Merge pull request #834 from dsugar100/main

mozilla adds .mozilla directory to /etc/skel which useradd tries to copy
SELinuxProject · Dec 4, 2024 · facba43 · facba43
2 parents de5329e + 16da307
commit facba43
Show file tree

Hide file tree

Showing 2 changed files with 65 additions and 0 deletions.
diff --git a/policy/modules/admin/usermanage.te b/policy/modules/admin/usermanage.te
@@ -551,10 +551,13 @@ seutil_run_setfiles(useradd_t, useradd_roles)
 
 userdom_use_unpriv_users_fds(useradd_t)
 # Add/remove user home directories
+userdom_create_all_user_home_dirs(useradd_t)
+userdom_create_all_user_home_files(useradd_t)
 userdom_manage_user_home_dirs(useradd_t)
 userdom_home_filetrans_user_home_dir(useradd_t)
 userdom_manage_user_home_content_dirs(useradd_t)
 userdom_manage_user_home_content_files(useradd_t)
+userdom_write_all_user_home_files(useradd_t)
 userdom_user_home_dir_filetrans_user_home_content(useradd_t, notdevfile_class_set)
 
 optional_policy(`

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
@@ -2109,6 +2109,68 @@ interface(`userdom_manage_user_home_content_dirs',`
 	files_search_home($1)
 ')
 
+########################################
+## <summary>
+##	Create all user home content directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_all_user_home_dirs',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	create_dirs_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+	setattr_dirs_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Create all user home content files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_create_all_user_home_files',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	create_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+	setattr_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
+########################################
+## <summary>
+##	Write all user home content files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`userdom_write_all_user_home_files',`
+	gen_require(`
+		attribute user_home_content_type;
+		type user_home_dir_t;
+	')
+
+	userdom_search_user_home_dirs($1)
+	write_files_pattern($1, { user_home_dir_t user_home_content_type }, user_home_content_type)
+')
+
 ########################################
 ## <summary>
 ##	Delete all user home content directories.