[gentoo-commits] proj/hardened-refpolicy:next commit in: policy/modules/system/

[Jason Zaman]

commit:     c2e01eedeb6884cfd367f4ca160c6b35cdcc3e38
Author:     Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Thu May 26 15:09:27 2016 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Thu May 26 18:44:57 2016 +0000
URL:        
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c2e01eed

userdomain: filetrans interfaces for user_runtime

 policy/modules/system/userdomain.if | 99 +++++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)

diff --git a/policy/modules/system/userdomain.if 
b/policy/modules/system/userdomain.if
index 0d6d9b1..044bf81 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -324,6 +324,7 @@ interface(`userdom_manage_tmp_role',`
        manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
        manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
        files_tmp_filetrans($2, user_tmp_t, { dir file lnk_file sock_file 
fifo_file })
+       userdom_user_runtime_dir_filetrans_user_tmp($2, { dir file lnk_file 
sock_file fifo_file })
 ')
 
 #######################################
@@ -2753,6 +2754,104 @@ interface(`userdom_tmp_filetrans_user_tmp',`
 
 ########################################
 ## <summary>
+##     Create objects in the pid directory
+##     with an automatic type transition to
+##     the user runtime root type.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="object_class">
+##     <summary>
+##     The class of the object to be created.
+##     </summary>
+## </param>
+## <param name="name" optional="true">
+##     <summary>
+##     The name of the object being created.
+##     </summary>
+## </param>
+#
+interface(`userdom_pid_filetrans_user_runtime_root',`
+       gen_require(`
+               type user_runtime_root_t;
+       ')
+
+       files_pid_filetrans($1, user_runtime_root_t, $2, $3)
+')
+
+########################################
+## <summary>
+##     Create objects in a user runtime
+##     directory with an automatic type
+##     transition to a specified private
+##     type.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="private_type">
+##     <summary>
+##     The type of the object to create.
+##     </summary>
+## </param>
+## <param name="object_class">
+##     <summary>
+##     The class of the object to be created.
+##     </summary>
+## </param>
+## <param name="name" optional="true">
+##     <summary>
+##     The name of the object being created.
+##     </summary>
+## </param>
+#
+interface(`userdom_user_runtime_dir_filetrans',`
+       gen_require(`
+               type user_runtime_root_t, user_runtime_dir_t;
+       ')
+
+       filetrans_pattern($1, user_runtime_dir_t, $2, $3, $4)
+       allow $1 user_runtime_root_t:dir search_dir_perms;
+       files_search_pids($1)
+')
+
+########################################
+## <summary>
+##     Create objects in the user runtime directory
+##     with an automatic type transition to
+##     the user temporary type.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+## <param name="object_class">
+##     <summary>
+##     The class of the object to be created.
+##     </summary>
+## </param>
+## <param name="name" optional="true">
+##     <summary>
+##     The name of the object being created.
+##     </summary>
+## </param>
+#
+interface(`userdom_user_runtime_dir_filetrans_user_tmp',`
+       gen_require(`
+               type user_tmp_t;
+       ')
+
+       userdom_user_runtime_dir_filetrans($1, user_tmp_t, $2, $3)
+')
+
+########################################
+## <summary>
 ##     Read and write user tmpfs files.
 ## </summary>
 ## <param name="domain">