diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index 53c0e82..61ac720 100644
--- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if
@@ -45,6 +45,12 @@ interface(`mozilla_role',`
relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
+
+ mozilla_dbus_chat($2)
+
+ optional_policy(`
+ pulseaudio_role($1, mozilla_t)
+ ')
')
########################################
@@ -64,6 +70,7 @@ interface(`mozilla_read_user_home_files',`
allow $1 mozilla_home_t:dir list_dir_perms;
allow $1 mozilla_home_t:file read_file_perms;
+ allow $1 mozilla_home_t:lnk_file read_lnk_file_perms;
userdom_search_user_home_dirs($1)
')
@@ -88,6 +95,43 @@ interface(`mozilla_write_user_home_files',`
########################################
##
+## Dontaudit attempts to read/write mozilla home directory content
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`mozilla_dontaudit_rw_user_home_files',`
+ gen_require(`
+ type mozilla_home_t;
+ ')
+
+ dontaudit $1 mozilla_home_t:file rw_file_perms;
+')
+
+########################################
+##
+## Dontaudit attempts to write mozilla home directory content
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`mozilla_dontaudit_manage_user_home_files',`
+ gen_require(`
+ type mozilla_home_t;
+ ')
+
+ dontaudit $1 mozilla_home_t:dir manage_dir_perms;
+ dontaudit $1 mozilla_home_t:file manage_file_perms;
+')
+
+########################################
+##
## Run mozilla in the mozilla domain.
##
##
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 7957bc9..e7428a1 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -1,5 +1,5 @@
-policy_module(mozilla, 2.1.0)
+policy_module(mozilla, 2.1.1)
########################################
#
@@ -59,6 +59,7 @@ manage_dirs_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
manage_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
manage_lnk_files_pattern(mozilla_t, mozilla_home_t, mozilla_home_t)
userdom_search_user_home_dirs(mozilla_t)
+userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir)
# Mozpluggerrc
allow mozilla_t mozilla_conf_t:file read_file_perms;
@@ -75,7 +76,7 @@ kernel_read_network_state(mozilla_t)
kernel_read_system_state(mozilla_t)
kernel_read_net_sysctls(mozilla_t)
-# Look for plugins
+# Look for plugins
corecmd_list_bin(mozilla_t)
# for bash - old mozilla binary
corecmd_exec_shell(mozilla_t)
@@ -97,6 +98,7 @@ corenet_tcp_connect_http_cache_port(mozilla_t)
corenet_tcp_connect_ftp_port(mozilla_t)
corenet_tcp_connect_ipp_port(mozilla_t)
corenet_tcp_connect_generic_port(mozilla_t)
+corenet_tcp_connect_soundd_port(mozilla_t)
corenet_sendrecv_http_client_packets(mozilla_t)
corenet_sendrecv_http_cache_client_packets(mozilla_t)
corenet_sendrecv_ftp_client_packets(mozilla_t)
@@ -114,6 +116,8 @@ dev_read_sound(mozilla_t)
dev_dontaudit_rw_dri(mozilla_t)
dev_getattr_sysfs_dirs(mozilla_t)
+domain_dontaudit_read_all_domains_state(mozilla_t)
+
files_read_etc_runtime_files(mozilla_t)
files_read_usr_files(mozilla_t)
files_read_etc_files(mozilla_t)
@@ -231,6 +235,10 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(mozilla_t)
dbus_session_bus_client(mozilla_t)
+
+ optional_policy(`
+ networkmanager_dbus_chat(mozilla_t)
+ ')
')
optional_policy(`