type($1_execmem_t)
- domain_entry_file($1_execmem_t, execmem_exec_t)
- role $2 types $1_execmem_t;
-
- userdom_unpriv_usertype($1, $1_execmem_t)
- userdom_manage_tmp_role($2, $1_execmem_t)
- userdom_manage_tmpfs_role($2, $1_execmem_t)
-
- allow $1_execmem_t self:process { execmem execstack };
- allow $3 $1_execmem_t:process { getattr ptrace noatsecure signal_perms };
- domtrans_pattern($3, execmem_exec_t, $1_execmem_t)
-
- files_execmod_tmp($1_execmem_t)
-
- allow $3 execmem_exec_t:file execmod;
- allow $1_execmem_t execmem_exec_t:file execmod;
-
- # needed by plasma-desktop
- optional_policy(`
- gnome_read_usr_config($1_execmem_t)
- ')
-
- optional_policy(`
- mozilla_execmod_user_home_files($1_execmem_t)
- ')
-
- optional_policy(`
- nsplugin_rw_shm($1_execmem_t)
- nsplugin_rw_semaphores($1_execmem_t)
- ')
-
- optional_policy(`
- xserver_role($2, $1_execmem_t)
- ')
-')
-
-########################################
-## <summary>
-## Execute a execmem_exec file
-## in the specified domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-## <param name="target_domain">
-## <summary>
-## The type of the new process.
-## </summary>
-## </param>
-#
-interface(`execmem_domtrans',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- domtrans_pattern($1, execmem_exec_t, $2)
-')
-
-########################################
-## <summary>
-## Execmod the execmem_exec applications
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`execmem_execmod',`
- gen_require(`
- type execmem_exec_t;
- ')
-
- allow $1 execmem_exec_t:file execmod;
-')
-
diff --git a/policy/modules/apps/execmem.te b/policy/modules/apps/execmem.te
deleted file mode 100644
index a7d37e2..0000000
--- a/policy/modules/apps/execmem.te
+++ /dev/null
@@ -1,10 +0,0 @@
-policy_module(execmem, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type execmem_exec_t alias unconfined_execmem_exec_t;
-application_executable_file(execmem_exec_t)
-
diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te
index 10a2ce4..5c81832 100644
--- a/policy/modules/apps/gift.te
+++ b/policy/modules/apps/gift.te
@@ -70,17 +70,7 @@ sysnet_read_config(gift_t)
# giftui looks in .icons, .themes.
userdom_dontaudit_read_user_home_content_files(gift_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gift_t)
- fs_manage_nfs_files(gift_t)
- fs_manage_nfs_symlinks(gift_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gift_t)
- fs_manage_cifs_files(gift_t)
- fs_manage_cifs_symlinks(gift_t)
-')
+userdom_home_manager(gift_t)
optional_policy(`
nscd_socket_use(gift_t)
@@ -133,15 +123,4 @@ miscfiles_read_localization(giftd_t)
sysnet_read_config(giftd_t)
userdom_use_inherited_user_terminals(giftd_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(giftd_t)
- fs_manage_nfs_files(giftd_t)
- fs_manage_nfs_symlinks(giftd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(giftd_t)
- fs_manage_cifs_files(giftd_t)
- fs_manage_cifs_symlinks(giftd_t)
-')
+userdom_home_manager(gitd_t)
diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if
index deab06c..00762c5 100644
--- a/policy/modules/apps/gnome.if
+++ b/policy/modules/apps/gnome.if
@@ -70,6 +70,8 @@ interface(`gnome_role_gkeyringd',`
ubac_constrained($1_gkeyringd_t)
domain_user_exemption_target($1_gkeyringd_t)
+ userdom_home_manager($1_gkeyringd_t)
+
role $2 types $1_gkeyringd_t;
domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t)
diff --git a/policy/modules/apps/gnome.te b/policy/modules/apps/gnome.te
index 45b4ca9..14d7e30 100644
--- a/policy/modules/apps/gnome.te
+++ b/policy/modules/apps/gnome.te
@@ -153,15 +153,7 @@ optional_policy(`
policykit_read_reload(gconfdefaultsm_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gconfdefaultsm_t)
- fs_manage_nfs_files(gconfdefaultsm_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gconfdefaultsm_t)
- fs_manage_cifs_files(gconfdefaultsm_t)
-')
+userdom_home_manager(gconfdefaultsm_t)
#######################################
#
@@ -233,6 +225,7 @@ corecmd_search_bin(gkeyringd_domain)
dev_read_rand(gkeyringd_domain)
dev_read_urand(gkeyringd_domain)
+dev_read_sysfs(gkeyringd_domain)
files_read_etc_files(gkeyringd_domain)
files_read_usr_files(gkeyringd_domain)
@@ -268,13 +261,3 @@ domain_use_interactive_fds(gnome_domain)
userdom_use_inherited_user_terminals(gnome_domain)
-tunable_policy(`use_nfs_home_dirs',`
- fs_getattr_nfs(gkeyringd_domain)
- fs_manage_nfs_dirs(gkeyringd_domain)
- fs_manage_nfs_files(gkeyringd_domain)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gkeyringd_domain)
- fs_manage_cifs_files(gkeyringd_domain)
-')
diff --git a/policy/modules/apps/gpg.te b/policy/modules/apps/gpg.te
index 401a4ec..80f8c31 100644
--- a/policy/modules/apps/gpg.te
+++ b/policy/modules/apps/gpg.te
@@ -150,15 +150,7 @@ userdom_stream_connect(gpg_t)
mta_write_config(gpg_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gpg_t)
- fs_manage_nfs_files(gpg_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gpg_t)
- fs_manage_cifs_files(gpg_t)
-')
+userdom_home_manager(gpg_t)
optional_policy(`
gnome_read_config(gpg_t)
@@ -290,17 +282,7 @@ tunable_policy(`gpg_agent_env_file',`
userdom_manage_user_home_content_files(gpg_agent_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(gpg_agent_t)
- fs_manage_nfs_files(gpg_agent_t)
- fs_manage_nfs_symlinks(gpg_agent_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(gpg_agent_t)
- fs_manage_cifs_files(gpg_agent_t)
- fs_manage_cifs_symlinks(gpg_agent_t)
-')
+userdom_home_manager(gpg_agent_t)
optional_policy(`
mozilla_dontaudit_rw_user_home_files(gpg_agent_t)
@@ -371,13 +353,7 @@ allow gpg_pinentry_t user_tmpfs_t:file unlink;
userdom_signull_unpriv_users(gpg_pinentry_t)
userdom_use_user_terminals(gpg_pinentry_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(gpg_pinentry_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(gpg_pinentry_t)
-')
+userdom_home_reader(gpg_pinentry_t)
optional_policy(`
gnome_read_home_config(gpg_pinentry_t)
diff --git a/policy/modules/apps/irc.te b/policy/modules/apps/irc.te
index b69a628..4bc18b6 100644
--- a/policy/modules/apps/irc.te
+++ b/policy/modules/apps/irc.te
@@ -110,17 +110,7 @@ sysnet_read_config(irc_t)
# Write to the user domain tty.
userdom_use_inherited_user_terminals(irc_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(irc_t)
- fs_manage_nfs_files(irc_t)
- fs_manage_nfs_symlinks(irc_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(irc_t)
- fs_manage_cifs_files(irc_t)
- fs_manage_cifs_symlinks(irc_t)
-')
+userdom_home_manager(irc_t)
optional_policy(`
nis_use_ypbind(irc_t)
@@ -185,17 +175,7 @@ tunable_policy(`irssi_use_full_network', `
corenet_sendrecv_all_client_packets(irssi_t)
')
-tunable_policy(`use_nfs_home_dirs', `
- fs_manage_nfs_dirs(irssi_t)
- fs_manage_nfs_files(irssi_t)
- fs_manage_nfs_symlinks(irssi_t)
-')
-
-tunable_policy(`use_samba_home_dirs', `
- fs_manage_cifs_dirs(irssi_t)
- fs_manage_cifs_files(irssi_t)
- fs_manage_cifs_symlinks(irssi_t)
-')
+userdom_home_manager(irssi_t)
optional_policy(`
automount_dontaudit_getattr_tmp_dirs(irssi_t)
diff --git a/policy/modules/apps/java.fc b/policy/modules/apps/java.fc
index 5d2130c..86c1768 100644
--- a/policy/modules/apps/java.fc
+++ b/policy/modules/apps/java.fc
@@ -5,13 +5,10 @@
/opt/ibm/java.*/(bin|javaws)(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/opt/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/local/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/MATLAB.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
#
# /usr
#
-/usr/Aptana[^/]*/AptanaStudio -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/(.*/)?bin/java.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/fastjar -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/bin/frysk -- gen_context(system_u:object_r:java_exec_t,s0)
@@ -30,14 +27,12 @@
/usr/lib/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/opera -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/lib/opera(/.*)?/works -- gen_context(system_u:object_r:java_exec_t,s0)
+/usr/lib64/jvm/java(.*/)bin(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/local/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
/usr/matlab.*/bin.*/MATLAB.* -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/ibm/lotus/Symphony/framework/rcp/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
-/opt/ibm(/.*)?/eclipse/plugins(/.*)? -- gen_context(system_u:object_r:java_exec_t,s0)
-
ifdef(`distro_redhat',`
/usr/java/eclipse[^/]*/eclipse -- gen_context(system_u:object_r:java_exec_t,s0)
')
diff --git a/policy/modules/apps/java.if b/policy/modules/apps/java.if
index 7c398c0..e6d84e8 100644
--- a/policy/modules/apps/java.if
+++ b/policy/modules/apps/java.if
@@ -72,8 +72,7 @@ template(`java_role_template',`
domain_interactive_fd($1_java_t)
- userdom_unpriv_usertype($1, $1_java_t)
- userdom_manage_tmpfs_role($2, $1_java_t)
+ userdom_manage_user_tmpfs_files($1_java_t)
allow $1_java_t self:process { ptrace signal getsched execmem execstack };
@@ -83,7 +82,7 @@ template(`java_role_template',`
domtrans_pattern($3, java_exec_t, $1_java_t)
- corecmd_bin_domtrans($1_java_t, $1_t)
+ corecmd_bin_domtrans($1_java_t, $3)
dev_dontaudit_append_rand($1_java_t)
@@ -106,7 +105,7 @@ template(`java_role_template',`
## </summary>
## </param>
#
-interface(`java_domtrans',`
+template(`java_domtrans',`
gen_require(`
type java_t, java_exec_t;
')
@@ -180,10 +179,6 @@ interface(`java_run_unconfined',`
java_domtrans_unconfined($1)
role $2 types unconfined_java_t;
-
- optional_policy(`
- nsplugin_role_notrans($2, unconfined_java_t)
- ')
')
########################################
diff --git a/policy/modules/apps/java.te b/policy/modules/apps/java.te
index 27d37b0..167950d 100644
--- a/policy/modules/apps/java.te
+++ b/policy/modules/apps/java.te
@@ -82,20 +82,18 @@ dev_read_urand(java_t)
dev_read_rand(java_t)
dev_dontaudit_append_rand(java_t)
-files_read_etc_files(java_t)
files_read_usr_files(java_t)
files_search_home(java_t)
files_search_var_lib(java_t)
files_read_etc_runtime_files(java_t)
# Read global fonts and font config
+files_read_etc_files(java_t)
fs_getattr_xattr_fs(java_t)
fs_dontaudit_rw_tmpfs_files(java_t)
logging_send_syslog_msg(java_t)
-auth_use_nsswitch(java_t)
-
miscfiles_read_localization(java_t)
# Read global fonts and font config
miscfiles_read_fonts(java_t)
@@ -125,6 +123,14 @@ tunable_policy(`allow_java_execstack',`
')
optional_policy(`
+ nis_use_ypbind(java_t)
+')
+
+optional_policy(`
+ nscd_socket_use(java_t)
+')
+
+optional_policy(`
xserver_user_x_domain_template(java, java_t, java_tmpfs_t)
')
@@ -137,21 +143,14 @@ optional_policy(`
# execheap is needed for itanium/BEA jrocket
allow unconfined_java_t self:process { execstack execmem execheap };
- init_dbus_chat_script(unconfined_java_t)
-
files_execmod_all_files(unconfined_java_t)
init_dbus_chat_script(unconfined_java_t)
unconfined_domain_noaudit(unconfined_java_t)
unconfined_dbus_chat(unconfined_java_t)
- userdom_unpriv_usertype(unconfined, unconfined_java_t)
optional_policy(`
rpm_domtrans(unconfined_java_t)
')
-
- optional_policy(`
- wine_domtrans(unconfined_java_t)
- ')
')
diff --git a/policy/modules/apps/mono.if b/policy/modules/apps/mono.if
index b2b83ad..7b08e13 100644
--- a/policy/modules/apps/mono.if
+++ b/policy/modules/apps/mono.if
@@ -40,16 +40,16 @@ template(`mono_role_template',`
domain_interactive_fd($1_mono_t)
application_type($1_mono_t)
- allow $1_mono_t self:process { signal getsched execheap execmem execstack };
- allow $3 $1_mono_t:process { getattr noatsecure signal_perms };
+ allow $1_mono_t self:process { ptrace signal getsched execheap execmem execstack };
+
+ allow $3 $1_mono_t:process { getattr ptrace noatsecure signal_perms };
domtrans_pattern($3, mono_exec_t, $1_mono_t)
fs_dontaudit_rw_tmpfs_files($1_mono_t)
corecmd_bin_domtrans($1_mono_t, $1_t)
- userdom_unpriv_usertype($1, $1_mono_t)
- userdom_manage_tmpfs_role($2, $1_mono_t)
+ userdom_manage_user_tmpfs_files($1_mono_t)
optional_policy(`
xserver_role($1_r, $1_mono_t)
diff --git a/policy/modules/apps/mono.te b/policy/modules/apps/mono.te
index ecab36d..dff0f12 100644
--- a/policy/modules/apps/mono.te
+++ b/policy/modules/apps/mono.te
@@ -15,7 +15,7 @@ init_system_domain(mono_t, mono_exec_t)
# Local policy
#
-allow mono_t self:process { signal getsched execheap execmem execstack };
+allow mono_t self:process { ptrace signal getsched execheap execmem execstack };
init_dbus_chat_script(mono_t)
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 69e2534..3654ad3 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -186,17 +186,7 @@ tunable_policy(`deny_execmem',`',`
allow mozilla_t self:process execmem;
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mozilla_t)
- fs_manage_nfs_files(mozilla_t)
- fs_manage_nfs_symlinks(mozilla_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mozilla_t)
- fs_manage_cifs_files(mozilla_t)
- fs_manage_cifs_symlinks(mozilla_t)
-')
+userdom_home_manager(mozilla_t)
# Uploads, local html
tunable_policy(`mozilla_read_content && use_nfs_home_dirs',`
@@ -426,17 +416,7 @@ tunable_policy(`allow_execstack',`
allow mozilla_plugin_t self:process execstack;
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mozilla_plugin_t)
- fs_manage_nfs_files(mozilla_plugin_t)
- fs_manage_nfs_symlinks(mozilla_plugin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mozilla_plugin_t)
- fs_manage_cifs_files(mozilla_plugin_t)
- fs_manage_cifs_symlinks(mozilla_plugin_t)
-')
+userdom_home_manager(mozilla_plugin_t)
optional_policy(`
alsa_read_rw_config(mozilla_plugin_t)
diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index 8b1fa1b..320963b 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -84,6 +84,7 @@ userdom_read_user_tmp_files(mencoder_t)
userdom_read_user_tmp_symlinks(mencoder_t)
userdom_read_user_home_content_files(mencoder_t)
userdom_read_user_home_content_symlinks(mencoder_t)
+userdom_home_manager(mencoder_t)
# Read content to encode
ifndef(`enable_mls',`
@@ -104,46 +105,6 @@ tunable_policy(`allow_mplayer_execstack',`
allow mencoder_t self:process { execmem execstack };
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mencoder_t)
- fs_manage_nfs_files(mencoder_t)
- fs_manage_nfs_symlinks(mencoder_t)
-
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mencoder_t)
- fs_manage_cifs_files(mencoder_t)
- fs_manage_cifs_symlinks(mencoder_t)
-
-')
-
-# Read content to encode
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(mencoder_t)
- files_list_home(mencoder_t)
- fs_read_nfs_files(mencoder_t)
- fs_read_nfs_symlinks(mencoder_t)
-
-',`
- files_dontaudit_list_home(mencoder_t)
- fs_dontaudit_list_auto_mountpoints(mencoder_t)
- fs_dontaudit_read_nfs_files(mencoder_t)
- fs_dontaudit_list_nfs(mencoder_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_auto_mountpoints(mencoder_t)
- files_list_home(mencoder_t)
- fs_read_cifs_files(mencoder_t)
- fs_read_cifs_symlinks(mencoder_t)
-',`
- files_dontaudit_list_home(mencoder_t)
- fs_dontaudit_list_auto_mountpoints(mencoder_t)
- fs_dontaudit_read_cifs_files(mencoder_t)
- fs_dontaudit_list_cifs(mencoder_t)
-')
-
########################################
#
# mplayer local policy
@@ -242,6 +203,7 @@ userdom_read_user_tmp_symlinks(mplayer_t)
userdom_read_user_home_content_files(mplayer_t)
userdom_read_user_home_content_symlinks(mplayer_t)
userdom_write_user_tmp_sockets(mplayer_t)
+userdom_home_manager(mplayer_t)
xserver_user_x_domain_template(mplayer, mplayer_t, mplayer_tmpfs_t)
@@ -264,47 +226,12 @@ tunable_policy(`allow_mplayer_execstack',`
allow mplayer_t self:process { execmem execstack };
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mplayer_t)
- fs_manage_nfs_files(mplayer_t)
- fs_manage_nfs_symlinks(mplayer_t)
-')
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mplayer_t)
- fs_manage_cifs_files(mplayer_t)
- fs_manage_cifs_symlinks(mplayer_t)
-')
-
# Legacy domain issues
tunable_policy(`allow_mplayer_execstack',`
allow mplayer_t mplayer_tmpfs_t:file execute;
')
-# Read songs
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(mplayer_t)
- files_list_home(mplayer_t)
- fs_read_nfs_files(mplayer_t)
- fs_read_nfs_symlinks(mplayer_t)
-
-',`
- files_dontaudit_list_home(mplayer_t)
- fs_dontaudit_list_auto_mountpoints(mplayer_t)
- fs_dontaudit_read_nfs_files(mplayer_t)
- fs_dontaudit_list_nfs(mplayer_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_auto_mountpoints(mplayer_t)
- files_list_home(mplayer_t)
- fs_read_cifs_files(mplayer_t)
- fs_read_cifs_symlinks(mplayer_t)
-',`
- files_dontaudit_list_home(mplayer_t)
- fs_dontaudit_list_auto_mountpoints(mplayer_t)
- fs_dontaudit_read_cifs_files(mplayer_t)
- fs_dontaudit_list_cifs(mplayer_t)
-')
+userdom_home_manager(mplayer_t)
optional_policy(`
alsa_read_rw_config(mplayer_t)
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
index 3b6b4cb..cc6b555 100644
--- a/policy/modules/apps/nsplugin.te
+++ b/policy/modules/apps/nsplugin.te
@@ -208,10 +208,6 @@ optional_policy(`
')
optional_policy(`
- unconfined_execmem_signull(nsplugin_t)
-')
-
-optional_policy(`
sandbox_read_tmpfs_files(nsplugin_t)
')
@@ -329,7 +325,3 @@ optional_policy(`
pulseaudio_manage_home_files(nsplugin_t)
pulseaudio_setattr_home_dir(nsplugin_t)
')
-
-optional_policy(`
- unconfined_execmem_exec(nsplugin_t)
-')
diff --git a/policy/modules/apps/openoffice.fc b/policy/modules/apps/openoffice.fc
deleted file mode 100644
index 4428be4..0000000
--- a/policy/modules/apps/openoffice.fc
+++ /dev/null
@@ -1,3 +0,0 @@
-/usr/lib/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
-/opt/openoffice\.org.*/program/.+\.bin -- gen_context(system_u:object_r:openoffice_exec_t,s0)
-
diff --git a/policy/modules/apps/openoffice.if b/policy/modules/apps/openoffice.if
deleted file mode 100644
index 792bf9c..0000000
--- a/policy/modules/apps/openoffice.if
+++ /dev/null
@@ -1,124 +0,0 @@
-## <summary>Openoffice</summary>
-
-#######################################
-## <summary>
-## The per role template for the openoffice module.
-## </summary>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-interface(`openoffice_plugin_role',`
- gen_require(`
- type openoffice_exec_t;
- type openoffice_t;
- ')
-
- ########################################
- #
- # Local policy
- #
-
- domtrans_pattern($1, openoffice_exec_t, openoffice_t)
- allow $1 openoffice_t:process { signal sigkill };
-')
-
-#######################################
-## <summary>
-## role for openoffice
-## </summary>
-## <desc>
-## <p>
-## This template creates a derived domains which are used
-## for java applications.
-## </p>
-## </desc>
-## <param name="role_prefix">
-## <summary>
-## The prefix of the user domain (e.g., user
-## is the prefix for user_t).
-## </summary>
-## </param>
-## <param name="user_role">
-## <summary>
-## The role associated with the user domain.
-## </summary>
-## </param>
-## <param name="user_domain">
-## <summary>
-## The type of the user domain.
-## </summary>
-## </param>
-#
-interface(`openoffice_role_template',`
- gen_require(`
- type openoffice_exec_t;
- ')
-
- role $2 types $1_openoffice_t;
-
- type $1_openoffice_t;
- domain_type($1_openoffice_t)
- domain_entry_file($1_openoffice_t, openoffice_exec_t)
- domain_interactive_fd($1_openoffice_t)
-
- userdom_unpriv_usertype($1, $1_openoffice_t)
- userdom_exec_user_home_content_files($1_openoffice_t)
-
- allow $1_openoffice_t self:process { getsched sigkill execmem execstack };
-
- allow $3 $1_openoffice_t:process { getattr signal_perms noatsecure siginh rlimitinh };
- allow $1_openoffice_t $3:tcp_socket { read write };
-
- domtrans_pattern($3, openoffice_exec_t, $1_openoffice_t)
-
- dev_read_urand($1_openoffice_t)
- dev_read_rand($1_openoffice_t)
-
- fs_dontaudit_rw_tmpfs_files($1_openoffice_t)
-
- allow $3 $1_openoffice_t:process { signal sigkill };
- allow $1_openoffice_t $3:unix_stream_socket connectto;
-
- optional_policy(`
- xserver_role($2, $1_openoffice_t)
- ')
-')
-
-########################################
-## <summary>
-## Execute openoffice_exec_t
-## in the specified domain.
-## </summary>
-## <desc>
-## <p>
-## Execute a openoffice_exec_t
-## in the specified domain.
-## </p>
-## <p>
-## No interprocess communication (signals, pipes,
-## etc.) is provided by this interface since
-## the domains are not owned by this module.
-## </p>
-## </desc>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-## <param name="target_domain">
-## <summary>
-## The type of the new process.
-## </summary>
-## </param>
-#
-interface(`openoffice_exec_domtrans',`
- gen_require(`
- type openoffice_exec_t;
- ')
-
- allow $2 openoffice_exec_t:file entrypoint;
- domtrans_pattern($1, openoffice_exec_t, $2)
-')
diff --git a/policy/modules/apps/openoffice.te b/policy/modules/apps/openoffice.te
deleted file mode 100644
index a842371..0000000
--- a/policy/modules/apps/openoffice.te
+++ /dev/null
@@ -1,16 +0,0 @@
-policy_module(openoffice, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type openoffice_t;
-type openoffice_exec_t;
-application_domain(openoffice_t, openoffice_exec_t)
-
-########################################
-#
-# Unconfined java local policy
-#
-
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te
index 5314e57..a4f8158 100644
--- a/policy/modules/apps/pulseaudio.te
+++ b/policy/modules/apps/pulseaudio.te
@@ -43,6 +43,7 @@ allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms;
manage_dirs_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
manage_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
+manage_lnk_files_pattern(pulseaudio_t, pulseaudio_home_t, pulseaudio_home_t)
userdom_search_user_home_dirs(pulseaudio_t)
userdom_search_admin_dir(pulseaudio_t)
diff --git a/policy/modules/apps/screen.if b/policy/modules/apps/screen.if
index f9fbc60..b0b3ce6 100644
--- a/policy/modules/apps/screen.if
+++ b/policy/modules/apps/screen.if
@@ -39,6 +39,8 @@ template(`screen_role_template',`
ubac_constrained($1_screen_t)
role $2 types $1_screen_t;
+ userdom_home_reader($1_screen_t)
+
domtrans_pattern($3, screen_exec_t, $1_screen_t)
allow $3 $1_screen_t:process { signal sigchld };
dontaudit $3 $1_screen_t:unix_stream_socket { read write };
diff --git a/policy/modules/apps/screen.te b/policy/modules/apps/screen.te
index b3b144c..0bd13e3 100644
--- a/policy/modules/apps/screen.te
+++ b/policy/modules/apps/screen.te
@@ -115,12 +115,3 @@ userdom_create_user_pty(screen_domain)
userdom_setattr_user_ptys(screen_domain)
userdom_setattr_user_ttys(screen_domain)
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_symlinks(screen_domain)
- fs_list_cifs(screen_domain)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(screen_domain)
- fs_read_nfs_symlinks(screen_domain)
-')
diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
index 546f5a5..7942965 100644
--- a/policy/modules/apps/telepathy.te
+++ b/policy/modules/apps/telepathy.te
@@ -116,15 +116,7 @@ tunable_policy(`telepathy_tcp_connect_generic_network_ports',`
corenet_sendrecv_generic_client_packets(telepathy_gabble_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_gabble_t)
- fs_manage_nfs_files(telepathy_gabble_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_gabble_t)
- fs_manage_cifs_files(telepathy_gabble_t)
-')
+userdom_home_manager(telepathy_gabble_t)
optional_policy(`
dbus_system_bus_client(telepathy_gabble_t)
@@ -183,15 +175,7 @@ files_search_pids(telepathy_logger_t)
fs_getattr_all_fs(telepathy_logger_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_logger_t)
- fs_manage_nfs_files(telepathy_logger_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_logger_t)
- fs_manage_cifs_files(telepathy_logger_t)
-')
+userdom_home_manager(telepathy_logger_t)
optional_policy(`
# ~/.config/dconf/user
@@ -220,15 +204,7 @@ fs_getattr_all_fs(telepathy_mission_control_t)
files_read_etc_files(telepathy_mission_control_t)
files_read_usr_files(telepathy_mission_control_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(telepathy_mission_control_t)
- fs_manage_nfs_files(telepathy_mission_control_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(telepathy_mission_control_t)
- fs_manage_cifs_files(telepathy_mission_control_t)
-')
+userdom_home_manager(telepathy_mission_control_t)
optional_policy(`
dbus_system_bus_client(telepathy_mission_control_t)
diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te
index f50789e..9ba6da8 100644
--- a/policy/modules/apps/thunderbird.te
+++ b/policy/modules/apps/thunderbird.te
@@ -114,17 +114,7 @@ xserver_read_xdm_tmp_files(thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
# Access ~/.thunderbird
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(thunderbird_t)
- fs_manage_nfs_files(thunderbird_t)
- fs_manage_nfs_symlinks(thunderbird_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(thunderbird_t)
- fs_manage_cifs_files(thunderbird_t)
- fs_manage_cifs_symlinks(thunderbird_t)
-')
+userdom_home_manager(thunderbird_t)
tunable_policy(`mail_read_content && use_nfs_home_dirs',`
files_list_home(thunderbird_t)
diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 98bfbf3..38318b9 100644
--- a/policy/modules/apps/tvtime.te
+++ b/policy/modules/apps/tvtime.te
@@ -77,16 +77,7 @@ userdom_use_inherited_user_terminals(tvtime_t)
userdom_read_user_home_content_files(tvtime_t)
# X access, Home files
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(tvtime_t)
- fs_manage_nfs_files(tvtime_t)
- fs_manage_nfs_symlinks(tvtime_t)
-')
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(tvtime_t)
- fs_manage_cifs_files(tvtime_t)
- fs_manage_cifs_symlinks(tvtime_t)
-')
+userdom_home_manager(tvtime_t)
optional_policy(`
xserver_user_x_domain_template(tvtime, tvtime_t, tvtime_tmpfs_t)
diff --git a/policy/modules/apps/wireshark.te b/policy/modules/apps/wireshark.te
index 95a3d06..356e2a1 100644
--- a/policy/modules/apps/wireshark.te
+++ b/policy/modules/apps/wireshark.te
@@ -97,17 +97,7 @@ sysnet_read_config(wireshark_t)
userdom_manage_user_home_content_files(wireshark_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(wireshark_t)
- fs_manage_nfs_files(wireshark_t)
- fs_manage_nfs_symlinks(wireshark_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(wireshark_t)
- fs_manage_cifs_files(wireshark_t)
- fs_manage_cifs_symlinks(wireshark_t)
-')
+userdom_home_manager(wireshark_t)
# Manual transition from userhelper
optional_policy(`
diff --git a/policy/modules/kernel/corecommands.fc b/policy/modules/kernel/corecommands.fc
index 7bcafea..0b0896b 100644
--- a/policy/modules/kernel/corecommands.fc
+++ b/policy/modules/kernel/corecommands.fc
@@ -302,6 +302,7 @@ ifdef(`distro_gentoo',`
/usr/share/shorewall6-lite(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/spamassassin/sa-update\.cron gen_context(system_u:object_r:bin_t,s0)
/usr/share/turboprint/lib(/.*)? -- gen_context(system_u:object_r:bin_t,s0)
+/usr/share/tucan.*/tucan.py -- gen_context(system_u:object_r:bin_t,s0)
/usr/share/vhostmd/scripts(/.*)? gen_context(system_u:object_r:bin_t,s0)
/usr/share/virtualbox/.*\.sh gen_context(system_u:object_r:bin_t,s0)
/usr/share/wicd/daemon(/.*)? gen_context(system_u:object_r:bin_t,s0)
diff --git a/policy/modules/kernel/corecommands.te b/policy/modules/kernel/corecommands.te
index 9527971..23a1c3c 100644
--- a/policy/modules/kernel/corecommands.te
+++ b/policy/modules/kernel/corecommands.te
@@ -13,7 +13,7 @@ attribute exec_type;
#
# bin_t is the type of files in the system bin/sbin directories.
#
-type bin_t alias { ls_exec_t sbin_t java_exec_t execmem_exec_t mono_exec_t };
+type bin_t alias { ls_exec_t sbin_t };
corecmd_executable_file(bin_t)
dev_associate(bin_t) #For /dev/MAKEDEV
diff --git a/policy/modules/kernel/devices.fc b/policy/modules/kernel/devices.fc
index 12bd6fc..b48524e 100644
--- a/policy/modules/kernel/devices.fc
+++ b/policy/modules/kernel/devices.fc
@@ -137,6 +137,7 @@ ifdef(`distro_suse', `
/dev/bus/usb/.*/[0-9]+ -c gen_context(system_u:object_r:usb_device_t,s0)
+/dev/ati/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/card.* -c gen_context(system_u:object_r:xserver_misc_device_t,s0)
/dev/cmx.* -c gen_context(system_u:object_r:smartcard_device_t,s0)
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if
index e5652a1..6342520 100644
--- a/policy/modules/kernel/filesystem.if
+++ b/policy/modules/kernel/filesystem.if
@@ -2167,6 +2167,24 @@ interface(`fs_read_fusefs_symlinks',`
########################################
## <summary>
+## Manage symbolic links on a FUSEFS filesystem.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`fs_manage_fusefs_symlinks',`
+ gen_require(`
+ type fusefs_t;
+ ')
+
+ manage_lnk_files_pattern($1, fusefs_t, fusefs_t)
+')
+
+########################################
+## <summary>
## Get the attributes of an hugetlbfs
## filesystem.
## </summary>
diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index cfea862..de3c13e 100644
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -66,6 +66,10 @@ optional_policy(`
')
optional_policy(`
+ blueman_dbus_chat(staff_t)
+')
+
+optional_policy(`
dbadm_role_change(staff_r)
')
@@ -234,10 +238,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- blueman_dbus_chat(staff_t)
- ')
-
- optional_policy(`
bluetooth_role(staff_r, staff_t)
')
diff --git a/policy/modules/roles/unconfineduser.if b/policy/modules/roles/unconfineduser.if
index 8b2cdf3..bac0dc0 100644
--- a/policy/modules/roles/unconfineduser.if
+++ b/policy/modules/roles/unconfineduser.if
@@ -220,42 +220,6 @@ interface(`unconfined_signull',`
########################################
## <summary>
-## Send a SIGNULL signal to the unconfined execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_signull',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:process signull;
-')
-
-########################################
-## <summary>
-## Send a signal to the unconfined execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_signal',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:process signal;
-')
-
-########################################
-## <summary>
## Send generic signals to the unconfined domain.
## </summary>
## <param name="domain">
@@ -557,62 +521,6 @@ interface(`unconfined_rw_shm',`
########################################
## <summary>
-## Read and write to unconfined execmem shared memory.
-## </summary>
-## <param name="domain">
-## <summary>
-## The type of the process performing this action.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_rw_shm',`
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- allow $1 unconfined_execmem_t:shm rw_shm_perms;
-')
-
-########################################
-## <summary>
-## Transition to the unconfined_execmem domain.
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_domtrans',`
-
- gen_require(`
- type unconfined_execmem_t;
- ')
-
- execmem_domtrans($1, unconfined_execmem_t)
-')
-
-########################################
-## <summary>
-## execute the execmem applications
-## </summary>
-## <param name="domain">
-## <summary>
-## Domain allowed access.
-## </summary>
-## </param>
-#
-interface(`unconfined_execmem_exec',`
-
- gen_require(`
- type execmem_exec_t;
- ')
-
- can_exec($1, execmem_exec_t)
-')
-
-########################################
-## <summary>
## Allow apps to set rlimits on userdomain
## </summary>
## <param name="domain">
diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 4ce2685..11ad8fb 100644
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -320,13 +320,6 @@ optional_policy(`
')
optional_policy(`
- mono_role_template(unconfined, unconfined_r, unconfined_t)
- unconfined_domain_noaudit(unconfined_mono_t)
- role system_r types unconfined_mono_t;
-')
-
-
-optional_policy(`
mozilla_role_plugin(unconfined_r)
tunable_policy(`unconfined_mozilla_plugin_transition', `
diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index 9db5ebd..454e627 100644
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -31,6 +31,10 @@ optional_policy(`
')
optional_policy(`
+ blueman_dbus_chat(user_t)
+')
+
+optional_policy(`
colord_dbus_chat(user_t)
')
@@ -116,10 +120,6 @@ ifndef(`distro_redhat',`
')
optional_policy(`
- blueman_dbus_chat(staff_t)
- ')
-
- optional_policy(`
bluetooth_role(user_r, user_t)
')
diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te
index b1ea76e..6f176f9 100644
--- a/policy/modules/roles/xguest.te
+++ b/policy/modules/roles/xguest.te
@@ -86,6 +86,13 @@ optional_policy(`
')
optional_policy(`
+ tunable_policy(`xguest_use_bluetooth',`
+ blueman_dbus_chat(xguest_t)
+ ')
+')
+
+
+optional_policy(`
chrome_role(xguest_r, xguest_usertype)
')
@@ -106,10 +113,6 @@ optional_policy(`
')
optional_policy(`
- mono_role_template(xguest, xguest_r, xguest_t)
-')
-
-optional_policy(`
mozilla_run_plugin(xguest_usertype, xguest_r)
')
diff --git a/policy/modules/services/apache.te b/policy/modules/services/apache.te
index 7cb2fe5..2ef8fef 100644
--- a/policy/modules/services/apache.te
+++ b/policy/modules/services/apache.te
@@ -1401,5 +1401,3 @@ tunable_policy(`httpd_builtin_scripting',`
read_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
read_lnk_files_pattern(httpd_t, httpd_content_type, httpd_content_type)
')
-
-
diff --git a/policy/modules/services/blueman.te b/policy/modules/services/blueman.te
index fde1531..12ef44c 100644
--- a/policy/modules/services/blueman.te
+++ b/policy/modules/services/blueman.te
@@ -26,6 +26,7 @@ domain_use_interactive_fds(blueman_t)
files_read_etc_files(blueman_t)
files_read_usr_files(blueman_t)
+auth_use_nsswitch(blueman_t)
auth_read_passwd(blueman_t)
logging_send_syslog_msg(blueman_t)
diff --git a/policy/modules/services/cloudform.te b/policy/modules/services/cloudform.te
index 5c0c84f..83fc37d 100644
--- a/policy/modules/services/cloudform.te
+++ b/policy/modules/services/cloudform.te
@@ -137,12 +137,7 @@ corenet_tcp_connect_all_ports(iwhd_t)
dev_read_rand(iwhd_t)
dev_read_urand(iwhd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_auto_mountpoints(iwhd_t)
- fs_manage_nfs_dirs(iwhd_t)
- fs_manage_nfs_files(iwhd_t)
- fs_manage_nfs_symlinks(iwhd_t)
-')
+userdom_home_manager(iwhd_t)
########################################
#
diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
index 6ff206b..74f1baa 100644
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
@@ -91,15 +91,7 @@ sysnet_dns_name_resolve(colord_t)
userdom_rw_user_tmpfs_files(colord_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_getattr_nfs(colord_t)
- fs_read_nfs_files(colord_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_getattr_cifs(colord_t)
- fs_read_cifs_files(colord_t)
-')
+userdom_home_reader(colord_t)
optional_policy(`
cups_read_config(colord_t)
diff --git a/policy/modules/services/consolekit.te b/policy/modules/services/consolekit.te
index 5b322ca..d45381d 100644
--- a/policy/modules/services/consolekit.te
+++ b/policy/modules/services/consolekit.te
@@ -82,13 +82,7 @@ userdom_dontaudit_read_user_home_content_files(consolekit_t)
userdom_dontaudit_getattr_admin_home_files(consolekit_t)
userdom_read_user_tmp_files(consolekit_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(consolekit_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(consolekit_t)
-')
+userdom_home_reader(consolekit_t)
optional_policy(`
cron_read_system_job_lib_files(consolekit_t)
diff --git a/policy/modules/services/cron.te b/policy/modules/services/cron.te
index 258a3d7..a2e960c 100644
--- a/policy/modules/services/cron.te
+++ b/policy/modules/services/cron.te
@@ -300,10 +300,6 @@ optional_policy(`
')
optional_policy(`
- mono_domtrans(crond_t)
-')
-
-optional_policy(`
amanda_search_var_lib(crond_t)
')
@@ -553,10 +549,6 @@ optional_policy(`
')
optional_policy(`
- mono_domtrans(system_cronjob_t)
-')
-
-optional_policy(`
mrtg_append_create_logs(system_cronjob_t)
')
diff --git a/policy/modules/services/cups.te b/policy/modules/services/cups.te
index 825cafb..3bc4cfd 100644
--- a/policy/modules/services/cups.te
+++ b/policy/modules/services/cups.te
@@ -625,16 +625,7 @@ optional_policy(`
lpd_manage_spool(cups_pdf_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_search_auto_mountpoints(cups_pdf_t)
- fs_manage_nfs_dirs(cups_pdf_t)
- fs_manage_nfs_files(cups_pdf_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
-')
+userdom_home_manager(cups_pdf_t)
optional_policy(`
gnome_read_config(cups_pdf_t)
diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 3558f18..115133d 100644
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -56,6 +56,8 @@ template(`dbus_role_template',`
ubac_constrained($1_dbusd_t)
role $2 types $1_dbusd_t;
+ userdom_home_manager($1_dbusd_t)
+
##############################
#
# Local policy
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index f0266a9..c9396db 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -143,13 +143,7 @@ seutil_sigchld_newrole(system_dbusd_t)
userdom_dontaudit_use_unpriv_user_fds(system_dbusd_t)
userdom_dontaudit_search_user_home_dirs(system_dbusd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(system_dbusd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(system_dbusd_t)
-')
+userdom_home_reader(system_dbusd_t)
optional_policy(`
bind_domtrans(system_dbusd_t)
@@ -309,16 +303,6 @@ userdom_manage_user_home_content_dirs(session_bus_type)
userdom_manage_user_home_content_files(session_bus_type)
userdom_user_home_dir_filetrans_user_home_content(session_bus_type, { dir file })
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(session_bus_type)
- fs_manage_nfs_files(session_bus_type)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(session_bus_type)
- fs_manage_cifs_files(session_bus_type)
-')
-
optional_policy(`
gnome_read_gconf_home_files(session_bus_type)
')
diff --git a/policy/modules/services/dovecot.te b/policy/modules/services/dovecot.te
index 2fbb869..194f170 100644
--- a/policy/modules/services/dovecot.te
+++ b/policy/modules/services/dovecot.te
@@ -142,6 +142,7 @@ files_dontaudit_list_default(dovecot_t)
# Dovecot now has quota support and it uses getmntent() to find the mountpoints.
files_read_etc_runtime_files(dovecot_t)
files_search_all_mountpoints(dovecot_t)
+files_read_var_lib_files(dovecot_t)
init_getattr_utmp(dovecot_t)
@@ -152,6 +153,7 @@ logging_send_syslog_msg(dovecot_t)
miscfiles_read_generic_certs(dovecot_t)
miscfiles_read_localization(dovecot_t)
+userdom_home_manager(dovecot_t)
userdom_dontaudit_use_unpriv_user_fds(dovecot_t)
userdom_manage_user_home_content_dirs(dovecot_t)
userdom_manage_user_home_content_files(dovecot_t)
@@ -238,7 +240,6 @@ files_read_usr_files(dovecot_auth_t)
files_read_usr_symlinks(dovecot_auth_t)
files_read_var_lib_files(dovecot_auth_t)
files_search_tmp(dovecot_auth_t)
-files_read_var_lib_files(dovecot_t)
fs_getattr_xattr_fs(dovecot_auth_t)
@@ -330,23 +331,7 @@ userdom_manage_user_home_content_pipes(dovecot_deliver_t)
userdom_manage_user_home_content_sockets(dovecot_deliver_t)
userdom_user_home_dir_filetrans_user_home_content(dovecot_deliver_t, { dir file lnk_file fifo_file sock_file })
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(dovecot_deliver_t)
- fs_manage_nfs_files(dovecot_deliver_t)
- fs_manage_nfs_symlinks(dovecot_deliver_t)
- fs_manage_nfs_dirs(dovecot_t)
- fs_manage_nfs_files(dovecot_t)
- fs_manage_nfs_symlinks(dovecot_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(dovecot_deliver_t)
- fs_manage_cifs_files(dovecot_deliver_t)
- fs_manage_cifs_symlinks(dovecot_deliver_t)
- fs_manage_cifs_dirs(dovecot_t)
- fs_manage_cifs_files(dovecot_t)
- fs_manage_cifs_symlinks(dovecot_t)
-')
+userdom_home_manager(dovecot_deliver_t)
optional_policy(`
gnome_manage_data(dovecot_deliver_t)
diff --git a/policy/modules/services/fail2ban.te b/policy/modules/services/fail2ban.te
index 2599f96..c7a0911 100644
--- a/policy/modules/services/fail2ban.te
+++ b/policy/modules/services/fail2ban.te
@@ -98,6 +98,9 @@ miscfiles_read_localization(fail2ban_t)
mta_send_mail(fail2ban_t)
+sysnet_manage_config(fail2ban_t)
+sysnet_filetrans_named_content(fail2ban_t)
+
optional_policy(`
apache_read_log(fail2ban_t)
')
diff --git a/policy/modules/services/ftp.te b/policy/modules/services/ftp.te
index 3bc14c3..6c4a30d 100644
--- a/policy/modules/services/ftp.te
+++ b/policy/modules/services/ftp.te
@@ -458,16 +458,4 @@ tunable_policy(`sftpd_full_access',`
files_manage_non_security_files(sftpd_t)
')
-tunable_policy(`use_samba_home_dirs',`
- # allow read access to /home by default
- fs_list_cifs(sftpd_t)
- fs_read_cifs_files(sftpd_t)
- fs_read_cifs_symlinks(sftpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- # allow read access to /home by default
- fs_list_nfs(sftpd_t)
- fs_read_nfs_files(sftpd_t)
- fs_read_nfs_symlinks(ftpd_t)
-')
+userdom_home_reader(sftpd_t)
diff --git a/policy/modules/services/git.if b/policy/modules/services/git.if
index 27945d1..9077b2d 100644
--- a/policy/modules/services/git.if
+++ b/policy/modules/services/git.if
@@ -209,17 +209,7 @@ interface(`git_rwx_all_content',`
userdom_search_user_home_dirs($1)
files_search_var_lib($1)
- tunable_policy(`use_nfs_home_dirs',`
- fs_exec_nfs_files($1)
- fs_manage_nfs_dirs($1)
- fs_manage_nfs_files($1)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_exec_cifs_files($1)
- fs_manage_cifs_dirs($1)
- fs_manage_cifs_files($1)
- ')
+ userdom_home_manager($1)
tunable_policy(`git_system_use_cifs',`
fs_exec_cifs_files($1)
@@ -323,15 +313,7 @@ interface(`git_read_all_content_files',`
userdom_search_user_home_dirs($1)
files_search_var_lib($1)
- tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs($1)
- fs_read_nfs_files($1)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs($1)
- fs_read_cifs_files($1)
- ')
+ userdom_home_reader($1)
tunable_policy(`git_system_use_cifs',`
fs_list_cifs($1)
@@ -363,16 +345,7 @@ interface(`git_read_session_content_files',`
list_dirs_pattern($1, git_session_content_t, git_session_content_t)
read_files_pattern($1, git_session_content_t, git_session_content_t)
userdom_search_user_home_dirs($1)
-
- tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs($1)
- fs_read_nfs_files($1)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs($1)
- fs_read_cifs_files($1)
- ')
+ userdom_home_reader($1)
')
#######################################
diff --git a/policy/modules/services/git.te b/policy/modules/services/git.te
index 2ef543c..fa32fcf 100644
--- a/policy/modules/services/git.te
+++ b/policy/modules/services/git.te
@@ -166,15 +166,7 @@ tunable_policy(`git_session_bind_all_unreserved_ports',`
corenet_sendrecv_generic_server_packets(git_session_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(git_session_t)
- fs_read_nfs_files(git_session_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs(git_session_t)
- fs_read_cifs_files(git_session_t)
-')
+userdom_home_reader(git_session_t)
########################################
#
diff --git a/policy/modules/services/i18n_input.te b/policy/modules/services/i18n_input.te
index 5fc89c4..738c3e2 100644
--- a/policy/modules/services/i18n_input.te
+++ b/policy/modules/services/i18n_input.te
@@ -74,16 +74,7 @@ sysnet_read_config(i18n_input_t)
userdom_dontaudit_use_unpriv_user_fds(i18n_input_t)
userdom_read_user_home_content_files(i18n_input_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(i18n_input_t)
- fs_read_nfs_symlinks(i18n_input_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(i18n_input_t)
- fs_read_cifs_symlinks(i18n_input_t)
-')
+userdom_home_reader(i18n_input_t)
optional_policy(`
canna_stream_connect(i18n_input_t)
diff --git a/policy/modules/services/lpd.te b/policy/modules/services/lpd.te
index f28acd2..27d96e1 100644
--- a/policy/modules/services/lpd.te
+++ b/policy/modules/services/lpd.te
@@ -308,19 +308,7 @@ tunable_policy(`use_lpd_server',`
read_lnk_files_pattern(lpr_t, printconf_t, printconf_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- files_list_home(lpr_t)
- fs_list_auto_mountpoints(lpr_t)
- fs_read_nfs_files(lpr_t)
- fs_read_nfs_symlinks(lpr_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- files_list_home(lpr_t)
- fs_list_auto_mountpoints(lpr_t)
- fs_read_cifs_files(lpr_t)
- fs_read_cifs_symlinks(lpr_t)
-')
+userdom_home_reader(lpr_t)
optional_policy(`
cups_read_config(lpr_t)
diff --git a/policy/modules/services/mock.te b/policy/modules/services/mock.te
index b1107b5..4389219 100644
--- a/policy/modules/services/mock.te
+++ b/policy/modules/services/mock.te
@@ -127,6 +127,7 @@ userdom_use_user_ptys(mock_t)
files_search_home(mock_t)
tunable_policy(`mock_enable_homedirs',`
+ userdom_manage_user_home_content_dirs(mock_t)
userdom_manage_user_home_content_files(mock_t)
')
diff --git a/policy/modules/services/mpd.te b/policy/modules/services/mpd.te
index e4ac35e..36ff69d 100644
--- a/policy/modules/services/mpd.te
+++ b/policy/modules/services/mpd.te
@@ -108,16 +108,7 @@ miscfiles_read_localization(mpd_t)
userdom_read_home_audio_files(mpd_t)
userdom_read_user_tmpfs_files(mpd_t)
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(mpd_t)
- fs_read_cifs_symlinks(mpd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(mpd_t)
- fs_read_nfs_symlinks(mpd_t)
-')
+userdom_home_reader(mpd_t)
optional_policy(`
alsa_read_rw_config(mpd_t)
diff --git a/policy/modules/services/mta.if b/policy/modules/services/mta.if
index e5519fd..867dfac 100644
--- a/policy/modules/services/mta.if
+++ b/policy/modules/services/mta.if
@@ -340,6 +340,8 @@ interface(`mta_mailserver_delivery',`
')
typeattribute $1 mailserver_delivery;
+
+ userdom_home_manager($1)
')
#######################################
diff --git a/policy/modules/services/mta.te b/policy/modules/services/mta.te
index 65fd01f..7f55b85 100644
--- a/policy/modules/services/mta.te
+++ b/policy/modules/services/mta.te
@@ -233,18 +233,6 @@ read_files_pattern(mailserver_delivery, mail_home_t, mail_home_t)
read_files_pattern(mailserver_delivery, system_mail_tmp_t, system_mail_tmp_t)
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(mailserver_delivery)
- fs_manage_cifs_files(mailserver_delivery)
- fs_manage_cifs_symlinks(mailserver_delivery)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(mailserver_delivery)
- fs_manage_nfs_files(mailserver_delivery)
- fs_manage_nfs_symlinks(mailserver_delivery)
-')
-
optional_policy(`
dovecot_manage_spool(mailserver_delivery)
dovecot_domtrans_deliver(mailserver_delivery)
diff --git a/policy/modules/services/oident.te b/policy/modules/services/oident.te
index 98f541f..58148ed 100644
--- a/policy/modules/services/oident.te
+++ b/policy/modules/services/oident.te
@@ -59,17 +59,8 @@ miscfiles_read_localization(oidentd_t)
sysnet_read_config(oidentd_t)
oident_read_user_content(oidentd_t)
+userdom_home_reader(oidentd_t)
optional_policy(`
nis_use_ypbind(oidentd_t)
')
-
-tunable_policy(`use_samba_home_dirs', `
- fs_list_cifs(oidentd_t)
- fs_read_cifs_files(oidentd_t)
-')
-
-tunable_policy(`use_nfs_home_dirs', `
- fs_list_nfs(oidentd_t)
- fs_read_nfs_files(oidentd_t)
-')
diff --git a/policy/modules/services/polipo.te b/policy/modules/services/polipo.te
index 89ab1b6..d958b53 100644
--- a/policy/modules/services/polipo.te
+++ b/policy/modules/services/polipo.te
@@ -146,14 +146,4 @@ tunable_policy(`polipo_session_send_syslog_msg',`
logging_send_syslog_msg(polipo_session_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(polipo_session_t)
-',`
- fs_dontaudit_manage_nfs_files(polipo_session_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(polipo_session_t)
-',`
- fs_dontaudit_manage_cifs_files(polipo_session_t)
-')
+userdom_home_manager(polipo_session_t)
diff --git a/policy/modules/services/procmail.te b/policy/modules/services/procmail.te
index 6451f82..4c188f9 100644
--- a/policy/modules/services/procmail.te
+++ b/policy/modules/services/procmail.te
@@ -110,17 +110,7 @@ ifdef(`hide_broken_symptoms',`
mta_dontaudit_rw_queue(procmail_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(procmail_t)
- fs_manage_nfs_files(procmail_t)
- fs_manage_nfs_symlinks(procmail_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(procmail_t)
- fs_manage_cifs_files(procmail_t)
- fs_manage_cifs_symlinks(procmail_t)
-')
+userdom_home_manager(procmail_t)
optional_policy(`
clamav_domtrans_clamscan(procmail_t)
diff --git a/policy/modules/services/razor.te b/policy/modules/services/razor.te
index cc1775e..9405f78 100644
--- a/policy/modules/services/razor.te
+++ b/policy/modules/services/razor.te
@@ -121,17 +121,7 @@ ifdef(`distro_redhat',`
userdom_search_user_home_dirs(razor_t)
userdom_use_inherited_user_terminals(razor_t)
- tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(razor_t)
- fs_manage_nfs_files(razor_t)
- fs_manage_nfs_symlinks(razor_t)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(razor_t)
- fs_manage_cifs_files(razor_t)
- fs_manage_cifs_symlinks(razor_t)
- ')
+ userdom_home_manager(razor_t)
optional_policy(`
milter_manage_spamass_state(razor_t)
diff --git a/policy/modules/services/remotelogin.te b/policy/modules/services/remotelogin.te
index adc198d..a475797 100644
--- a/policy/modules/services/remotelogin.te
+++ b/policy/modules/services/remotelogin.te
@@ -88,15 +88,7 @@ userdom_manage_user_tmp_dirs(remote_login_t)
userdom_manage_user_tmp_files(remote_login_t)
userdom_tmp_filetrans_user_tmp(remote_login_t, { file dir })
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(remote_login_t)
- fs_read_nfs_symlinks(remote_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(remote_login_t)
- fs_read_cifs_symlinks(remote_login_t)
-')
+userdom_home_reader(remote_login_t)
optional_policy(`
alsa_domtrans(remote_login_t)
diff --git a/policy/modules/services/rlogin.te b/policy/modules/services/rlogin.te
index 4bcaacc..91c8ee8 100644
--- a/policy/modules/services/rlogin.te
+++ b/policy/modules/services/rlogin.te
@@ -92,21 +92,10 @@ userdom_search_admin_dir(rlogind_t)
userdom_manage_user_tmp_files(rlogind_t)
userdom_tmp_filetrans_user_tmp(rlogind_t, file)
userdom_use_user_terminals(rlogind_t)
+userdom_home_reader(rlogind_t)
rlogin_read_home_content(rlogind_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_list_nfs(rlogind_t)
- fs_read_nfs_files(rlogind_t)
- fs_read_nfs_symlinks(rlogind_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_list_cifs(rlogind_t)
- fs_read_cifs_files(rlogind_t)
- fs_read_cifs_symlinks(rlogind_t)
-')
-
optional_policy(`
kerberos_keytab_template(rlogind, rlogind_t)
kerberos_manage_host_rcache(rlogind_t)
diff --git a/policy/modules/services/rshd.te b/policy/modules/services/rshd.te
index 49a4283..cdf9184 100644
--- a/policy/modules/services/rshd.te
+++ b/policy/modules/services/rshd.te
@@ -68,15 +68,7 @@ seutil_read_default_contexts(rshd_t)
userdom_search_user_home_content(rshd_t)
userdom_manage_tmp_role(system_r, rshd_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(rshd_t)
- fs_read_nfs_symlinks(rshd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(rshd_t)
- fs_read_cifs_symlinks(rshd_t)
-')
+userdom_home_reader(rshd_t)
optional_policy(`
kerberos_keytab_template(rshd, rshd_t)
diff --git a/policy/modules/services/spamassassin.te b/policy/modules/services/spamassassin.te
index a370364..32019d8 100644
--- a/policy/modules/services/spamassassin.te
+++ b/policy/modules/services/spamassassin.te
@@ -147,6 +147,7 @@ manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
manage_fifo_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
manage_sock_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
userdom_user_home_dir_filetrans(spamd_t, spamassassin_home_t, { dir file lnk_file sock_file fifo_file })
+userdom_home_manager(spamassassin_t)
kernel_read_kernel_sysctls(spamassassin_t)
@@ -207,18 +208,6 @@ tunable_policy(`spamd_enable_home_dirs',`
userdom_manage_user_home_content_symlinks(spamd_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamassassin_t)
- fs_manage_nfs_files(spamassassin_t)
- fs_manage_nfs_symlinks(spamassassin_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamassassin_t)
- fs_manage_cifs_files(spamassassin_t)
- fs_manage_cifs_symlinks(spamassassin_t)
-')
-
optional_policy(`
# Write pid file and socket in ~/.evolution/cache/tmp
evolution_home_filetrans(spamd_t, spamd_tmp_t, { file sock_file })
@@ -328,18 +317,7 @@ seutil_read_config(spamc_t)
sysnet_read_config(spamc_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamc_t)
- fs_manage_nfs_files(spamc_t)
- fs_manage_nfs_symlinks(spamc_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamc_t)
- fs_manage_cifs_files(spamc_t)
- fs_manage_cifs_symlinks(spamc_t)
-')
-
+userdom_home_manager(spamc_t)
optional_policy(`
abrt_stream_connect(spamc_t)
@@ -479,22 +457,13 @@ miscfiles_read_localization(spamd_t)
userdom_use_unpriv_users_fds(spamd_t)
userdom_search_user_home_dirs(spamd_t)
+userdom_home_manager(spamd_t)
optional_policy(`
exim_manage_spool_dirs(spamd_t)
exim_manage_spool_files(spamd_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamd_t)
- fs_manage_nfs_files(spamd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamd_t)
- fs_manage_cifs_files(spamd_t)
-')
-
optional_policy(`
amavis_manage_lib_files(spamd_t)
')
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index 5439f7e..126255f 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -277,19 +277,7 @@ template(`ssh_server_template',`
# Allow checking users mail at login
mta_getattr_spool($1_t)
- tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_dirs($1_t)
- fs_manage_fusefs_files($1_t)
- ')
-
- tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files($1_t)
- fs_read_nfs_symlinks($1_t)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files($1_t)
- ')
+ userdom_home_manager($1_t)
optional_policy(`
kerberos_use($1_t)
@@ -443,19 +431,7 @@ template(`ssh_role_template',`
ssh_exec_keygen($3)
- tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files($1_ssh_agent_t)
-
- # transition back to normal privs upon exec
- fs_nfs_domtrans($1_ssh_agent_t, $3)
- ')
-
- tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files($1_ssh_agent_t)
-
- # transition back to normal privs upon exec
- fs_cifs_domtrans($1_ssh_agent_t, $3)
- ')
+ userdom_home_manager($1_ssh_agent_t)
optional_policy(`
nis_use_ypbind($1_ssh_agent_t)
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 02e70c9..e93db05 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -200,6 +200,7 @@ userdom_read_user_tmp_files(ssh_t)
userdom_write_user_tmp_files(ssh_t)
userdom_read_user_home_content_symlinks(ssh_t)
userdom_read_home_certs(ssh_t)
+userdom_home_manager(ssh_t)
tunable_policy(`allow_ssh_keysign',`
domtrans_pattern(ssh_t, ssh_keysign_exec_t, ssh_keysign_t)
@@ -210,16 +211,6 @@ tunable_policy(`use_fusefs_home_dirs',`
fs_manage_fusefs_files(ssh_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(ssh_t)
- fs_manage_nfs_files(ssh_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(ssh_t)
- fs_manage_cifs_files(ssh_t)
-')
-
# for port forwarding
tunable_policy(`user_tcp_server',`
corenet_tcp_bind_ssh_port(ssh_t)
@@ -498,14 +489,7 @@ tunable_policy(`use_samba_home_dirs',`
fs_read_cifs_symlinks(chroot_user_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(chroot_user_t)
- fs_read_nfs_symlinks(chroot_user_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_read_fusefs_files(chroot_user_t)
-')
+userdom_home_manager(chroot_user_t)
optional_policy(`
ssh_rw_dgram_sockets(chroot_user_t)
diff --git a/policy/modules/services/sssd.te b/policy/modules/services/sssd.te
index 5c32a99..eb8979d 100644
--- a/policy/modules/services/sssd.te
+++ b/policy/modules/services/sssd.te
@@ -117,17 +117,7 @@ optional_policy(`
ldap_stream_connect(sssd_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(sssd_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(sssd_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_read_fusefs_files(sssd_t)
-')
+userdom_home_reader(sssd_t)
diff --git a/policy/modules/services/virt.te b/policy/modules/services/virt.te
index 3619ec3..629863f 100644
--- a/policy/modules/services/virt.te
+++ b/policy/modules/services/virt.te
@@ -842,10 +842,6 @@ miscfiles_read_localization(virtd_lxc_t)
sysnet_domtrans_ifconfig(virtd_lxc_t)
-optional_policy(`
- execmem_exec(virtd_lxc_t)
-')
-
#optional_policy(`
# unconfined_shell_domtrans(virtd_lxc_t)
# unconfined_signal(virtd_t)
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 743ea2b..ab908aa 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -286,18 +286,7 @@ fs_search_auto_mountpoints(iceauth_t)
userdom_use_inherited_user_terminals(iceauth_t)
userdom_read_user_tmp_files(iceauth_t)
userdom_read_all_users_state(iceauth_t)
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_files(iceauth_t)
-')
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(iceauth_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(iceauth_t)
-')
+userdom_home_manager(iceauth_t)
ifdef(`hide_broken_symptoms',`
dev_dontaudit_read_urand(iceauth_t)
@@ -388,14 +377,7 @@ tunable_policy(`use_fusefs_home_dirs',`
fs_manage_fusefs_files(xauth_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_files(xauth_t)
- fs_read_nfs_symlinks(xauth_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_files(xauth_t)
-')
+userdom_home_manager(xauth_t)
ifdef(`hide_broken_symptoms',`
term_dontaudit_use_unallocated_ttys(xauth_t)
@@ -614,6 +596,7 @@ files_dontaudit_access_check_etc(xdm_t)
files_dontaudit_getattr_all_dirs(xdm_t)
files_dontaudit_getattr_all_symlinks(xdm_t)
files_dontaudit_getattr_all_tmp_sockets(xdm_t)
+files_dontaudit_all_access_check(xdm_t)
fs_getattr_all_fs(xdm_t)
fs_search_auto_mountpoints(xdm_t)
@@ -678,6 +661,7 @@ userdom_manage_user_tmp_dirs(xdm_t)
userdom_manage_user_tmp_files(xdm_t)
userdom_manage_user_tmp_sockets(xdm_t)
userdom_manage_tmpfs_role(system_r, xdm_t)
+userdom_home_manager(xdm_t)
application_signal(xdm_t)
@@ -699,16 +683,10 @@ tunable_policy(`use_fusefs_home_dirs',`
')
tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(xdm_t)
- fs_manage_nfs_files(xdm_t)
- fs_manage_nfs_symlinks(xdm_t)
fs_exec_nfs_files(xdm_t)
')
tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(xdm_t)
- fs_manage_cifs_files(xdm_t)
- fs_manage_cifs_symlinks(xdm_t)
fs_exec_cifs_files(xdm_t)
')
@@ -1227,26 +1205,10 @@ init_use_fds(xserver_t)
# (xauth?)
userdom_read_user_home_content_files(xserver_t)
userdom_read_all_users_state(xserver_t)
+userdom_home_manager(xserver_t)
xserver_use_user_fonts(xserver_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(xserver_t)
- fs_manage_nfs_files(xserver_t)
- fs_manage_nfs_symlinks(xserver_t)
-')
-
-tunable_policy(`use_fusefs_home_dirs',`
- fs_manage_fusefs_dirs(xserver_t)
- fs_manage_fusefs_files(xserver_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(xserver_t)
- fs_manage_cifs_files(xserver_t)
- fs_manage_cifs_symlinks(xserver_t)
-')
-
optional_policy(`
dbus_system_bus_client(xserver_t)
@@ -1434,7 +1396,6 @@ tunable_policy(`use_nfs_home_dirs',`
optional_policy(`
unconfined_rw_shm(xserver_t)
- unconfined_execmem_rw_shm(xserver_t)
# xserver signals unconfined user on startx
unconfined_signal(xserver_t)
diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if
index 5a963ef..2409206 100644
--- a/policy/modules/system/init.if
+++ b/policy/modules/system/init.if
@@ -650,7 +650,7 @@ interface(`init_dontaudit_rw_stream_socket',`
type init_t;
')
- dontaudit $1 init_t:unix_stream_socket { read write };
+ dontaudit $1 init_t:unix_stream_socket { getattr read write };
')
########################################
diff --git a/policy/modules/system/init.te b/policy/modules/system/init.te
index 75f6d6b..f44bdae 100644
--- a/policy/modules/system/init.te
+++ b/policy/modules/system/init.te
@@ -1206,13 +1206,6 @@ optional_policy(`
rpm_transition_script(initrc_t)
optional_policy(`
- gen_require(`
- type unconfined_execmem_t, execmem_exec_t;
- ')
- init_system_domain(unconfined_execmem_t, execmem_exec_t)
- ')
-
- optional_policy(`
rtkit_scheduled(initrc_t)
')
')
diff --git a/policy/modules/system/locallogin.te b/policy/modules/system/locallogin.te
index 37a5bb4..2291a13 100644
--- a/policy/modules/system/locallogin.te
+++ b/policy/modules/system/locallogin.te
@@ -154,15 +154,7 @@ tunable_policy(`console_login',`
term_relabel_console(local_login_t)
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(local_login_t)
- fs_read_nfs_symlinks(local_login_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(local_login_t)
- fs_read_cifs_symlinks(local_login_t)
-')
+userdom_home_reader(local_login_t)
tunable_policy(`allow_console_login',`
term_use_console(local_login_t)
diff --git a/policy/modules/system/modutils.te b/policy/modules/system/modutils.te
index 2273e1a..6b39756 100644
--- a/policy/modules/system/modutils.te
+++ b/policy/modules/system/modutils.te
@@ -78,6 +78,7 @@ userdom_use_inherited_user_terminals(depmod_t)
files_list_home(depmod_t)
userdom_read_user_home_content_files(depmod_t)
userdom_manage_user_tmp_files(depmod_t)
+userdom_home_reader(depmod_t)
ifdef(`distro_ubuntu',`
optional_policy(`
@@ -85,14 +86,6 @@ ifdef(`distro_ubuntu',`
')
')
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(depmod_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(depmod_t)
-')
-
optional_policy(`
bootloader_rw_tmp_files(insmod_t)
')
diff --git a/policy/modules/system/selinuxutil.te b/policy/modules/system/selinuxutil.te
index 3ee9ea8..ac8b214 100644
--- a/policy/modules/system/selinuxutil.te
+++ b/policy/modules/system/selinuxutil.te
@@ -492,14 +492,7 @@ seutil_manage_default_contexts(semanage_t)
# Handle pp files created in homedir and /tmp
userdom_read_user_home_content_files(semanage_t)
userdom_read_user_tmp_files(semanage_t)
-
-tunable_policy(`use_nfs_home_dirs',`
- fs_read_nfs_files(semanage_t)
-')
-
-tunable_policy(`use_samba_home_dirs',`
- fs_read_cifs_files(semanage_t)
-')
+userdom_home_reader(semanage_t)
ifdef(`distro_debian',`
files_read_var_lib_files(semanage_t)
diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 31047e8..0bb4d1e 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -1144,10 +1144,6 @@ template(`userdom_restricted_xwindows_user_template',`
')
optional_policy(`
- openoffice_role_template($1, $1_r, $1_usertype)
- ')
-
- optional_policy(`
policykit_role($1_r, $1_usertype)
')
@@ -1282,10 +1278,6 @@ template(`userdom_unpriv_user_template', `
')
optional_policy(`
- mono_role_template($1, $1_r, $1_t)
- ')
-
- optional_policy(`
mount_run_fusermount($1_t, $1_r)
mount_read_pid_files($1_t)
')
@@ -5065,3 +5057,41 @@ interface(`userdom_filetrans_home_content',`
# gnome_admin_home_gconf_filetrans($1, home_bin_t, dir, "bin")
#')
')
+
+########################################
+## <summary>
+## Make the specified type able to read content in user home dirs
+## </summary>
+## <param name="type">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_home_reader',`
+ gen_require(`
+ attribute userdom_home_reader_type;
+ ')
+
+ typeattribute $1 userdom_home_reader_type;
+')
+
+
+########################################
+## <summary>
+## Make the specified type able to manage content in user home dirs
+## </summary>
+## <param name="type">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`userdom_home_manager',`
+ gen_require(`
+ attribute userdom_home_manager_type;
+ ')
+
+ typeattribute $1 userdom_home_manager_type;
+')
+
diff --git a/policy/modules/system/userdomain.te b/policy/modules/system/userdomain.te
index d6c3860..ced52ff 100644
--- a/policy/modules/system/userdomain.te
+++ b/policy/modules/system/userdomain.te
@@ -73,6 +73,9 @@ attribute unpriv_userdomain;
attribute untrusted_content_type;
attribute untrusted_content_tmp_type;
+attribute userdom_home_reader_type;
+attribute userdom_home_manager_type;
+
# unprivileged user domains
attribute user_home_type;
attribute user_tmp_type;
@@ -172,3 +175,36 @@ optional_policy(`
optional_policy(`
xserver_filetrans_home_content(userdomain)
')
+
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_read_nfs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_read_cifs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_read_fusefs_files(userdom_home_reader_type)
+')
+
+tunable_policy(`use_nfs_home_dirs',`
+ fs_list_auto_mountpoints(userdom_home_manager_type)
+ fs_manage_nfs_dirs(userdom_home_manager_type)
+ fs_manage_nfs_files(userdom_home_manager_type)
+ fs_manage_nfs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs(userdom_home_manager_type)
+ fs_manage_cifs_files(userdom_home_manager_type)
+ fs_manage_cifs_symlinks(userdom_home_manager_type)
+')
+
+tunable_policy(`use_fusefs_home_dirs',`
+ fs_manage_fusefs_dirs(userdom_home_manager_type)
+ fs_manage_fusefs_files(userdom_home_manager_type)
+ fs_manage_fusefs_symlinks(userdom_home_manager_type)
+')
+