[refpolicy] [ Simplify user content patch 6/7] userdom_manage_tmpfs_role

[domg472@gmail.com (Dominick Grift)]

Allow user domain for which userdom_manage_tmpfs_role template is called to manage and relabel all userdom_user_tmpfs_content.
Fix userdom_user_tmp_content template (forgot some stuff)
TODO:
Remove all rules that implicitly allow login user domains to manage/relabel user tmpfs files.

Signed-off-by: Dominick Grift <domg472@gmail.com>
---
:100644 100644 728d1fa... d0f53d5... M	policy/modules/system/userdomain.if
 policy/modules/system/userdomain.if |   30 ++++++++++++++++++------------
 1 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 728d1fa..d0f53d5 100644
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -301,11 +301,11 @@ interface(`userdom_manage_tmp_role',`
 	# Redundant: in userdomain.te files_policy_member_tmp(userdomain, user_tmp_t)
 	files_poly_member_tmp($2, user_tmp_t)
 
-	manage_dirs_pattern($2, user_tmp_t, user_tmp_t)
-	manage_files_pattern($2, user_tmp_t, user_tmp_t)
-	manage_lnk_files_pattern($2, user_tmp_t, user_tmp_t)
-	manage_sock_files_pattern($2, user_tmp_t, user_tmp_t)
-	manage_fifo_files_pattern($2, user_tmp_t, user_tmp_t)
+	manage_dirs_pattern($2, user_tmp_type, user_tmp_type)
+	manage_files_pattern($2, user_tmp_type, user_tmp_type)
+	manage_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
+	manage_sock_files_pattern($2, user_tmp_type, user_tmp_type)
+	manage_fifo_files_pattern($2, user_tmp_type, user_tmp_type)
 	relabel_dirs_pattern($2, user_tmp_type, user_tmp_type)
 	relabel_files_pattern($2, user_tmp_type, user_tmp_type)
 	relabel_lnk_files_pattern($2, user_tmp_type, user_tmp_type)
@@ -362,16 +362,22 @@ interface(`userdom_exec_user_tmp_files',`
 #
 interface(`userdom_manage_tmpfs_role',`
 	gen_require(`
+		attribute user_tmpfs_type;
 		type user_tmpfs_t;
 	')
 
-	role $1 types user_tmpfs_t;
+	role $1 types user_tmpfs_type;
 
-	manage_dirs_pattern($2, user_tmpfs_t, user_tmpfs_t)
-	manage_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
-	manage_lnk_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
-	manage_sock_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
-	manage_fifo_files_pattern($2, user_tmpfs_t, user_tmpfs_t)
+	manage_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	manage_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	manage_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	manage_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	manage_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	relabel_dirs_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	relabel_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	relabel_lnk_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	relabel_sock_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
+	relabel_fifo_files_pattern($2, user_tmpfs_type, user_tmpfs_type)
 	fs_tmpfs_filetrans($2, user_tmpfs_t, { dir file lnk_file sock_file fifo_file })
 ')
 
-- 
1.7.1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20100708/f3e23512/attachment.bin