diff --git a/refpolicy/policy/modules/services/cron.te b/refpolicy/policy/modules/services/cron.te index 5ddfbca..c80201c 100644 --- a/refpolicy/policy/modules/services/cron.te +++ b/refpolicy/policy/modules/services/cron.te @@ -158,11 +158,11 @@ ifdef(`targeted_policy',` # cjp: fix this to generic_user interfaces userdom_manage_user_home_subdirs(user,crond_t) - userdom_manage_user_home_files(user,crond_t) - userdom_manage_user_home_symlinks(user,crond_t) - userdom_manage_user_home_pipes(user,crond_t) - userdom_manage_user_home_sockets(user,crond_t) - userdom_filetrans_user_home(user,crond_t,{ dir file lnk_file fifo_file sock_file }) + userdom_manage_generic_user_home_files(crond_t) + userdom_manage_generic_user_home_symlinks(crond_t) + userdom_manage_generic_user_home_sockets(crond_t) + userdom_manage_generic_user_home_pipes(crond_t) + userdom_filetrans_generic_user_home(crond_t,{ dir file lnk_file fifo_file sock_file }) allow crond_t unconfined_t:dbus send_msg; allow crond_t initrc_t:dbus send_msg; diff --git a/refpolicy/policy/modules/services/ftp.te b/refpolicy/policy/modules/services/ftp.te index bfc6428..54001cc 100644 --- a/refpolicy/policy/modules/services/ftp.te +++ b/refpolicy/policy/modules/services/ftp.te @@ -137,12 +137,11 @@ ifdef(`targeted_policy',` optional_policy(`ftp',` tunable_policy(`ftpd_is_daemon',` - # cjp: fix this to use regular interfaces - userdom_manage_user_home_files(user,ftpd_t) - userdom_manage_user_home_symlinks(user,ftpd_t) - userdom_manage_user_home_sockets(user,ftpd_t) - userdom_manage_user_home_pipes(user,ftpd_t) - userdom_filetrans_user_home(user,ftpd_t,{ dir file lnk_file sock_file fifo_file }) + userdom_manage_generic_user_home_files(ftpd_t) + userdom_manage_generic_user_home_symlinks(ftpd_t) + userdom_manage_generic_user_home_sockets(ftpd_t) + userdom_manage_generic_user_home_pipes(ftpd_t) + userdom_filetrans_generic_user_home(ftpd_t,{ dir file lnk_file sock_file fifo_file }) ') ') ') diff --git a/refpolicy/policy/modules/services/mta.te b/refpolicy/policy/modules/services/mta.te index 00edc7e..7312d55 100644 --- a/refpolicy/policy/modules/services/mta.te +++ b/refpolicy/policy/modules/services/mta.te @@ -78,11 +78,11 @@ ifdef(`targeted_policy',` # also for delivering mail to maildir # cjp: fix this to generic_user interfaces userdom_manage_user_home_subdirs(user,mailserver_delivery) - userdom_manage_user_home_files(user,mailserver_delivery) - userdom_manage_user_home_symlinks(user,mailserver_delivery) - userdom_manage_user_home_pipes(user,mailserver_delivery) - userdom_manage_user_home_sockets(user,mailserver_delivery) - userdom_filetrans_user_home(user,mailserver_delivery,{ dir file lnk_file fifo_file sock_file }) + userdom_manage_generic_user_home_files(mailserver_delivery) + userdom_manage_generic_user_home_symlinks(mailserver_delivery) + userdom_manage_generic_user_home_sockets(mailserver_delivery) + userdom_manage_generic_user_home_pipes(mailserver_delivery) + userdom_filetrans_generic_user_home(mailserver_delivery,{ dir file lnk_file sock_file fifo_file }) # cjp: another require-in-else to resolve # optional_policy(`postfix',`',` diff --git a/refpolicy/policy/modules/system/userdomain.if b/refpolicy/policy/modules/system/userdomain.if index 0025588..2b73a7f 100644 --- a/refpolicy/policy/modules/system/userdomain.if +++ b/refpolicy/policy/modules/system/userdomain.if @@ -3899,6 +3899,8 @@ interface(`userdom_filetrans_generic_user_home',` type user_home_dir_t, user_home_t; ') + files_search_home($1) + allow $1 user_home_dir_t:dir rw_dir_perms; ifelse(`$2',`',` type_transition $1 user_home_dir_t:file user_home_t;