## <summary>Unconfiend user role</summary>
########################################
## <summary>
## Change from the unconfineduser role.
## </summary>
## <desc>
## <p>
## Change from the unconfineduser role to
## the specified role.
## </p>
## <p>
## This is an interface to support third party modules
## and its use is not allowed in upstream reference
## policy.
## </p>
## </desc>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`unconfined_role_change_to',`
gen_require(`
role unconfined_r;
')
allow unconfined_r $1;
')
########################################
## <summary>
## Transition to the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_domtrans',`
gen_require(`
type unconfined_t, unconfined_exec_t;
')
domtrans_pattern($1,unconfined_exec_t,unconfined_t)
')
########################################
## <summary>
## Execute specified programs in the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to allow the unconfined domain.
## </summary>
## </param>
#
interface(`unconfined_run',`
gen_require(`
type unconfined_t;
')
unconfined_domtrans($1)
role $2 types unconfined_t;
')
########################################
## <summary>
## Transition to the unconfined domain by executing a shell.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_shell_domtrans',`
gen_require(`
attribute unconfined_login_domain;
')
typeattribute $1 unconfined_login_domain;
')
########################################
## <summary>
## Allow unconfined to execute the specified program in
## the specified domain.
## </summary>
## <desc>
## <p>
## Allow unconfined to execute the specified program in
## the specified domain.
## </p>
## <p>
## This is a interface to support third party modules
## and its use is not allowed in upstream reference
## policy.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to execute in.
## </summary>
## </param>
## <param name="entry_file">
## <summary>
## Domain entry point file.
## </summary>
## </param>
#
interface(`unconfined_domtrans_to',`
gen_require(`
type unconfined_t;
')
domtrans_pattern(unconfined_t,$2,$1)
')
########################################
## <summary>
## Allow unconfined to execute the specified program in
## the specified domain. Allow the specified domain the
## unconfined role and use of unconfined user terminals.
## </summary>
## <desc>
## <p>
## Allow unconfined to execute the specified program in
## the specified domain. Allow the specified domain the
## unconfined role and use of unconfined user terminals.
## </p>
## <p>
## This is a interface to support third party modules
## and its use is not allowed in upstream reference
## policy.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to execute in.
## </summary>
## </param>
## <param name="entry_file">
## <summary>
## Domain entry point file.
## </summary>
## </param>
#
interface(`unconfined_run_to',`
gen_require(`
type unconfined_t;
role unconfined_r;
')
domtrans_pattern(unconfined_t,$2,$1)
role unconfined_r types $1;
userdom_use_user_terminals($1)
')
########################################
## <summary>
## Inherit file descriptors from the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_use_fds',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:fd use;
')
########################################
## <summary>
## Send a SIGCHLD signal to the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_sigchld',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process sigchld;
')
########################################
## <summary>
## Send a SIGNULL signal to the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_signull',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process signull;
')
########################################
## <summary>
## Send a SIGNULL signal to the unconfined execmem domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_execmem_signull',`
gen_require(`
type unconfined_execmem_t;
')
allow $1 unconfined_execmem_t:process signull;
')
########################################
## <summary>
## Send a signal to the unconfined execmem domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_execmem_signal',`
gen_require(`
type unconfined_execmem_t;
')
allow $1 unconfined_execmem_t:process signal;
')
########################################
## <summary>
## Send generic signals to the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_signal',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process signal;
')
########################################
## <summary>
## Read unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_read_pipes',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:fifo_file read_fifo_file_perms;
')
########################################
## <summary>
## Do not audit attempts to read unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_dontaudit_read_pipes',`
gen_require(`
type unconfined_t;
')
dontaudit $1 unconfined_t:fifo_file read;
')
########################################
## <summary>
## Read and write unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_rw_pipes',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:fifo_file rw_fifo_file_perms;
')
########################################
## <summary>
## Do not audit attempts to read and write
## unconfined domain unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`unconfined_dontaudit_rw_pipes',`
gen_require(`
type unconfined_t;
')
dontaudit $1 unconfined_t:fifo_file rw_file_perms;
')
########################################
## <summary>
## Do not audit attempts to read and write
## unconfined domain stream.
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`unconfined_dontaudit_rw_stream',`
gen_require(`
type unconfined_t;
')
dontaudit $1 unconfined_t:unix_stream_socket rw_socket_perms;
')
########################################
## <summary>
## Connect to the unconfined domain using
## a unix domain stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_stream_connect',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:unix_stream_socket connectto;
')
########################################
## <summary>
## Do not audit attempts to read or write
## unconfined domain tcp sockets.
## </summary>
## <desc>
## <p>
## Do not audit attempts to read or write
## unconfined domain tcp sockets.
## </p>
## <p>
## This interface was added due to a broken
## symptom in ldconfig.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`unconfined_dontaudit_rw_tcp_sockets',`
gen_require(`
type unconfined_t;
')
dontaudit $1 unconfined_t:tcp_socket { read write };
')
########################################
## <summary>
## Do not audit attempts to read or write
## unconfined domain packet sockets.
## </summary>
## <desc>
## <p>
## Do not audit attempts to read or write
## unconfined domain packet sockets.
## </p>
## <p>
## This interface was added due to a broken
## symptom.
## </p>
## </desc>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`unconfined_dontaudit_rw_packet_sockets',`
gen_require(`
type unconfined_t;
')
dontaudit $1 unconfined_t:packet_socket { read write };
')
########################################
## <summary>
## Create keys for the unconfined domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_create_keys',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:key create;
')
########################################
## <summary>
## Send messages to the unconfined domain over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_dbus_send',`
gen_require(`
type unconfined_t;
class dbus send_msg;
')
allow $1 unconfined_t:dbus send_msg;
')
########################################
## <summary>
## Send and receive messages from
## unconfined_t over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_dbus_chat',`
gen_require(`
type unconfined_t;
class dbus send_msg;
')
allow $1 unconfined_t:dbus send_msg;
allow unconfined_t $1:dbus send_msg;
')
########################################
## <summary>
## Connect to the the unconfined DBUS
## for service (acquire_svc).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_dbus_connect',`
gen_require(`
type unconfined_t;
class dbus acquire_svc;
')
allow $1 unconfined_t:dbus acquire_svc;
')
########################################
## <summary>
## Allow ptrace of unconfined domain
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_ptrace',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process ptrace;
')
########################################
## <summary>
## Read and write to unconfined shared memory.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`unconfined_rw_shm',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:shm rw_shm_perms;
')
########################################
## <summary>
## Read and write to unconfined execmem shared memory.
## </summary>
## <param name="domain">
## <summary>
## The type of the process performing this action.
## </summary>
## </param>
#
interface(`unconfined_execmem_rw_shm',`
gen_require(`
type unconfined_execmem_t;
')
allow $1 unconfined_execmem_t:shm rw_shm_perms;
')
########################################
## <summary>
## Transition to the unconfined_execmem domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_execmem_domtrans',`
gen_require(`
type unconfined_execmem_t;
')
execmem_domtrans($1, unconfined_execmem_t)
')
########################################
## <summary>
## execute the execmem applications
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_execmem_exec',`
gen_require(`
type execmem_exec_t;
')
can_exec($1, execmem_exec_t)
')
########################################
## <summary>
## Allow apps to set rlimits on userdomain
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_set_rlimitnh',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process rlimitinh;
')
########################################
## <summary>
## Get the process group of unconfined.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_getpgid',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:process getpgid;
')
########################################
## <summary>
## Change to the unconfined role.
## </summary>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`unconfined_role_change',`
gen_require(`
role unconfined_r;
')
allow $1 unconfined_r;
')
########################################
## <summary>
## Allow domain to attach to TUN devices created by unconfined_t users.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`unconfined_attach_tun_iface',`
gen_require(`
type unconfined_t;
')
allow $1 unconfined_t:tun_socket relabelfrom;
allow $1 self:tun_socket relabelto;
')