Layer: system

Module: userdomain

Tunables Interfaces Templates

Description:

Policy for user domains


Tunables:

allow_user_mysql_connect
Default value

false

Description

Allow users to connect to mysql

allow_user_postgresql_connect
Default value

false

Description

Allow users to connect to PostgreSQL

user_direct_mouse
Default value

false

Description

Allow regular users direct mouse access

user_dmesg
Default value

false

Description

Allow users to read system messages.

user_exec_noexattrfile
Default value

false

Description

Allow user to execute files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

user_rw_noexattrfile
Default value

false

Description

Allow user to r/w files on filesystems that do not have extended attributes (FAT, CDROM, FLOPPY)

user_ttyfile_stat
Default value

false

Description

Allow w to display everyone

user_write_removable
Default value

false

Description

Allow user to write files on removable devices (e.g. external USB memory devices or floppies)

Return

Interfaces:

userdom_append_inherited_user_home_content_files( domain )
Summary

Allow append on inherited user home files.

Parameters
Parameter:Description:
domain

Domain to allow.

userdom_application_exec_domain( domain , userdomain_prefix )
Summary

Associate the specified domain to be a domain capable of executing other applications on behalf of the specified user.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_attach_admin_tun_iface( domain )
Summary

Allow domain to attach to TUN devices created by administrative users.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_bin_spec_domtrans_unpriv_users( domain )
Summary

Execute bin_t in the unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed to transition.

userdom_create_all_users_keys( domain )
Summary

Create keys for all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_create_user_home_dirs( domain )
Summary

Create user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_create_user_pty( domain )
Summary

Create a user pty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_dbus_send_all_users( domain )
Summary

Send a dbus message to all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_home_content_dirs( domain )
Summary

Delete all user home content directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_home_content_files( domain )
Summary

Delete all user home content files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_home_content_symlinks( domain )
Summary

Delete all user home content symbolic links.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_blk_files( domain )
Summary

delete user runtime blk files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_chr_files( domain )
Summary

delete user runtime chr files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_dirs( domain )
Summary

delete user runtime directories

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_files( domain )
Summary

delete user runtime files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_named_pipes( domain )
Summary

delete user runtime fifo files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_named_sockets( domain )
Summary

delete user runtime socket files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_all_user_runtime_symlinks( domain )
Summary

delete user runtime symlink files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_home_content_dirs( domain )
Summary

Delete directories in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_home_content_files( domain )
Summary

Delete files in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_home_content_symlinks( domain )
Summary

Delete symbolic links in a user home directory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_runtime_files( domain )
Summary

delete user runtime files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmp_dirs( domain )
Summary

Delete users temporary directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmp_files( domain )
Summary

Delete users temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmp_named_pipes( domain )
Summary

Delete users temporary named pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmp_named_sockets( domain )
Summary

Delete users temporary named sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmp_symlinks( domain )
Summary

Delete users temporary symbolic links.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_delete_user_tmpfs_files( domain )
Summary

Delete user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_dontaudit_append_user_home_content_files( domain )
Summary

Do not audit attempts to append user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_append_user_tmp_files( domain )
Summary

Do not audit attempts to append users temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_exec_user_home_content_files( domain )
Summary

Do not audit attempts to execute user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_getattr_user_home_dirs( domain )
Summary

Do not audit attempts to get the attributes of user home directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_getattr_user_ttys( domain )
Summary

Do not audit attempts to get the attributes of a user domain tty.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_list_user_home_dirs( domain )
Summary

Do not audit attempts to list user home subdirectories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_list_user_tmp( domain )
Summary

Do not audit attempts to list user temporary directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_manage_user_certs( domain )
Summary

Do not audit attempts to manage the user SSL certificates.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_dontaudit_manage_user_home_content_dirs( domain )
Summary

Do not audit attempts to create, read, write, and delete directories in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_manage_user_home_dirs( domain )
Summary

Do not audit attempts to manage user home directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_manage_user_tmp_dirs( domain )
Summary

Do not audit attempts to manage users temporary directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_manage_user_tmp_files( domain )
Summary

Do not audit attempts to manage users temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_read_user_home_content_files( domain )
Summary

Do not audit attempts to read user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_read_user_tmp_files( domain )
Summary

Do not audit attempts to read users temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_read_user_tmpfs_files( domain )
Summary

dontaudit Read attempts of user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_dontaudit_relabel_user_home_content_files( domain )
Summary

Do not audit attempts to relabel user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_relabelfrom_user_ptys( domain )
Summary

Do not audit attempts to relabel files from user pty types.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_rw_all_users_stream_sockets( domain )
Summary

Do not audit attempts to read and write unserdomain stream.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_rw_user_tmp_pipes( domain )
Summary

Do not audit attempts to read and write temporary pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_dontaudit_search_user_home_content( domain )
Summary

Do not audit attempts to search user home content directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_search_user_home_dirs( domain )
Summary

Do not audit attempts to search user home directories.

Description

Do not audit attempts to search user home directories. This will suppress SELinux denial messages when the specified domain is denied the permission to search these directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_search_user_runtime_root( domain )
Summary

Do not audit attempts to search user runtime root directories.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_setattr_user_home_content_files( domain )
Summary

Do not audit attempts to set the attributes of user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_setattr_user_ttys( domain )
Summary

Do not audit attempts to set the attributes of a user domain tty.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_use_all_users_fds( domain )
Summary

Do not audit attempts to inherit the file descriptors from any user domains.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_use_unpriv_user_fds( domain )
Summary

Do not audit attempts to inherit the file descriptors from unprivileged user domains.

Description

Do not audit attempts to inherit the file descriptors from unprivileged user domains. This will suppress SELinux denial messages when the specified domain is denied the permission to inherit these file descriptors.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_use_user_ptys( domain )
Summary

Do not audit attempts to use user ptys.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_use_user_terminals( domain )
Summary

Do not audit attempts to read and write a user domain tty and pty.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_use_user_ttys( domain )
Summary

Do not audit attempts to use user ttys.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_write_user_home_content_files( domain )
Summary

Do not audit attempts to write user home files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_dontaudit_write_user_tmp_files( domain )
Summary

Do not audit attempts to write users temporary files.

Parameters
Parameter:Description:
domain

Domain to not audit.

userdom_entry_spec_domtrans_unpriv_users( domain )
Summary

Execute all entrypoint files in unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_exec_user_bin_files( domain )
Summary

Execute user executable files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_exec_user_home_content_files( domain )
Summary

Execute user home files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_exec_user_tmp_files( domain )
Summary

The execute access user temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_execmod_user_tmpfs_files( domain )
Summary

execute and execmod user tmpfs files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_getattr_all_users( domain )
Summary

Get the attributes of all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_getattr_user_home_dirs( domain )
Summary

Get the attributes of user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_getattr_user_ttys( domain )
Summary

Get the attributes of a user domain tty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_home_filetrans_user_home_dir( domain , name )
Summary

Create directories in the home dir root with the user home directory type.

Parameters
Parameter:Description:
domain

Domain allowed access.

name

The name of the object being created.

userdom_list_all_user_home_content( domain )
Summary

List all users home content directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_list_all_user_runtime( domain )
Summary

List user runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_list_user_home_content( domain )
Summary

List contents of users home directory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_list_user_home_dirs( domain )
Summary

List user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_list_user_tmp( domain )
Summary

List user temporary directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_all_user_home_content( domain )
Summary

Manage all user home content, including application-specific resources.

Parameters
Parameter:Description:
domain

Domain allowed access

userdom_manage_all_users_keys( domain )
Summary

Manage keys for all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_home_role( role , userdomain )
Summary

Allow a home directory for which the role has full access.

Description

Allow a home directory for which the role has full access.

This does not allow execute access.

Parameters
Parameter:Description:
role

The user role

userdomain

The user domain

userdom_manage_tmp_role( role , domain )
Summary

Manage user temporary files

Parameters
Parameter:Description:
role

Role allowed access.

domain

Domain allowed access.

userdom_manage_tmpfs_role( role , domain )
Summary

Role access for the user tmpfs type that the user has full access.

Description

Role access for the user tmpfs type that the user has full access.

This does not allow execute access.

Parameters
Parameter:Description:
role

Role allowed access.

domain

Domain allowed access.

userdom_manage_unpriv_user_semaphores( domain )
Summary

Manage unpriviledged user SysV sempaphores.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_unpriv_user_shared_mem( domain )
Summary

Manage unpriviledged user SysV shared memory segments.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_bin( domain )
Summary

Manage user executable files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_certs( domain )
Summary

Manage user SSL certificates.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_content_dirs( domain )
Summary

Create, read, write, and delete directories in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_content_files( domain )
Summary

Create, read, write, and delete files in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_content_pipes( domain )
Summary

Create, read, write, and delete named pipes in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_content_sockets( domain )
Summary

Create, read, write, and delete named sockets in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_content_symlinks( domain )
Summary

Create, read, write, and delete symbolic links in a user home subdirectory.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_home_dirs( domain )
Summary

Manage user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_runtime_dirs( domain )
Summary

Create, read, write, and delete user runtime dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_runtime_root_dirs( domain )
Summary

Create, read, write, and delete user runtime root dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmp_dirs( domain )
Summary

Create, read, write, and delete user temporary directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmp_files( domain )
Summary

Create, read, write, and delete user temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmp_pipes( domain )
Summary

Create, read, write, and delete user temporary named pipes.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmp_sockets( domain )
Summary

Create, read, write, and delete user temporary named sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmp_symlinks( domain )
Summary

Create, read, write, and delete user temporary symbolic links.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_manage_user_tmpfs_files( domain )
Summary

Create, read, write, and delete user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_map_all_user_home_content_files( domain )
Summary

Map all user home content, including application-specific resources.

Parameters
Parameter:Description:
domain

Domain allowed access

userdom_map_user_home_content_files( domain )
Summary

Map user home files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_map_user_tmp_files( domain )
Summary

Map user temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_map_user_tmpfs_files( domain )
Summary

Map user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_mmap_user_home_content_files( domain )
Summary

Mmap user home files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_mounton_user_runtime_dirs( domain )
Summary

Mount a filesystem on user runtime dir directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_all_user_home_content( domain )
Summary

Read all user home content, including application-specific resources.

Parameters
Parameter:Description:
domain

Domain allowed access

userdom_read_all_users_keys( domain )
Summary

Read keys for all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_all_users_state( domain )
Summary

Read the process state of all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_certs( domain )
Summary

Read user SSL certificates.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_home_content_files( domain )
Summary

Read user home files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_home_content_symlinks( domain )
Summary

Read user home subdirectory symbolic links.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_tmp_files( domain )
Summary

Read user temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_tmp_symlinks( domain )
Summary

Read user temporary symbolic links.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_read_user_tmpfs_files( domain )
Summary

Read user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabel_generic_user_home_dirs( domain )
Summary

Relabel generic user home dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabel_generic_user_home_files( domain )
Summary

Relabel generic user home files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabel_user_runtime_root_dirs( domain )
Summary

Relabel to and from user runtime root dirs.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabel_user_tmpfs_dirs( domain )
Summary

relabel to/from user tmpfs dirs

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabel_user_tmpfs_files( domain )
Summary

relabel to/from user tmpfs files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabelfrom_user_runtime_dirs( domain )
Summary

Relabel from user runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabelto_user_home_dirs( domain )
Summary

Relabel to user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabelto_user_ptys( domain )
Summary

Relabel files to unprivileged user pty types.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_relabelto_user_runtime_dirs( domain )
Summary

Relabel to user runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_ro_home_role( role , userdomain )
Summary

Allow a home directory for which the role has read-only access.

Description

Allow a home directory for which the role has read-only access.

This does not allow execute access.

Parameters
Parameter:Description:
role

The user role

userdomain

The user domain

userdom_runtime_filetrans_user_runtime_root( domain , object_class , name )
Summary

Create objects in the runtime directory with an automatic type transition to the user runtime root type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_rw_all_users_keys( domain )
Summary

Read and write keys for all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_rw_unpriv_user_semaphores( domain )
Summary

Read and write unpriviledged user SysV sempaphores.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_rw_unpriv_user_shared_mem( domain )
Summary

Read and write unpriviledged user SysV shared memory segments.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_rw_user_tmp_files( domain )
Summary

Read and write user temporary files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_rw_user_tmpfs_files( domain )
Summary

Read and write user tmpfs files.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_search_all_user_runtime( domain )
Summary

Search users runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_search_user_home_content( domain )
Summary

Search users home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_search_user_home_dirs( domain )
Summary

Search user home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_search_user_runtime( domain )
Summary

Search users runtime directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_search_user_runtime_root( domain )
Summary

Search user runtime root directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_security_admin_template( domain , role )
Summary

Allow user to run as a secadm

Description

Create objects in a user home directory with an automatic type transition to a specified private type.

This is a templated interface, and should only be called from a per-userdomain template.

Parameters
Parameter:Description:
domain

Domain allowed access.

role

The role of the object to create.

userdom_setattr_all_user_home_content_dirs( domain )
Summary

Set attributes of all user home content directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_setattr_user_ptys( domain )
Summary

Set the attributes of a user pty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_setattr_user_ttys( domain )
Summary

Set the attributes of a user domain tty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_sigchld_all_users( domain )
Summary

Send a SIGCHLD signal to all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_signal_all_users( domain )
Summary

Send general signals to all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_signal_unpriv_users( domain )
Summary

Send general signals to unprivileged user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_signull_unpriv_users( domain )
Summary

Send signull to unprivileged user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_spec_domtrans_all_users( domain )
Summary

Execute a shell in all user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed to transition.

userdom_spec_domtrans_unpriv_users( domain )
Summary

Execute a shell in all unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed to transition.

userdom_tmp_filetrans_user_tmp( domain , object_class , name )
Summary

Create objects in the temporary directory with an automatic type transition to the user temporary type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_unlink_user_tmp_devices( domain )
Summary

Delete user_tmp_t device nodes (probably should not have been created in the first place)

Parameters
Parameter:Description:
domain

Domain to allow deleting

userdom_use_all_users_fds( domain )
Summary

Inherit the file descriptors from all user domains

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_use_inherited_user_terminals( domain )
Summary

Read and write a user TTYs and PTYs.

Description

Allow the specified domain to read and write user TTYs and PTYs. This will allow the domain to interact with the user via the terminal. Typically all interactive applications will require this access.

However, this also allows the applications to spy on user sessions or inject information into the user session. Thus, this access should likely not be allowed for non-interactive domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_use_unpriv_users_fds( domain )
Summary

Inherit the file descriptors from unprivileged user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_use_user_ptys( domain )
Summary

Read and write a user domain pty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_use_user_terminals( domain )
Summary

Read, write and open a user TTYs and PTYs.

Description

Allow the specified domain to read and write user TTYs and PTYs. This will allow the domain to interact with the user via the terminal. Typically all interactive applications will require this access.

This interface will also allow to open these user terminals, which should not be necessary in general and userdom_use_inherited_user_terminals() should be sufficient.

However, this also allows the applications to spy on user sessions or inject information into the user session. Thus, this access should likely not be allowed for non-interactive domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_use_user_ttys( domain )
Summary

Read and write a user domain tty.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_user_application_domain( type , type )
Summary

Make the specified type usable as a user application domain.

Parameters
Parameter:Description:
type

Type to be used as a user application domain.

type

Type to be used as the domain entry point.

userdom_user_application_type( type )
Summary

Make the specified type usable as a user application domain type.

Parameters
Parameter:Description:
type

Type to be used as a user application domain.

userdom_user_home_content( type )
Summary

Make the specified type usable in a user home directory.

Parameters
Parameter:Description:
type

Type to be used as a file in the user home directory.

userdom_user_home_content_filetrans( domain , private_type , object_class , name )
Summary

Create objects in a directory located in a user home directory with an automatic type transition to a specified private type.

Parameters
Parameter:Description:
domain

Domain allowed access.

private_type

The type of the object to create.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_home_dir_filetrans( domain , private_type , object_class , name )
Summary

Create objects in a user home directory with an automatic type transition to a specified private type.

Parameters
Parameter:Description:
domain

Domain allowed access.

private_type

The type of the object to create.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_home_dir_filetrans_user_cert( domain , class , filename )
Summary

Automatically use the user_cert_t label for selected resources created in a users home directory

Parameters
Parameter:Description:
domain

Domain allowed access

class

Resource type(s) for which the label should be used

filename

Name of the resource that is being created

userdom_user_home_dir_filetrans_user_home_content( domain , object_class , name )
Summary

Create objects in a user home directory with an automatic type transition to the user home file type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_home_domtrans( source_domain , target_domain )
Summary

Do a domain transition to the specified domain when executing a program in the user home directory.

Description

Do a domain transition to the specified domain when executing a program in the user home directory.

No interprocess communication (signals, pipes, etc.) is provided by this interface since the domains are not owned by this module.

Parameters
Parameter:Description:
source_domain

Domain allowed to transition.

target_domain

Domain to transition to.

userdom_user_run_filetrans_user_runtime( domain , object_class , name )
Summary

Create objects in the user runtime root directory with an automatic type transition to the user runtime dir type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_runtime_content( type )
Summary

Make the specified type usable in the directory /run/user/%{USERID}/.

Parameters
Parameter:Description:
type

Type to be used as a file in the user_runtime_content_dir_t.

userdom_user_runtime_filetrans( domain , private_type , object_class , name )
Summary

Create objects in a user runtime directory with an automatic type transition to a specified private type.

Parameters
Parameter:Description:
domain

Domain allowed access.

private_type

The type of the object to create.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_runtime_filetrans_user_tmp( domain , object_class , name )
Summary

Create objects in the user runtime directory with an automatic type transition to the user temporary type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_runtime_root_filetrans_user_runtime( domain , object_class , name )
Summary

Create objects in the user runtime root directory with an automatic type transition to the user runtime dir type.

Parameters
Parameter:Description:
domain

Domain allowed access.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_tmp_file( type )
Summary

Make the specified type usable as a user temporary file.

Parameters
Parameter:Description:
type

Type to be used as a file in the temporary directories.

userdom_user_tmp_filetrans( domain , private_type , object_class , name )
Summary

Create objects in a user temporary directory with an automatic type transition to a specified private type.

Parameters
Parameter:Description:
domain

Domain allowed access.

private_type

The type of the object to create.

object_class

The class of the object to be created.

name

The name of the object being created.

userdom_user_tmpfs_file( type )
Summary

Make the specified type usable as a user tmpfs file.

Parameters
Parameter:Description:
type

Type to be used as a file in tmpfs directories.

userdom_watch_user_home_dirs( domain )
Summary

watch users home directories.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_write_all_user_runtime_named_sockets( domain )
Summary

write user runtime socket files

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_write_all_users_keys( domain )
Summary

Write keys for all user domains.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_write_user_runtime_sockets( domain )
Summary

write user runtime sockets

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_write_user_tmp_files( domain )
Summary

Write all users files in /tmp

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_write_user_tmp_sockets( domain )
Summary

Write to user temporary named sockets.

Parameters
Parameter:Description:
domain

Domain allowed access.

userdom_xsession_spec_domtrans_all_users( domain )
Summary

Execute an Xserver session in all user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed to transition.

userdom_xsession_spec_domtrans_unpriv_users( domain )
Summary

Execute an Xserver session in all unprivileged user domains. This is an explicit transition, requiring the caller to use setexeccon().

Parameters
Parameter:Description:
domain

Domain allowed to transition.

Return

Templates:

userdom_admin_user_template( userdomain_prefix )
Summary

The template for creating an administrative user.

Description

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

The privileges given to administrative users are:

  • Raw disk access

  • Set all sysctls

  • All kernel ring buffer controls

  • Create, read, write, and delete all files but shadow

  • Manage source and binary format SELinux policy

  • Run insmod

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., sysadm is the prefix for sysadm_t).

userdom_base_user_template( userdomain_prefix )
Summary

The template containing the most basic rules common to all users.

Description

The template containing the most basic rules common to all users.

This template creates a user domain, types, and rules for the user's tty and pty.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_basic_networking_template( userdomain_prefix )
Summary

The template allowing the user basic network permissions

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_change_password_template( userdomain_prefix )
Summary

The template for allowing the user to change passwords.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_common_user_template( userdomain_prefix )
Summary

The template containing rules common to unprivileged users and administrative users.

Description

This template creates a user domain, types, and rules for the user's tty, pty, tmp, and tmpfs files.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_login_user_template( userdomain_prefix )
Summary

The template for creating a login user.

Description

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_restricted_user_template( userdomain_prefix )
Summary

The template for creating a unprivileged login user.

Description

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_restricted_xwindows_user_template( userdomain_prefix )
Summary

The template for creating a unprivileged xwindows login user.

Description

The template for creating a unprivileged xwindows login user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_unpriv_user_template( userdomain_prefix )
Summary

The template for creating a unprivileged user roughly equivalent to a regular linux user.

Description

The template for creating a unprivileged user roughly equivalent to a regular linux user.

This template creates a user domain, types, and rules for the user's tty, pty, home directories, tmp, and tmpfs files.

Parameters
Parameter:Description:
userdomain_prefix

The prefix of the user domain (e.g., user is the prefix for user_t).

userdom_user_content_access_template( prefix , domain )
Summary

Template for handling user content through standard tunables

Description

This template generates the tunable blocks for accessing end user content, either the generic one (user_home_t) or the complete one (based on user_home_content_type).

It calls the *_read_generic_user_content, *_read_all_user_content, *_manage_generic_user_content, and *_manage_all_user_content booleans.

Parameters
Parameter:Description:
prefix

The application domain prefix to use, meant for the boolean calls

domain

The application domain which is granted the necessary privileges

userdom_xdg_user_template( domain )
Summary

Allow user to interact with xdg content types

Description

Create rules to allow a user to manage xdg content in a user home directory with an automatic type transition to those types.

This is a templated interface, and should only be called from a per-userdomain template.

Parameters
Parameter:Description:
domain

Domain allowed access.

Return