Index: policy/modules/kernel/corenetwork.te.in
===================================================================
--- policy/modules/kernel/corenetwork.te.in (revision 2473)
+++ policy/modules/kernel/corenetwork.te.in (working copy)
@@ -59,115 +59,116 @@
#
type server_packet_t, packet_type, server_packet_type;
-network_port(afs_bos, udp,7007,s0)
-network_port(afs_fs, tcp,2040,s0, udp,7000,s0, udp,7005,s0)
-network_port(afs_ka, udp,7004,s0)
-network_port(afs_pt, udp,7002,s0)
-network_port(afs_vl, udp,7003,s0)
-network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0)
-network_port(amavisd_recv, tcp,10024,s0)
-network_port(amavisd_send, tcp,10025,s0)
-network_port(aol, tcp,5190,s0, udp,5190,s0)
-network_port(apcupsd, tcp,3551,s0, udp,3551,s0)
-network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0)
-network_port(auth, tcp,113,s0)
-network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)
+network_port(afs_bos,udp,7007,s0);
+network_port(afs_fs,tcp,2040,s0,udp,7000,s0,udp,7005,s0);
+network_port(afs_ka,udp,7004,s0);
+network_port(afs_pt,udp,7002,s0);
+network_port(afs_vl,udp,7003,s0);
+network_port(amanda,udp,10080,s0,tcp,10080,s0,udp,10081,s0,tcp,10081,s0,tcp,10082,s0,tcp,10083,s0);
+network_port(amavisd_recv,tcp,10024,s0);
+network_port(amavisd_send,tcp,10025,s0);
+network_port(aol,tcp,5190,s0,udp,5190,s0);
+network_port(apcupsd,tcp,3551,s0,udp,3551,s0);
+network_port(asterisk,tcp,1720,s0,udp,2427,s0,udp,2727,s0,udp,4569,s0,udp,5060,s0);
+network_port(auth,tcp,113,s0);
+network_port(bgp,tcp,179,s0,udp,179,s0,tcp,2605,s0,udp,2605,s0);
type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict
-network_port(clamd, tcp,3310,s0)
-network_port(clockspeed, udp,4041,s0)
-network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)
-network_port(comsat, udp,512,s0)
-network_port(cvs, tcp,2401,s0, udp,2401,s0)
-network_port(dcc, udp,6276,s0, udp,6277,s0)
-network_port(dbskkd, tcp,1178,s0)
-network_port(dhcpc, udp,68,s0)
-network_port(dhcpd, udp,67,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0)
-network_port(dict, tcp,2628,s0)
-network_port(distccd, tcp,3632,s0)
-network_port(dns, udp,53,s0, tcp,53,s0)
-network_port(fingerd, tcp,79,s0)
-network_port(ftp_data, tcp,20,s0)
-network_port(ftp, tcp,21,s0)
-network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0)
-network_port(giftd, tcp,1213,s0)
-network_port(gopher, tcp,70,s0, udp,70,s0)
-network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy
-network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port
-network_port(howl, tcp,5335,s0, udp,5353,s0)
-network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0)
-network_port(i18n_input, tcp,9010,s0)
-network_port(imaze, tcp,5323,s0, udp,5323,s0)
-network_port(inetd_child, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0)
-network_port(innd, tcp,119,s0)
-network_port(ipp, tcp,631,s0, udp,631,s0)
-network_port(ircd, tcp,6667,s0)
-network_port(isakmp, udp,500,s0)
-network_port(iscsi, tcp,3260,s0)
-network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)
-network_port(jabber_interserver, tcp,5269,s0)
-network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0)
-network_port(kerberos_master, tcp,4444,s0, udp,4444,s0)
-network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)
-network_port(ktalkd, udp,517,s0, udp,518,s0)
-network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0)
+network_port(clamd,tcp,3310,s0);
+network_port(clockspeed,udp,4041,s0);
+network_port(cluster,tcp,5149,s0,udp,5149,s0,tcp,40040,s0,tcp,50006,s0,udp,50006,s0,tcp,50007,s0,udp,50007,s0,tcp,50008,s0,udp,50008,s0);
+network_port(comsat,udp,512,s0);
+network_port(cvs,tcp,2401,s0,udp,2401,s0);
+network_port(dcc,udp,6276,s0,udp,6277,s0);
+network_port(dbskkd,tcp,1178,s0);
+network_port(dhcpc,udp,68,s0);
+network_port(dhcpd,udp,67,s0,tcp,647,s0,udp,647,s0,tcp,847,s0,udp,847,s0);
+network_port(dict,tcp,2628,s0);
+network_port(distccd,tcp,3632,s0);
+network_port(dns,udp,53,s0,tcp,53,s0);
+network_port(fingerd,tcp,79,s0);
+network_port(ftp_data,tcp,20,s0);
+network_port(ftp,tcp,21,s0);
+network_port(gatekeeper,udp,1718,s0,udp,1719,s0,tcp,1721,s0,tcp,7000,s0);
+network_port(giftd,tcp,1213,s0);
+network_port(gopher,tcp,70,s0,udp,70,s0);
+network_port(http_cache,tcp,3128,s0,udp,3130,s0,tcp,8080,s0,tcp,8118,s0);
+network_port(http,tcp,80,s0,tcp,443,s0,tcp,488,s0,tcp,8008,s0,tcp,8009,s0,tcp,8443,s0);
+network_port(howl,tcp,5335,s0,udp,5353,s0);
+network_port(hplip,tcp,1782,s0,tcp,2207,s0,tcp,2208,s0,tcp,50000,s0,tcp,50002,s0,tcp,8292,s0,tcp,9100,s0,tcp,9101,s0,tcp,9102,s0,tcp,9220,s0,tcp,9221,s0,tcp,9222,s0,tcp,9280,s0,tcp,9281,s0,tcp,9282,s0,tcp,9290,s0,tcp,9291,s0,tcp,9292,s0);
+network_port(i18n_input,tcp,9010,s0);
+network_port(imaze,tcp,5323,s0,udp,5323,s0);
+network_port(inetd_child,tcp,7,s0,udp,7,s0,tcp,9,s0,udp,9,s0,tcp,13,s0,udp,13,s0,tcp,19,s0,udp,19,s0,tcp,37,s0,udp,37,s0,tcp,512,s0,tcp,543,s0,tcp,544,s0,tcp,891,s0,udp,891,s0,tcp,892,s0,udp,892,s0,tcp,2105,s0,tcp,5666,s0);
+network_port(innd,tcp,119,s0);
+network_port(ipp,tcp,631,s0,udp,631,s0);
+network_port(ircd,tcp,6667,s0);
+network_port(isakmp,udp,500,s0);
+network_port(iscsi,tcp,3260,s0);
+network_port(jabber_client,tcp,5222,s0,tcp,5223,s0);
+network_port(jabber_interserver,tcp,5269,s0);
+network_port(kerberos_admin,tcp,464,s0,udp,464,s0,tcp,749,s0);
+network_port(kerberos_master,tcp,4444,s0,udp,4444,s0);
+network_port(kerberos,tcp,88,s0,udp,88,s0,tcp,750,s0,udp,750,s0);
+network_port(ktalkd,udp,517,s0,udp,518,s0);
+network_port(ldap,tcp,389,s0,udp,389,s0,tcp,636,s0,udp,636,s0);
type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon
-network_port(lmtp, tcp,24,s0, udp,24,s0)
-network_port(mail, tcp,2000,s0)
-network_port(mmcc, tcp,5050,s0, udp,5050,s0)
-network_port(msnp, tcp,1863,s0, udp,1863,s0)
-network_port(monopd, tcp,1234,s0)
-network_port(mysqld, tcp,3306,s0)
-network_port(nessus, tcp,1241,s0)
-network_port(netsupport, tcp,5405,s0, udp,5405,s0)
-network_port(nmbd, udp,137,s0, udp,138,s0)
-network_port(ntp, udp,123,s0)
-network_port(ocsp, tcp,9080,s0)
-network_port(openvpn, tcp,1194,s0, udp,1194,s0)
-network_port(pegasus_http, tcp,5988,s0)
-network_port(pegasus_https, tcp,5989,s0)
-network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0)
-network_port(portmap, udp,111,s0, tcp,111,s0)
-network_port(postgresql, tcp,5432,s0)
-network_port(postgrey, tcp,60000,s0)
-network_port(printer, tcp,515,s0)
-network_port(ptal, tcp,5703,s0)
-network_port(pxe, udp,4011,s0)
-network_port(pyzor, udp,24441,s0)
-network_port(radacct, udp,1646,s0, udp,1813,s0)
-network_port(radius, udp,1645,s0, udp,1812,s0)
-network_port(razor, tcp,2703,s0)
-network_port(ricci, tcp,11111,s0, udp,11111,s0)
-network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)
-network_port(rlogind, tcp,513,s0)
-network_port(rndc, tcp,953,s0)
-network_port(router, udp,520,s0)
-network_port(rsh, tcp,514,s0)
-network_port(rsync, tcp,873,s0, udp,873,s0)
-network_port(rwho, udp,513,s0)
-network_port(smbd, tcp,139,s0, tcp,445,s0)
-network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0)
-network_port(spamd, tcp,783,s0)
-network_port(ssh, tcp,22,s0)
-network_port(soundd, tcp,8000,s0, tcp,9433,s0)
+network_port(lmtp,tcp,24,s0,udp,24,s0);
+network_port(mail,tcp,2000,s0);
+network_port(mmcc,tcp,5050,s0,udp,5050,s0);
+network_port(msnp,tcp,1863,s0,udp,1863,s0);
+network_port(monopd,tcp,1234,s0);
+network_port(mysqld,tcp,3306,s0);
+network_port(nessus,tcp,1241,s0);
+network_port(netsupport,tcp,5405,s0,udp,5405,s0);
+network_port(nmbd,udp,137,s0,udp,138,s0);
+network_port(ntp,udp,123,s0);
+network_port(ocsp,tcp,9080,s0);
+network_port(openvpn,tcp,1194,s0,udp,1194,s0);
+network_port(pegasus_http,tcp,5988,s0);
+network_port(pegasus_https,tcp,5989,s0);
+network_port(pop,tcp,106,s0,tcp,109,s0,tcp,110,s0,tcp,143,s0,tcp,220,s0,tcp,993,s0,tcp,995,s0,tcp,1109,s0);
+network_port(portmap,udp,111,s0,tcp,111,s0);
+network_port(postgresql,tcp,5432,s0);
+network_port(postgrey,tcp,60000,s0);
+network_port(printer,tcp,515,s0);
+network_port(ptal,tcp,5703,s0);
+network_port(pxe,udp,4011,s0);
+network_port(pyzor,udp,24441,s0);
+network_port(radacct,udp,1646,s0,udp,1813,s0);
+network_port(radius,udp,1645,s0,udp,1812,s0);
+network_port(razor,tcp,2703,s0);
+network_port(ricci,tcp,11111,s0,udp,11111,s0);
+network_port(ricci_modcluster,tcp,16851,s0,udp,16851,s0);
+network_port(rlogind,tcp,513,s0);
+network_port(rndc,tcp,953,s0);
+network_port(router,udp,520,s0);
+network_port(rsh,tcp,514,s0);
+network_port(rsync,tcp,873,s0,udp,873,s0);
+network_port(rwho,udp,513,s0);
+network_port(smbd,tcp,139,s0,tcp,445,s0);
+network_port(smtp,tcp,25,s0,tcp,465,s0,tcp,587,s0);
+network_port(snmp,udp,161,s0,udp,162,s0,tcp,199,s0);
+network_port(spamd,tcp,783,s0);
+network_port(ssh,tcp,22,s0);
+network_port(soundd,tcp,8000,s0,tcp,9433,s0);
type socks_port_t, port_type; dnl network_port(socks) # no defined portcon
type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict
-network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp
-network_port(swat, tcp,901,s0)
-network_port(syslogd, udp,514,s0)
-network_port(telnetd, tcp,23,s0)
-network_port(tftp, udp,69,s0)
-network_port(tor, tcp,9001,s0, tcp,9030,s0, tcp,9050,s0)
-network_port(traceroute, udp,64000,s0, udp,64001,s0, udp,64002,s0, udp,64003,s0, udp,64004,s0, udp,64005,s0, udp,64006,s0, udp,64007,s0, udp,64008,s0, udp,64009,s0, udp,64010,s0)
-network_port(transproxy, tcp,8081,s0)
+network_port(squid,udp,3401,s0,tcp,3401,s0,udp,4827,s0,tcp,4827,s0);
+network_port(swat,tcp,901,s0);
+network_port(syslogd,udp,514,s0);
+network_port(telnetd,tcp,23,s0);
+network_port(tftp,udp,69,s0);
+network_port(tor,tcp,9001,s0,tcp,9030,s0,tcp,9050,s0);
+network_port(traceroute,udp,64000,s0,udp,64001,s0,udp,64002,s0,udp,64003,s0,udp,64004,s0,udp,64005,s0,udp,64006,s0,udp,64007,s0,udp,64008,s0,udp,64009,s0,udp,64010,s0);
+network_port(transproxy,tcp,8081,s0);
type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon
-network_port(uucpd, tcp,540,s0)
-network_port(vnc, tcp,5900,s0)
-network_port(xen, tcp,8002,s0)
-network_port(xfs, tcp,7100,s0)
-network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0)
-network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0)
-network_port(zope, tcp,8021,s0)
+network_port(uucpd,tcp,540,s0);
+network_port(vnc,tcp,5900,s0);
+network_port(xen,tcp,8002,s0);
+network_port(xfs,tcp,7100,s0);
+network_port(xserver,tcp,6000,s0,tcp,6001,s0,tcp,6002,s0,tcp,6003,s0,tcp,6004,s0,tcp,6005,s0,tcp,6006,s0,tcp,6007,s0,tcp,6008,s0,tcp,6009,s0,tcp,6010,s0,tcp,6011,s0,tcp,6012,s0,tcp,6013,s0,tcp,6014,s0,tcp,6015,s0,tcp,6016,s0,tcp,6017,s0,tcp,6018,s0,tcp,6019,s0);
+network_port(zebra,tcp,2600,s0,tcp,2601,s0,tcp,2602,s0,tcp,2603,s0,tcp,2604,s0,tcp,2606,s0,udp,2600,s0,udp,2601,s0,udp,2602,s0,udp,2603,s0,udp,2604,s0,udp,2606,s0);
+network_port(zope,tcp,8021,s0);
+network_port(xchat,tcp,4990,s0);
# Defaults for reserved ports. Earlier portcon entries take precedence;
# these entries just cover any remaining reserved ports not otherwise declared.
@@ -187,15 +188,15 @@
type node_t, node_type;
sid node gen_context(system_u:object_r:node_t,s0 - mls_systemhigh)
-network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)
-network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)
+network_node(compat_ipv4,s0,::,ffff:ffff:ffff:ffff:ffff:ffff::);
+network_node(inaddr_any,s0,0.0.0.0,255.255.255.255);
type node_internal_t, node_type; dnl network_node(internal, s0, , ) # no nodecon for this in current strict policy
-network_node(link_local, s0, fe80::, ffff:ffff:ffff:ffff::, )
-network_node(lo, s0 - mls_systemhigh, 127.0.0.1, 255.255.255.255)
-network_node(mapped_ipv4, s0, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)
-network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)
-network_node(site_local, s0, fec0::, ffc0::)
-network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)
+network_node(link_local,s0,fe80::,ffff:ffff:ffff:ffff::);
+network_node(lo,s0 - mls_systemhigh,127.0.0.1,255.255.255.255);
+network_node(mapped_ipv4,s0,::ffff:0000:0000,ffff:ffff:ffff:ffff:ffff:ffff::);
+network_node(multicast,s0 - mls_systemhigh,ff00::,ff00::);
+network_node(site_local,s0,fec0::,ffc0::);
+network_node(unspec,s0,::,ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff);
########################################
#
@@ -209,7 +210,7 @@
sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh)
build_option(`enable_mls',`
-network_interface(lo, lo,s0 - mls_systemhigh)
+network_interface(lo,lo,s0 - mls_systemhigh);
',`
typealias netif_t alias netif_lo_t;
')
Index: policy/modules/apps/xchat.fc
===================================================================
--- policy/modules/apps/xchat.fc (revision 0)
+++ policy/modules/apps/xchat.fc (revision 0)
@@ -0,0 +1,3 @@
+/usr/bin/xchat -- gen_context(system_u:object_r:xchat_exec_t,s0)
+
+HOME_DIR/\.xchat2(/.*)? gen_context(system_u:object_r:ROLE_xchat_home_t,s0)
Index: policy/modules/apps/xchat.te
===================================================================
--- policy/modules/apps/xchat.te (revision 0)
+++ policy/modules/apps/xchat.te (revision 0)
@@ -0,0 +1,8 @@
+policy_module(xchat,1.0.0)
+
+########################################
+#
+# Declarations
+#
+type xchat_exec_t;
+application_executable_file(xchat_exec_t)
Index: policy/modules/apps/xchat.if
===================================================================
--- policy/modules/apps/xchat.if (revision 0)
+++ policy/modules/apps/xchat.if (revision 0)
@@ -0,0 +1,441 @@
+## SELinux policy module
+##
+##
+## SELinux policy module for XChat
+## XChat scripting engines not supported
+##
+##
+
+#######################################
+##
+## The per role template for the XChat module.
+##
+##
+##
+## This template creates derived domains which are used
+## for XChat.
+##
+##
+## This template is invoked automatically for each user, and
+## generally does not need to be invoked directly
+## by policy writers.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## The type of the user domain.
+##
+##
+##
+##
+## The role associated with the user domain.
+##
+##
+#
+template(`xchat_per_role_template',`
+ gen_require(`
+ type xchat_exec_t;
+ ')
+
+ ########################################
+ #
+ # Declarations
+ #
+ type $1_xchat_t;
+ application_domain($1_xchat_t,xchat_exec_t)
+ role $3 types $1_xchat_t;
+
+ type $1_xchat_home_t alias $1_xchat_rw_t;
+ files_poly_member($1_xchat_home_t)
+ userdom_user_home_content($1,$1_xchat_home_t)
+
+ type $1_xchat_tmpfs_t;
+ files_tmpfs_file($1_xchat_tmpfs_t)
+
+ ########################################
+ #
+ # Local Policy
+ #
+ allow $1_xchat_t self:process { signal getsched setsched sigkill };
+ allow $1_xchat_t self:fifo_file rw_fifo_file_perms;
+ allow $1_xchat_t self:sem create_sem_perms;
+ allow $1_xchat_t self:netlink_route_socket r_netlink_socket_perms;
+ allow $1_xchat_t self:tcp_socket { create_socket_perms accept listen };
+ allow $1_xchat_t self:udp_socket create_socket_perms;
+
+ allow $1_xchat_t $2:fd use;
+ allow $1_xchat_t $2:process sigchld;
+
+ # XChat(GConfd-2) wants to stream connect to /tmp/orbit-*
+ allow $1_xchat_t $2:unix_stream_socket connectto;
+ allow $2 $1_xchat_t:unix_stream_socket connectto;
+
+ allow $2 $1_xchat_t:fd use;
+ allow $2 $1_xchat_t:shm { associate getattr unix_read unix_write };
+ allow $2 $1_xchat_t:process ptrace;
+
+ manage_dirs_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+ manage_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+ manage_sock_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)
+
+ userdom_user_home_dir_filetrans($1,$1_xchat_t,$1_xchat_home_t,{ dir sock_file file })
+ userdom_search_user_home_dirs($1,$1_xchat_t)
+
+ userdom_list_user_home_content_dirs($1,$1_xchat_t)
+
+ userdom_dbus_sendrecv_all_users($1_xchat_t)
+
+ userdom_read_user_home_content_files($1,$1_xchat_t)
+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+ userdom_read_user_tmp_files($1,$1_xchat_t)
+ userdom_manage_user_tmp_dirs($1,$1_xchat_t)
+ userdom_manage_user_tmp_files($1,$1_xchat_t)
+ userdom_manage_user_tmp_sockets($1,$1_xchat_t)
+ userdom_tmp_filetrans_user_tmp($1,$1_xchat_t, { file dir sock_file })
+
+ # XChat wants getattr to Beagle sock_file in home
+ dontaudit $1_xchat_t $1_home_t:sock_file getattr;
+
+ userdom_unlink_unpriv_users_home_content_files($1_xchat_t)
+ userdom_dontaudit_write_user_home_content_files($1,$1_xchat_t)
+
+ manage_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ manage_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ manage_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+ relabel_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ relabel_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+ relabel_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)
+
+ manage_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_lnk_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_fifo_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ manage_sock_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)
+ fs_tmpfs_filetrans($1_xchat_t,$1_xchat_tmpfs_t,{ file lnk_file sock_file fifo_file })
+ fs_rw_tmpfs_files($1_xchat_t)
+
+ corenet_tcp_bind_xchat_port($1_xchat_t)
+
+ corenet_all_recvfrom_netlabel($1_xchat_t)
+ corenet_tcp_sendrecv_all_ports($1_xchat_t)
+ corenet_tcp_connect_all_ports($1_xchat_t)
+ corenet_tcp_connect_generic_port($1_xchat_t)
+ corenet_all_recvfrom_unlabeled($1_xchat_t)
+ corenet_tcp_sendrecv_all_if($1_xchat_t)
+ corenet_tcp_sendrecv_all_nodes($1_xchat_t)
+ corenet_tcp_bind_all_nodes($1_xchat_t)
+ corenet_raw_sendrecv_generic_if($1_xchat_t)
+ corenet_raw_sendrecv_all_nodes($1_xchat_t)
+ corenet_sendrecv_generic_client_packets($1_xchat_t)
+
+ corenet_dontaudit_tcp_sendrecv_generic_port($1_xchat_t)
+ corenet_dontaudit_tcp_bind_generic_port($1_xchat_t)
+
+ kernel_read_system_state($1_xchat_t)
+ sysnet_read_config($1_xchat_t)
+
+ files_read_etc_files($1_xchat_t)
+ files_read_etc_symlinks($1_xchat_t)
+ files_read_etc_runtime_files($1_xchat_t)
+
+ files_read_usr_files($1_xchat_t)
+ files_read_usr_symlinks($1_xchat_t)
+
+ kernel_dontaudit_list_unlabeled($1_xchat_t)
+ kernel_dontaudit_getattr_unlabeled_files($1_xchat_t)
+ kernel_dontaudit_read_unlabeled_files($1_xchat_t)
+
+ files_dontaudit_list_non_security($1_xchat_t)
+ files_dontaudit_getattr_non_security_files($1_xchat_t)
+ fs_dontaudit_getattr_all_fs($1_xchat_t)
+
+ dev_getattr_sysfs_dirs($1_xchat_t)
+ fs_search_auto_mountpoints($1_xchat_t)
+ fs_list_inotifyfs($1_xchat_t)
+
+ term_dontaudit_getattr_pty_dirs($1_xchat_t)
+
+ selinux_dontaudit_getattr_fs($1_xchat_t)
+
+ dev_dontaudit_getattr_all_blk_files($1_xchat_t)
+ dev_dontaudit_getattr_all_chr_files($1_xchat_t)
+
+ domain_auto_trans($2, xchat_exec_t, $1_xchat_t)
+ allow $2 $1_xchat_t:process { noatsecure siginh rlimitinh };
+
+ ps_process_pattern($2,$1_xchat_t)
+ allow $2 $1_xchat_t:process signal_perms;
+
+ libs_exec_lib_files($1_xchat_t)
+ libs_use_ld_so($1_xchat_t)
+
+ miscfiles_read_localization($1_xchat_t)
+
+ logging_send_syslog_msg($1_xchat_t)
+
+ corecmd_exec_bin($1_xchat_t)
+ corecmd_dontaudit_exec_all_executables($1_xchat_t)
+ corecmd_bin_entry_type($1_xchat_t)
+ corecmd_read_bin_symlinks($1_xchat_t)
+ corecmd_shell_entry_type($1_xchat_t)
+
+ dev_read_urand($1_xchat_t)
+ dev_read_rand($1_xchat_t)
+
+ dev_read_sound($1_xchat_t)
+ dev_write_sound($1_xchat_t)
+
+ alsa_read_rw_config($1_xchat_t)
+
+ userdom_use_user_terminals($1,$1_xchat_t)
+
+ xserver_user_client_template($1,$1_xchat_t,$1_xchat_tmpfs_t)
+
+ xserver_dontaudit_read_xdm_tmp_files($1_xchat_t)
+ xserver_dontaudit_getattr_xdm_tmp_sockets($1_xchat_t)
+
+ ifdef(`enable_mls',`',`
+ fs_search_removable($1_xchat_t)
+ fs_read_removable_files($1_xchat_t)
+ fs_read_removable_symlinks($1_xchat_t)
+ ')
+
+ tunable_policy(`write_untrusted_content',`
+ userdom_manage_user_home_content_dirs($1,$1_xchat_t)
+ userdom_manage_user_home_content_files($1,$1_xchat_t)
+ userdom_manage_user_home_content_sockets($1,$1_xchat_t)
+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)
+ ')
+
+ tunable_policy(`use_nfs_home_dirs',`
+ fs_manage_nfs_dirs($1_xchat_t)
+ fs_manage_nfs_files($1_xchat_t)
+ fs_manage_nfs_symlinks($1_xchat_t)
+ ')
+
+ tunable_policy(`use_samba_home_dirs',`
+ fs_manage_cifs_dirs($1_xchat_t)
+ fs_manage_cifs_files($1_xchat_t)
+ fs_manage_cifs_symlinks($1_xchat_t)
+ ')
+
+ optional_policy(`
+ dbus_user_bus_client_template($1,$1_xchat,$1_xchat_t)
+ dbus_sendrcv_user_bus($1,$1_xchat_t)
+ dbus_system_bus_client_template($1_xchat,$1_xchat_t)
+ dbus_send_system_bus($1_xchat_t)
+ ')
+
+ optional_policy(`
+ gnome_manage_user_gnome_config($1,$1_xchat_t)
+ gnome_domtrans_user_gconf($1,$1_xchat_t)
+ gnome_stream_connect_gconf_template($1,$1_xchat_t)
+ ')
+
+ optional_policy(`
+ mozilla_read_user_home_files($1,$1_xchat_t)
+ mozilla_domtrans_user_mozilla($1,$1_xchat_t)
+ mozilla_dbus_chat($1,$1_xchat_t)
+ ')
+')
+
+########################################
+##
+## Read XChat per user homedir
+##
+##
+##
+## Read XChat per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`xchat_read_user_home_files',`
+ gen_require(`
+ type $1_xchat_home_t;
+ ')
+
+ allow $2 $1_xchat_home_t:dir list_dir_perms;
+ allow $2 $1_xchat_home_t:file read_file_perms;
+')
+
+########################################
+##
+## Write XChat per user homedir
+##
+##
+##
+## Write XChat per user homedir
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`xchat_write_user_home_files',`
+ gen_require(`
+ type $1_xchat_home_t;
+ ')
+
+ allow $2 $1_xchat_home_t:dir list_dir_perms;
+ allow $2 $1_xchat_home_t:file write;
+')
+
+########################################
+##
+## Run XChat in user XChat domain.
+##
+##
+##
+## Run XChat in user XChat domain.
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`xchat_domtrans_user_xchat',`
+ gen_require(`
+ type $1_xchat_t, xchat_exec_t;
+ ')
+
+ domtrans_pattern($2, xchat_exec_t,$1_xchat_t)
+')
+
+########################################
+##
+## Read/write XChat per user tcp_socket
+##
+##
+##
+## Read/write XChat per user tcp_socket
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`xchat_rw_user_tcp_sockets',`
+ gen_require(`
+ type $1_xchat_t;
+ ')
+
+ allow $2 $1_xchat_t:tcp_socket rw_socket_perms;
+')
+
+########################################
+##
+## XChat connection template.
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## The type of the user domain.
+##
+##
+#
+template(`xchat_stream_connect_template',`
+ gen_require(`
+ type $1_xchat_t;
+ ')
+
+ allow $2 $1_xchat_t:unix_stream_socket connectto;
+')
+
+########################################
+##
+## Send and receive messages from
+## XChat over dbus.
+##
+##
+##
+## Send and receive messages from
+## XChat over dbus.
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`xchat_dbus_chat',`
+ gen_require(`
+ type $1_xchat_t;
+ class dbus send_msg;
+ ')
+
+ allow $2 $1_xchat_t:dbus send_msg;
+ allow $1_xchat_t $2:dbus send_msg;
+')
Index: policy/modules/services/dbus.if
===================================================================
--- policy/modules/services/dbus.if (revision 2473)
+++ policy/modules/services/dbus.if (working copy)
@@ -369,3 +369,29 @@
allow $1 system_dbusd_t:dbus *;
')
+
+########################################
+##
+## Send and receive a message on
+## user/application specific DBUS.
+##
+##
+##
+## The prefix of the domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`dbus_sendrcv_user_bus',`
+ gen_require(`
+ type $1_dbusd_t;
+ class dbus all_dbus_perms;
+ ')
+
+ allow $2 $1_dbusd_t:dbus *;
+')
Index: policy/modules/system/userdomain.if
===================================================================
--- policy/modules/system/userdomain.if (revision 2473)
+++ policy/modules/system/userdomain.if (working copy)
@@ -5559,3 +5559,82 @@
interface(`userdom_unconfined',`
refpolicywarn(`$0($*) has been deprecated.')
')
+
+########################################
+##
+## List directories
+## in a user home subdirectory.
+##
+##
+##
+## List directories
+## in a user home subdirectory.
+##
+##
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+##
+##
+##
+##
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+##
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+template(`userdom_list_user_home_content_dirs',`
+ gen_require(`
+ type $1_home_dir_t, $1_home_t;
+ attribute user_home_type;
+ ')
+
+ files_search_home($2)
+ list_dirs_pattern($2,{ $1_home_dir_t user_home_type },$1_home_t)
+')
+
+########################################
+##
+## Send and receive a dbus message to
+## and from all user domains.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`userdom_dbus_sendrecv_all_users',`
+ gen_require(`
+ attribute userdomain;
+ class dbus send_msg;
+ ')
+
+ allow $1 userdomain:dbus send_msg;
+ allow userdomain $1:dbus send_msg;
+')
+
+########################################
+##
+## Unlink all unprivileged users home directory
+## files.
+##
+##
+##
+## Domain allowed access.
+##
+##
+#
+interface(`userdom_unlink_unpriv_users_home_content_files',`
+ gen_require(`
+ attribute user_home_dir_type, user_home_type;
+ ')
+
+ files_search_home($1)
+ allow $1 user_home_dir_type:dir list_dir_perms;
+ allow $1 user_home_type:file unlink;
+')