rendered paste bodyIndex: policy/modules/kernel/corenetwork.te.in===================================================================--- policy/modules/kernel/corenetwork.te.in (revision 2473)+++ policy/modules/kernel/corenetwork.te.in (working copy)@@ -59,115 +59,116 @@ # type server_packet_t, packet_type, server_packet_type; -network_port(afs_bos, udp,7007,s0)-network_port(afs_fs, tcp,2040,s0, udp,7000,s0, udp,7005,s0)-network_port(afs_ka, udp,7004,s0)-network_port(afs_pt, udp,7002,s0)-network_port(afs_vl, udp,7003,s0)-network_port(amanda, udp,10080,s0, tcp,10080,s0, udp,10081,s0, tcp,10081,s0, tcp,10082,s0, tcp,10083,s0)-network_port(amavisd_recv, tcp,10024,s0)-network_port(amavisd_send, tcp,10025,s0)-network_port(aol, tcp,5190,s0, udp,5190,s0)-network_port(apcupsd, tcp,3551,s0, udp,3551,s0)-network_port(asterisk, tcp,1720,s0, udp,2427,s0, udp,2727,s0, udp,4569,s0, udp,5060,s0)-network_port(auth, tcp,113,s0)-network_port(bgp, tcp,179,s0, udp,179,s0, tcp,2605,s0, udp,2605,s0)+network_port(afs_bos,udp,7007,s0);+network_port(afs_fs,tcp,2040,s0,udp,7000,s0,udp,7005,s0);+network_port(afs_ka,udp,7004,s0);+network_port(afs_pt,udp,7002,s0);+network_port(afs_vl,udp,7003,s0);+network_port(amanda,udp,10080,s0,tcp,10080,s0,udp,10081,s0,tcp,10081,s0,tcp,10082,s0,tcp,10083,s0);+network_port(amavisd_recv,tcp,10024,s0);+network_port(amavisd_send,tcp,10025,s0);+network_port(aol,tcp,5190,s0,udp,5190,s0);+network_port(apcupsd,tcp,3551,s0,udp,3551,s0);+network_port(asterisk,tcp,1720,s0,udp,2427,s0,udp,2727,s0,udp,4569,s0,udp,5060,s0);+network_port(auth,tcp,113,s0);+network_port(bgp,tcp,179,s0,udp,179,s0,tcp,2605,s0,udp,2605,s0); type biff_port_t, port_type, reserved_port_type; dnl network_port(biff) # no defined portcon in current strict-network_port(clamd, tcp,3310,s0)-network_port(clockspeed, udp,4041,s0)-network_port(cluster, tcp,5149,s0, udp,5149,s0, tcp,40040,s0, tcp,50006,s0, udp,50006,s0, tcp,50007,s0, udp,50007,s0, tcp,50008,s0, udp,50008,s0)-network_port(comsat, udp,512,s0)-network_port(cvs, tcp,2401,s0, udp,2401,s0)-network_port(dcc, udp,6276,s0, udp,6277,s0)-network_port(dbskkd, tcp,1178,s0)-network_port(dhcpc, udp,68,s0)-network_port(dhcpd, udp,67,s0, tcp,647,s0, udp,647,s0, tcp,847,s0, udp,847,s0)-network_port(dict, tcp,2628,s0)-network_port(distccd, tcp,3632,s0)-network_port(dns, udp,53,s0, tcp,53,s0)-network_port(fingerd, tcp,79,s0)-network_port(ftp_data, tcp,20,s0)-network_port(ftp, tcp,21,s0)-network_port(gatekeeper, udp,1718,s0, udp,1719,s0, tcp,1721,s0, tcp,7000,s0)-network_port(giftd, tcp,1213,s0)-network_port(gopher, tcp,70,s0, udp,70,s0)-network_port(http_cache, tcp,3128,s0, udp,3130,s0, tcp,8080,s0, tcp,8118,s0) # 8118 is for privoxy-network_port(http, tcp,80,s0, tcp,443,s0, tcp,488,s0, tcp,8008,s0, tcp,8009,s0, tcp,8443,s0) #8443 is mod_nss default port-network_port(howl, tcp,5335,s0, udp,5353,s0)-network_port(hplip, tcp,1782,s0, tcp,2207,s0, tcp,2208,s0, tcp,50000,s0, tcp,50002,s0, tcp,8292,s0, tcp,9100,s0, tcp,9101,s0, tcp,9102,s0, tcp,9220,s0, tcp,9221,s0, tcp,9222,s0, tcp,9280,s0, tcp,9281,s0, tcp,9282,s0, tcp,9290,s0, tcp,9291,s0, tcp,9292,s0)-network_port(i18n_input, tcp,9010,s0)-network_port(imaze, tcp,5323,s0, udp,5323,s0)-network_port(inetd_child, tcp,7,s0, udp,7,s0, tcp,9,s0, udp,9,s0, tcp,13,s0, udp,13,s0, tcp,19,s0, udp,19,s0, tcp,37,s0, udp,37,s0, tcp,512,s0, tcp,543,s0, tcp,544,s0, tcp,891,s0, udp,891,s0, tcp,892,s0, udp,892,s0, tcp,2105,s0, tcp,5666,s0)-network_port(innd, tcp,119,s0)-network_port(ipp, tcp,631,s0, udp,631,s0)-network_port(ircd, tcp,6667,s0)-network_port(isakmp, udp,500,s0)-network_port(iscsi, tcp,3260,s0)-network_port(jabber_client, tcp,5222,s0, tcp,5223,s0)-network_port(jabber_interserver, tcp,5269,s0)-network_port(kerberos_admin, tcp,464,s0, udp,464,s0, tcp,749,s0)-network_port(kerberos_master, tcp,4444,s0, udp,4444,s0)-network_port(kerberos, tcp,88,s0, udp,88,s0, tcp,750,s0, udp,750,s0)-network_port(ktalkd, udp,517,s0, udp,518,s0)-network_port(ldap, tcp,389,s0, udp,389,s0, tcp,636,s0, udp,636,s0)+network_port(clamd,tcp,3310,s0);+network_port(clockspeed,udp,4041,s0);+network_port(cluster,tcp,5149,s0,udp,5149,s0,tcp,40040,s0,tcp,50006,s0,udp,50006,s0,tcp,50007,s0,udp,50007,s0,tcp,50008,s0,udp,50008,s0);+network_port(comsat,udp,512,s0);+network_port(cvs,tcp,2401,s0,udp,2401,s0);+network_port(dcc,udp,6276,s0,udp,6277,s0);+network_port(dbskkd,tcp,1178,s0);+network_port(dhcpc,udp,68,s0);+network_port(dhcpd,udp,67,s0,tcp,647,s0,udp,647,s0,tcp,847,s0,udp,847,s0);+network_port(dict,tcp,2628,s0);+network_port(distccd,tcp,3632,s0);+network_port(dns,udp,53,s0,tcp,53,s0);+network_port(fingerd,tcp,79,s0);+network_port(ftp_data,tcp,20,s0);+network_port(ftp,tcp,21,s0);+network_port(gatekeeper,udp,1718,s0,udp,1719,s0,tcp,1721,s0,tcp,7000,s0);+network_port(giftd,tcp,1213,s0);+network_port(gopher,tcp,70,s0,udp,70,s0);+network_port(http_cache,tcp,3128,s0,udp,3130,s0,tcp,8080,s0,tcp,8118,s0);+network_port(http,tcp,80,s0,tcp,443,s0,tcp,488,s0,tcp,8008,s0,tcp,8009,s0,tcp,8443,s0);+network_port(howl,tcp,5335,s0,udp,5353,s0);+network_port(hplip,tcp,1782,s0,tcp,2207,s0,tcp,2208,s0,tcp,50000,s0,tcp,50002,s0,tcp,8292,s0,tcp,9100,s0,tcp,9101,s0,tcp,9102,s0,tcp,9220,s0,tcp,9221,s0,tcp,9222,s0,tcp,9280,s0,tcp,9281,s0,tcp,9282,s0,tcp,9290,s0,tcp,9291,s0,tcp,9292,s0);+network_port(i18n_input,tcp,9010,s0);+network_port(imaze,tcp,5323,s0,udp,5323,s0);+network_port(inetd_child,tcp,7,s0,udp,7,s0,tcp,9,s0,udp,9,s0,tcp,13,s0,udp,13,s0,tcp,19,s0,udp,19,s0,tcp,37,s0,udp,37,s0,tcp,512,s0,tcp,543,s0,tcp,544,s0,tcp,891,s0,udp,891,s0,tcp,892,s0,udp,892,s0,tcp,2105,s0,tcp,5666,s0);+network_port(innd,tcp,119,s0);+network_port(ipp,tcp,631,s0,udp,631,s0);+network_port(ircd,tcp,6667,s0);+network_port(isakmp,udp,500,s0);+network_port(iscsi,tcp,3260,s0);+network_port(jabber_client,tcp,5222,s0,tcp,5223,s0);+network_port(jabber_interserver,tcp,5269,s0);+network_port(kerberos_admin,tcp,464,s0,udp,464,s0,tcp,749,s0);+network_port(kerberos_master,tcp,4444,s0,udp,4444,s0);+network_port(kerberos,tcp,88,s0,udp,88,s0,tcp,750,s0,udp,750,s0);+network_port(ktalkd,udp,517,s0,udp,518,s0);+network_port(ldap,tcp,389,s0,udp,389,s0,tcp,636,s0,udp,636,s0); type lrrd_port_t, port_type; dnl network_port(lrrd_port_t) # no defined portcon-network_port(lmtp, tcp,24,s0, udp,24,s0)-network_port(mail, tcp,2000,s0)-network_port(mmcc, tcp,5050,s0, udp,5050,s0)-network_port(msnp, tcp,1863,s0, udp,1863,s0)-network_port(monopd, tcp,1234,s0)-network_port(mysqld, tcp,3306,s0)-network_port(nessus, tcp,1241,s0)-network_port(netsupport, tcp,5405,s0, udp,5405,s0)-network_port(nmbd, udp,137,s0, udp,138,s0)-network_port(ntp, udp,123,s0)-network_port(ocsp, tcp,9080,s0)-network_port(openvpn, tcp,1194,s0, udp,1194,s0)-network_port(pegasus_http, tcp,5988,s0)-network_port(pegasus_https, tcp,5989,s0)-network_port(pop, tcp,106,s0, tcp,109,s0, tcp,110,s0, tcp,143,s0, tcp,220,s0, tcp,993,s0, tcp,995,s0, tcp,1109,s0)-network_port(portmap, udp,111,s0, tcp,111,s0)-network_port(postgresql, tcp,5432,s0)-network_port(postgrey, tcp,60000,s0)-network_port(printer, tcp,515,s0)-network_port(ptal, tcp,5703,s0)-network_port(pxe, udp,4011,s0)-network_port(pyzor, udp,24441,s0)-network_port(radacct, udp,1646,s0, udp,1813,s0)-network_port(radius, udp,1645,s0, udp,1812,s0)-network_port(razor, tcp,2703,s0)-network_port(ricci, tcp,11111,s0, udp,11111,s0)-network_port(ricci_modcluster, tcp,16851,s0, udp,16851,s0)-network_port(rlogind, tcp,513,s0)-network_port(rndc, tcp,953,s0)-network_port(router, udp,520,s0)-network_port(rsh, tcp,514,s0)-network_port(rsync, tcp,873,s0, udp,873,s0)-network_port(rwho, udp,513,s0)-network_port(smbd, tcp,139,s0, tcp,445,s0)-network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)-network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0)-network_port(spamd, tcp,783,s0)-network_port(ssh, tcp,22,s0)-network_port(soundd, tcp,8000,s0, tcp,9433,s0)+network_port(lmtp,tcp,24,s0,udp,24,s0);+network_port(mail,tcp,2000,s0);+network_port(mmcc,tcp,5050,s0,udp,5050,s0);+network_port(msnp,tcp,1863,s0,udp,1863,s0);+network_port(monopd,tcp,1234,s0);+network_port(mysqld,tcp,3306,s0);+network_port(nessus,tcp,1241,s0);+network_port(netsupport,tcp,5405,s0,udp,5405,s0);+network_port(nmbd,udp,137,s0,udp,138,s0);+network_port(ntp,udp,123,s0);+network_port(ocsp,tcp,9080,s0);+network_port(openvpn,tcp,1194,s0,udp,1194,s0);+network_port(pegasus_http,tcp,5988,s0);+network_port(pegasus_https,tcp,5989,s0);+network_port(pop,tcp,106,s0,tcp,109,s0,tcp,110,s0,tcp,143,s0,tcp,220,s0,tcp,993,s0,tcp,995,s0,tcp,1109,s0);+network_port(portmap,udp,111,s0,tcp,111,s0);+network_port(postgresql,tcp,5432,s0);+network_port(postgrey,tcp,60000,s0);+network_port(printer,tcp,515,s0);+network_port(ptal,tcp,5703,s0);+network_port(pxe,udp,4011,s0);+network_port(pyzor,udp,24441,s0);+network_port(radacct,udp,1646,s0,udp,1813,s0);+network_port(radius,udp,1645,s0,udp,1812,s0);+network_port(razor,tcp,2703,s0);+network_port(ricci,tcp,11111,s0,udp,11111,s0);+network_port(ricci_modcluster,tcp,16851,s0,udp,16851,s0);+network_port(rlogind,tcp,513,s0);+network_port(rndc,tcp,953,s0);+network_port(router,udp,520,s0);+network_port(rsh,tcp,514,s0);+network_port(rsync,tcp,873,s0,udp,873,s0);+network_port(rwho,udp,513,s0);+network_port(smbd,tcp,139,s0,tcp,445,s0);+network_port(smtp,tcp,25,s0,tcp,465,s0,tcp,587,s0);+network_port(snmp,udp,161,s0,udp,162,s0,tcp,199,s0);+network_port(spamd,tcp,783,s0);+network_port(ssh,tcp,22,s0);+network_port(soundd,tcp,8000,s0,tcp,9433,s0); type socks_port_t, port_type; dnl network_port(socks) # no defined portcon type stunnel_port_t, port_type; dnl network_port(stunnel) # no defined portcon in current strict-network_port(squid, udp,3401,s0, tcp,3401,s0, udp,4827,s0, tcp,4827,s0) # snmp and htcp-network_port(swat, tcp,901,s0)-network_port(syslogd, udp,514,s0)-network_port(telnetd, tcp,23,s0)-network_port(tftp, udp,69,s0)-network_port(tor, tcp,9001,s0, tcp,9030,s0, tcp,9050,s0)-network_port(traceroute, udp,64000,s0, udp,64001,s0, udp,64002,s0, udp,64003,s0, udp,64004,s0, udp,64005,s0, udp,64006,s0, udp,64007,s0, udp,64008,s0, udp,64009,s0, udp,64010,s0)-network_port(transproxy, tcp,8081,s0)+network_port(squid,udp,3401,s0,tcp,3401,s0,udp,4827,s0,tcp,4827,s0);+network_port(swat,tcp,901,s0);+network_port(syslogd,udp,514,s0);+network_port(telnetd,tcp,23,s0);+network_port(tftp,udp,69,s0);+network_port(tor,tcp,9001,s0,tcp,9030,s0,tcp,9050,s0);+network_port(traceroute,udp,64000,s0,udp,64001,s0,udp,64002,s0,udp,64003,s0,udp,64004,s0,udp,64005,s0,udp,64006,s0,udp,64007,s0,udp,64008,s0,udp,64009,s0,udp,64010,s0);+network_port(transproxy,tcp,8081,s0); type utcpserver_port_t, port_type; dnl network_port(utcpserver) # no defined portcon-network_port(uucpd, tcp,540,s0)-network_port(vnc, tcp,5900,s0)-network_port(xen, tcp,8002,s0)-network_port(xfs, tcp,7100,s0)-network_port(xserver, tcp, 6000, s0, tcp,6001,s0, tcp,6002,s0, tcp,6003,s0, tcp,6004,s0, tcp,6005,s0, tcp,6006,s0, tcp,6007,s0, tcp,6008,s0, tcp,6009,s0, tcp,6010,s0, tcp,6011,s0, tcp,6012,s0, tcp,6013,s0, tcp,6014,s0, tcp,6015,s0, tcp,6016,s0, tcp,6017,s0, tcp,6018,s0, tcp,6019,s0)-network_port(zebra, tcp,2600,s0, tcp,2601,s0, tcp,2602,s0, tcp,2603,s0, tcp,2604,s0, tcp,2606,s0, udp,2600,s0, udp,2601,s0, udp,2602,s0, udp,2603,s0, udp,2604,s0, udp,2606,s0)-network_port(zope, tcp,8021,s0)+network_port(uucpd,tcp,540,s0);+network_port(vnc,tcp,5900,s0);+network_port(xen,tcp,8002,s0);+network_port(xfs,tcp,7100,s0);+network_port(xserver,tcp,6000,s0,tcp,6001,s0,tcp,6002,s0,tcp,6003,s0,tcp,6004,s0,tcp,6005,s0,tcp,6006,s0,tcp,6007,s0,tcp,6008,s0,tcp,6009,s0,tcp,6010,s0,tcp,6011,s0,tcp,6012,s0,tcp,6013,s0,tcp,6014,s0,tcp,6015,s0,tcp,6016,s0,tcp,6017,s0,tcp,6018,s0,tcp,6019,s0);+network_port(zebra,tcp,2600,s0,tcp,2601,s0,tcp,2602,s0,tcp,2603,s0,tcp,2604,s0,tcp,2606,s0,udp,2600,s0,udp,2601,s0,udp,2602,s0,udp,2603,s0,udp,2604,s0,udp,2606,s0);+network_port(zope,tcp,8021,s0);+network_port(xchat,tcp,4990,s0); # Defaults for reserved ports. Earlier portcon entries take precedence; # these entries just cover any remaining reserved ports not otherwise declared.@@ -187,15 +188,15 @@ type node_t, node_type; sid node gen_context(system_u:object_r:node_t,s0 - mls_systemhigh) -network_node(compat_ipv4, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff::)-network_node(inaddr_any, s0, 0.0.0.0, 255.255.255.255)+network_node(compat_ipv4,s0,::,ffff:ffff:ffff:ffff:ffff:ffff::);+network_node(inaddr_any,s0,0.0.0.0,255.255.255.255); type node_internal_t, node_type; dnl network_node(internal, s0, , ) # no nodecon for this in current strict policy-network_node(link_local, s0, fe80::, ffff:ffff:ffff:ffff::, )-network_node(lo, s0 - mls_systemhigh, 127.0.0.1, 255.255.255.255)-network_node(mapped_ipv4, s0, ::ffff:0000:0000, ffff:ffff:ffff:ffff:ffff:ffff::)-network_node(multicast, s0 - mls_systemhigh, ff00::, ff00::)-network_node(site_local, s0, fec0::, ffc0::)-network_node(unspec, s0, ::, ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff)+network_node(link_local,s0,fe80::,ffff:ffff:ffff:ffff::);+network_node(lo,s0 - mls_systemhigh,127.0.0.1,255.255.255.255);+network_node(mapped_ipv4,s0,::ffff:0000:0000,ffff:ffff:ffff:ffff:ffff:ffff::);+network_node(multicast,s0 - mls_systemhigh,ff00::,ff00::);+network_node(site_local,s0,fec0::,ffc0::);+network_node(unspec,s0,::,ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff); ######################################## #@@ -209,7 +210,7 @@ sid netif gen_context(system_u:object_r:netif_t,s0 - mls_systemhigh) build_option(`enable_mls',`-network_interface(lo, lo,s0 - mls_systemhigh)+network_interface(lo,lo,s0 - mls_systemhigh); ',` typealias netif_t alias netif_lo_t; ')Index: policy/modules/apps/xchat.fc===================================================================--- policy/modules/apps/xchat.fc (revision 0)+++ policy/modules/apps/xchat.fc (revision 0)@@ -0,0 +1,3 @@+/usr/bin/xchat -- gen_context(system_u:object_r:xchat_exec_t,s0)++HOME_DIR/\.xchat2(/.*)? gen_context(system_u:object_r:ROLE_xchat_home_t,s0)Index: policy/modules/apps/xchat.te===================================================================--- policy/modules/apps/xchat.te (revision 0)+++ policy/modules/apps/xchat.te (revision 0)@@ -0,0 +1,8 @@+policy_module(xchat,1.0.0) ++########################################+#+# Declarations+#+type xchat_exec_t;+application_executable_file(xchat_exec_t)Index: policy/modules/apps/xchat.if===================================================================--- policy/modules/apps/xchat.if (revision 0)+++ policy/modules/apps/xchat.if (revision 0)@@ -0,0 +1,441 @@+## <summary>SELinux policy module</summary>+## <desc>+## <p>+## SELinux policy module for XChat+## XChat scripting engines not supported+## </p>+## </desc>++#######################################+## <summary>+## The per role template for the XChat module.+## </summary>+## <desc>+## <p>+## This template creates derived domains which are used+## for XChat.+## </p>+## <p>+## This template is invoked automatically for each user, and+## generally does not need to be invoked directly+## by policy writers.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="user_domain">+## <summary>+## The type of the user domain.+## </summary>+## </param>+## <param name="user_role">+## <summary>+## The role associated with the user domain.+## </summary>+## </param>+#+template(`xchat_per_role_template',`+ gen_require(`+ type xchat_exec_t;+ ')++ ########################################+ #+ # Declarations+ #+ type $1_xchat_t;+ application_domain($1_xchat_t,xchat_exec_t)+ role $3 types $1_xchat_t;+ + type $1_xchat_home_t alias $1_xchat_rw_t;+ files_poly_member($1_xchat_home_t)+ userdom_user_home_content($1,$1_xchat_home_t)++ type $1_xchat_tmpfs_t;+ files_tmpfs_file($1_xchat_tmpfs_t)++ ########################################+ #+ # Local Policy+ #+ allow $1_xchat_t self:process { signal getsched setsched sigkill };+ allow $1_xchat_t self:fifo_file rw_fifo_file_perms;+ allow $1_xchat_t self:sem create_sem_perms;+ allow $1_xchat_t self:netlink_route_socket r_netlink_socket_perms;+ allow $1_xchat_t self:tcp_socket { create_socket_perms accept listen };+ allow $1_xchat_t self:udp_socket create_socket_perms;++ allow $1_xchat_t $2:fd use;+ allow $1_xchat_t $2:process sigchld;+ + # XChat(GConfd-2) wants to stream connect to /tmp/orbit-*+ allow $1_xchat_t $2:unix_stream_socket connectto;+ allow $2 $1_xchat_t:unix_stream_socket connectto;++ allow $2 $1_xchat_t:fd use;+ allow $2 $1_xchat_t:shm { associate getattr unix_read unix_write };+ allow $2 $1_xchat_t:process ptrace; ++ manage_dirs_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)+ manage_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)+ manage_sock_files_pattern($1_xchat_t,$1_xchat_home_t,$1_xchat_home_t)++ userdom_user_home_dir_filetrans($1,$1_xchat_t,$1_xchat_home_t,{ dir sock_file file })+ userdom_search_user_home_dirs($1,$1_xchat_t)++ userdom_list_user_home_content_dirs($1,$1_xchat_t)++ userdom_dbus_sendrecv_all_users($1_xchat_t)++ userdom_read_user_home_content_files($1,$1_xchat_t)+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)+ userdom_read_user_tmp_files($1,$1_xchat_t)+ userdom_manage_user_tmp_dirs($1,$1_xchat_t)+ userdom_manage_user_tmp_files($1,$1_xchat_t)+ userdom_manage_user_tmp_sockets($1,$1_xchat_t)+ userdom_tmp_filetrans_user_tmp($1,$1_xchat_t, { file dir sock_file })++ # XChat wants getattr to Beagle sock_file in home+ dontaudit $1_xchat_t $1_home_t:sock_file getattr;++ userdom_unlink_unpriv_users_home_content_files($1_xchat_t)+ userdom_dontaudit_write_user_home_content_files($1,$1_xchat_t)++ manage_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)+ manage_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)+ manage_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)++ relabel_dirs_pattern($2,$1_xchat_home_t,$1_xchat_home_t)+ relabel_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)+ relabel_sock_files_pattern($2,$1_xchat_home_t,$1_xchat_home_t)++ manage_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)+ manage_lnk_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)+ manage_fifo_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)+ manage_sock_files_pattern($1_xchat_t,$1_xchat_tmpfs_t,$1_xchat_tmpfs_t)+ fs_tmpfs_filetrans($1_xchat_t,$1_xchat_tmpfs_t,{ file lnk_file sock_file fifo_file })+ fs_rw_tmpfs_files($1_xchat_t)+ + corenet_tcp_bind_xchat_port($1_xchat_t)++ corenet_all_recvfrom_netlabel($1_xchat_t)+ corenet_tcp_sendrecv_all_ports($1_xchat_t)+ corenet_tcp_connect_all_ports($1_xchat_t)+ corenet_tcp_connect_generic_port($1_xchat_t)+ corenet_all_recvfrom_unlabeled($1_xchat_t)+ corenet_tcp_sendrecv_all_if($1_xchat_t)+ corenet_tcp_sendrecv_all_nodes($1_xchat_t)+ corenet_tcp_bind_all_nodes($1_xchat_t)+ corenet_raw_sendrecv_generic_if($1_xchat_t)+ corenet_raw_sendrecv_all_nodes($1_xchat_t)+ corenet_sendrecv_generic_client_packets($1_xchat_t)++ corenet_dontaudit_tcp_sendrecv_generic_port($1_xchat_t)+ corenet_dontaudit_tcp_bind_generic_port($1_xchat_t)++ kernel_read_system_state($1_xchat_t)+ sysnet_read_config($1_xchat_t) + + files_read_etc_files($1_xchat_t)+ files_read_etc_symlinks($1_xchat_t)+ files_read_etc_runtime_files($1_xchat_t)+ + files_read_usr_files($1_xchat_t)+ files_read_usr_symlinks($1_xchat_t)++ kernel_dontaudit_list_unlabeled($1_xchat_t)+ kernel_dontaudit_getattr_unlabeled_files($1_xchat_t)+ kernel_dontaudit_read_unlabeled_files($1_xchat_t)+ + files_dontaudit_list_non_security($1_xchat_t)+ files_dontaudit_getattr_non_security_files($1_xchat_t)+ fs_dontaudit_getattr_all_fs($1_xchat_t)++ dev_getattr_sysfs_dirs($1_xchat_t)+ fs_search_auto_mountpoints($1_xchat_t)+ fs_list_inotifyfs($1_xchat_t)+ + term_dontaudit_getattr_pty_dirs($1_xchat_t)++ selinux_dontaudit_getattr_fs($1_xchat_t)++ dev_dontaudit_getattr_all_blk_files($1_xchat_t)+ dev_dontaudit_getattr_all_chr_files($1_xchat_t)++ domain_auto_trans($2, xchat_exec_t, $1_xchat_t)+ allow $2 $1_xchat_t:process { noatsecure siginh rlimitinh };++ ps_process_pattern($2,$1_xchat_t)+ allow $2 $1_xchat_t:process signal_perms;++ libs_exec_lib_files($1_xchat_t)+ libs_use_ld_so($1_xchat_t)++ miscfiles_read_localization($1_xchat_t)++ logging_send_syslog_msg($1_xchat_t)+ + corecmd_exec_bin($1_xchat_t)+ corecmd_dontaudit_exec_all_executables($1_xchat_t)+ corecmd_bin_entry_type($1_xchat_t)+ corecmd_read_bin_symlinks($1_xchat_t)+ corecmd_shell_entry_type($1_xchat_t)+ + dev_read_urand($1_xchat_t) + dev_read_rand($1_xchat_t)++ dev_read_sound($1_xchat_t)+ dev_write_sound($1_xchat_t)++ alsa_read_rw_config($1_xchat_t) ++ userdom_use_user_terminals($1,$1_xchat_t) + + xserver_user_client_template($1,$1_xchat_t,$1_xchat_tmpfs_t)++ xserver_dontaudit_read_xdm_tmp_files($1_xchat_t)+ xserver_dontaudit_getattr_xdm_tmp_sockets($1_xchat_t)++ ifdef(`enable_mls',`',`+ fs_search_removable($1_xchat_t)+ fs_read_removable_files($1_xchat_t)+ fs_read_removable_symlinks($1_xchat_t)+ ')++ tunable_policy(`write_untrusted_content',`+ userdom_manage_user_home_content_dirs($1,$1_xchat_t)+ userdom_manage_user_home_content_files($1,$1_xchat_t)+ userdom_manage_user_home_content_sockets($1,$1_xchat_t)+ userdom_read_user_home_content_symlinks($1,$1_xchat_t)+ ')++ tunable_policy(`use_nfs_home_dirs',`+ fs_manage_nfs_dirs($1_xchat_t)+ fs_manage_nfs_files($1_xchat_t)+ fs_manage_nfs_symlinks($1_xchat_t)+ ')++ tunable_policy(`use_samba_home_dirs',`+ fs_manage_cifs_dirs($1_xchat_t)+ fs_manage_cifs_files($1_xchat_t)+ fs_manage_cifs_symlinks($1_xchat_t)+ ')++ optional_policy(`+ dbus_user_bus_client_template($1,$1_xchat,$1_xchat_t)+ dbus_sendrcv_user_bus($1,$1_xchat_t)+ dbus_system_bus_client_template($1_xchat,$1_xchat_t)+ dbus_send_system_bus($1_xchat_t)+ ')++ optional_policy(`+ gnome_manage_user_gnome_config($1,$1_xchat_t)+ gnome_domtrans_user_gconf($1,$1_xchat_t)+ gnome_stream_connect_gconf_template($1,$1_xchat_t)+ ')++ optional_policy(`+ mozilla_read_user_home_files($1,$1_xchat_t)+ mozilla_domtrans_user_mozilla($1,$1_xchat_t)+ mozilla_dbus_chat($1,$1_xchat_t)+ ')+')++########################################+## <summary>+## Read XChat per user homedir+## </summary>+## <desc>+## <p>+## Read XChat per user homedir+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`xchat_read_user_home_files',`+ gen_require(`+ type $1_xchat_home_t;+ ')++ allow $2 $1_xchat_home_t:dir list_dir_perms;+ allow $2 $1_xchat_home_t:file read_file_perms;+')++########################################+## <summary>+## Write XChat per user homedir+## </summary>+## <desc>+## <p>+## Write XChat per user homedir+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`xchat_write_user_home_files',`+ gen_require(`+ type $1_xchat_home_t;+ ')++ allow $2 $1_xchat_home_t:dir list_dir_perms;+ allow $2 $1_xchat_home_t:file write;+')++########################################+## <summary>+## Run XChat in user XChat domain.+## </summary>+## <desc>+## <p>+## Run XChat in user XChat domain.+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`xchat_domtrans_user_xchat',`+ gen_require(`+ type $1_xchat_t, xchat_exec_t;+ ')++ domtrans_pattern($2, xchat_exec_t,$1_xchat_t)+')++########################################+## <summary>+## Read/write XChat per user tcp_socket+## </summary>+## <desc>+## <p>+## Read/write XChat per user tcp_socket+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`xchat_rw_user_tcp_sockets',`+ gen_require(`+ type $1_xchat_t;+ ')++ allow $2 $1_xchat_t:tcp_socket rw_socket_perms;+')++########################################+## <summary>+## XChat connection template.+## </summary>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="user_domain">+## <summary>+## The type of the user domain.+## </summary>+## </param>+#+template(`xchat_stream_connect_template',`+ gen_require(`+ type $1_xchat_t;+ ')++ allow $2 $1_xchat_t:unix_stream_socket connectto;+')++########################################+## <summary>+## Send and receive messages from+## XChat over dbus.+## </summary>+## <desc>+## <p>+## Send and receive messages from+## XChat over dbus.+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`xchat_dbus_chat',`+ gen_require(`+ type $1_xchat_t;+ class dbus send_msg;+ ')++ allow $2 $1_xchat_t:dbus send_msg;+ allow $1_xchat_t $2:dbus send_msg;+')Index: policy/modules/services/dbus.if===================================================================--- policy/modules/services/dbus.if (revision 2473)+++ policy/modules/services/dbus.if (working copy)@@ -369,3 +369,29 @@ allow $1 system_dbusd_t:dbus *; ')++########################################+## <summary>+## Send and receive a message on +## user/application specific DBUS.+## </summary>+## <param name="user_prefix">+## <summary>+## The prefix of the domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`dbus_sendrcv_user_bus',`+ gen_require(`+ type $1_dbusd_t;+ class dbus all_dbus_perms;+ ')++ allow $2 $1_dbusd_t:dbus *;+')Index: policy/modules/system/userdomain.if===================================================================--- policy/modules/system/userdomain.if (revision 2473)+++ policy/modules/system/userdomain.if (working copy)@@ -5559,3 +5559,82 @@ interface(`userdom_unconfined',` refpolicywarn(`$0($*) has been deprecated.') ')++########################################+## <summary>+## List directories+## in a user home subdirectory.+## </summary>+## <desc>+## <p>+## List directories+## in a user home subdirectory.+## </p>+## <p>+## This is a templated interface, and should only+## be called from a per-userdomain template.+## </p>+## </desc>+## <param name="userdomain_prefix">+## <summary>+## The prefix of the user domain (e.g., user+## is the prefix for user_t).+## </summary>+## </param>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+template(`userdom_list_user_home_content_dirs',`+ gen_require(`+ type $1_home_dir_t, $1_home_t;+ attribute user_home_type;+ ')++ files_search_home($2)+ list_dirs_pattern($2,{ $1_home_dir_t user_home_type },$1_home_t)+')++########################################+## <summary>+## Send and receive a dbus message to+## and from all user domains.+## </summary>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+interface(`userdom_dbus_sendrecv_all_users',`+ gen_require(`+ attribute userdomain;+ class dbus send_msg;+ ')++ allow $1 userdomain:dbus send_msg;+ allow userdomain $1:dbus send_msg;+')++########################################+## <summary>+## Unlink all unprivileged users home directory+## files.+## </summary>+## <param name="domain">+## <summary>+## Domain allowed access.+## </summary>+## </param>+#+interface(`userdom_unlink_unpriv_users_home_content_files',`+ gen_require(`+ attribute user_home_dir_type, user_home_type;+ ')++ files_search_home($1)+ allow $1 user_home_dir_type:dir list_dir_perms;+ allow $1 user_home_type:file unlink;+')