--- nsaserefpolicy/policy/modules/apps/screen.fc 2008-08-07 11:15:03.000000000 -0400 +++ serefpolicy-3.5.5/policy/modules/apps/screen.fc 2008-08-14 13:53:54.000000000 -0400 @@ -1,7 +1,7 @@ # # /home # -HOME_DIR/\.screenrc -- gen_context(system_u:object_r:ROLE_screen_ro_home_t,s0) +HOME_DIR/\.screenrc -- gen_context(system_u:object_r:user_screen_ro_home_t,s0) # # /usr --- nsaserefpolicy/policy/modules/apps/screen.if 2008-08-07 11:15:02.000000000 -0400 +++ serefpolicy-3.5.5/policy/modules/apps/screen.if 2008-08-14 13:53:54.000000000 -0400 @@ -35,6 +35,7 @@ template(`screen_per_role_template',` gen_require(` type screen_dir_t, screen_exec_t; + type user_screen_ro_home_t; ') ######################################## @@ -50,8 +51,9 @@ type $1_screen_tmp_t; files_tmp_file($1_screen_tmp_t) - type $1_screen_ro_home_t; - files_type($1_screen_ro_home_t) + ifelse(`$1',`user',`',` + typealias user_screen_ro_home_t alias $1_screen_ro_home_t; + ') type $1_screen_var_run_t; files_pid_file($1_screen_var_run_t) @@ -81,9 +83,9 @@ filetrans_pattern($1_screen_t, screen_dir_t, $1_screen_var_run_t, fifo_file) files_pid_filetrans($1_screen_t, screen_dir_t, dir) - allow $1_screen_t $1_screen_ro_home_t:dir list_dir_perms; - read_files_pattern($1_screen_t, $1_screen_ro_home_t, $1_screen_ro_home_t) - read_lnk_files_pattern($1_screen_t, $1_screen_ro_home_t, $1_screen_ro_home_t) + allow $1_screen_t user_screen_ro_home_t:dir list_dir_perms; + read_files_pattern($1_screen_t, user_screen_ro_home_t, user_screen_ro_home_t) + read_lnk_files_pattern($1_screen_t, user_screen_ro_home_t, user_screen_ro_home_t) allow $1_screen_t $2:process signal; @@ -91,12 +93,12 @@ allow $2 $1_screen_t:process signal; allow $1_screen_t $2:process signal; - manage_dirs_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) - manage_files_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) - manage_lnk_files_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) - relabel_dirs_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) - relabel_files_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) - relabel_lnk_files_pattern($2, $1_screen_ro_home_t, $1_screen_ro_home_t) + manage_dirs_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) + manage_files_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) + manage_lnk_files_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) + relabel_dirs_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) + relabel_files_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) + relabel_lnk_files_pattern($2, user_screen_ro_home_t, user_screen_ro_home_t) kernel_read_system_state($1_screen_t) kernel_read_kernel_sysctls($1_screen_t) --- nsaserefpolicy/policy/modules/apps/screen.te 2008-08-07 11:15:02.000000000 -0400 +++ serefpolicy-3.5.5/policy/modules/apps/screen.te 2008-08-14 13:53:54.000000000 -0400 @@ -11,3 +11,7 @@ type screen_exec_t; application_executable_file(screen_exec_t) + +type user_screen_ro_home_t; +userdom_user_home_content(user, user_screen_ro_home_t) +