--- nsaserefpolicy/policy/modules/roles/unprivuser.if	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/roles/unprivuser.if	2008-08-14 13:53:54.000000000 -0400
@@ -62,6 +62,26 @@
 	files_home_filetrans($1, user_home_dir_t, dir)
 ')
 
+
+########################################
+## <summary>
+##	Create generic user home directories
+##	with automatic file type transition.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_home_dir_filetrans',`
+	gen_require(`
+		type user_home_dir_t;
+	')
+
+	filetrans_pattern($1, user_home_dir_t, $2, $3)
+')
+
 ########################################
 ## <summary>
 ##	Search generic user home directories.
@@ -77,6 +97,7 @@
 		type user_home_dir_t;
 	')
 
+	files_search_home($1)
 	allow $1 user_home_dir_t:dir search_dir_perms;
 ')
 
@@ -177,11 +198,29 @@
 #
 interface(`unprivuser_manage_home_content_dirs',`
 	gen_require(`
-		type user_home_dir_t, user_home_t;
+		attribute user_home_dir_type, user_home_type;
 	')
 
 	files_search_home($1)
-	manage_dirs_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
+	manage_dirs_pattern($1, { user_home_dir_type user_home_type }, user_home_type)
+')
+
+########################################
+## <summary>
+##	Don't audit list on the user home subdirectory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_dontaudit_list_home_dirs',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:dir list_dir_perms;
 ')
 
 ########################################
@@ -236,11 +275,30 @@
 #
 interface(`unprivuser_mmap_home_content_files',`
 	gen_require(`
-		type user_home_t;
+		attribute user_home_type;
 	')
 
 	files_search_home($1)
-	allow $1 user_home_t:file execute;
+	allow $1 user_home_type:file execute;
+')
+
+########################################
+## <summary>
+##	Read link files in generic user home directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_read_home_content_symlinks',`
+	gen_require(`
+		type user_home_t, user_home_dir_t;
+	')
+
+	files_search_home($1)
+	read_lnk_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
 ')
 
 ########################################
@@ -342,3 +400,515 @@
 	manage_sock_files_pattern($1, { user_home_dir_t user_home_t }, user_home_t)
 ')
 
+########################################
+## <summary>
+##	Do not audit attempts to write user home files.
+## </summary>
+## <desc>
+##	<p>
+##	Do not audit attempts to write user home files.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+template(`unprivuser_dontaudit_write_home_content_files',`
+	gen_require(`
+		type user_home_t;
+	')
+
+	dontaudit $1 user_home_t:file write;
+
+	fs_dontaudit_list_nfs($1)
+	fs_dontaudit_rw_nfs_files($1)
+
+	fs_dontaudit_list_cifs($1)
+	fs_dontaudit_rw_cifs_files($1)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to manage users
+##	temporary directories.
+## </summary>
+## <desc>
+##	<p>
+##	Do not audit attempts to manage users
+##	temporary directories.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+template(`unprivuser_dontaudit_manage_tmp_dirs',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	dontaudit $1 user_tmp_t:dir manage_dir_perms;
+')
+
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary named sockets.
+## </summary>
+## <desc>
+##	<p>
+##	Create, read, write, and delete user
+##	temporary named sockets.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_manage_tmp_sockets',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_search_tmp($1)
+	manage_sock_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Read all unprivileged users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_read_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	read_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Write all unprivileged users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_write_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	write_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Write all unprivileged users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_manage_tmp_files',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_search_tmp($1)
+	manage_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Write all unprivileged users lnk_files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_manage_tmp_symlinks',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_search_tmp($1)
+	manage_lnk_files_pattern($1, user_tmp_t,  user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to relabel unpriv user
+##	home files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_dontaudit_home_content_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	dontaudit $1 user_home_type:file { relabelto relabelfrom };
+')
+
+########################################
+## <summary>
+##	unlink all unprivileged users files in /tmp
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_unlink_tmp_files',`
+	gen_require(`
+		attribute user_tmpfile;
+	')
+
+	files_delete_tmp_dir_entry($1)
+	allow $1 user_tmpfile:file unlink;
+')
+
+########################################
+## <summary>
+##	Connect to unpriviledged users over an unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_stream_connect',`
+	gen_require(`
+		attribute user_tmpfile;
+		attribute userdomain;
+	')
+
+	stream_connect_pattern($1, user_tmpfile, user_tmpfile, userdomain)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary directories.
+## </summary>
+## <desc>
+##	<p>
+##	Create, read, write, and delete user
+##	temporary directories.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_manage_tmp_dirs',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_search_tmp($1)
+	manage_dirs_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Create, read, write, and delete user
+##	temporary named pipes.
+## </summary>
+## <desc>
+##	<p>
+##	Create, read, write, and delete user
+##	temporary named pipes.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_manage_tmp_pipes',`
+	gen_require(`
+		type user_tmp_t;
+	')
+
+	files_search_tmp($1)
+	manage_fifo_files_pattern($1, user_tmp_t, user_tmp_t)
+')
+
+########################################
+## <summary>
+##	Manage user untrusted files.
+## </summary>
+## <desc>
+##      <p>
+##      Create, read, write, and delete untrusted files.
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##      Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_manage_untrusted_content_files',`
+	gen_require(`
+		type user_untrusted_content_t;
+	')
+
+	manage_files_pattern($1, user_untrusted_content_t, user_untrusted_content_t)
+')
+
+########################################
+## <summary>
+##	Manage user untrusted tmp files.
+## </summary>
+## <desc>
+##      <p>
+##      Create, read, write, and delete untrusted tmp files.
+##      </p>
+##      <p>
+##      This is a templated interface, and should only
+##      be called from a per-userdomain template.
+##      </p>
+## </desc>
+## <param name="userdomain_prefix">
+##	<summary>
+##      The prefix of the user domain (e.g., user
+##      is the prefix for user_t).
+##	</summary>
+## </param>
+## <param name="domain">
+##	<summary>
+##      Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_manage_untrusted_content_tmp_files',`
+	gen_require(`
+		type user_untrusted_content_tmp_t;
+	')
+
+	manage_files_pattern($1, user_untrusted_content_tmp_t, user_untrusted_content_tmp_t)
+')
+
+########################################
+## <summary>
+##	RW unpriviledged user SysV sempaphores.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_rw_semaphores',`
+	gen_require(`
+		attribute unpriv_userdomain;
+	')
+
+	allow $1 unpriv_userdomain:sem rw_sem_perms;
+')
+
+########################################
+## <summary>
+##	Read user tmpfs files.
+## </summary>
+## <desc>
+##	<p>
+##	<p>
+##	read user temporary file system files
+##	</p>
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_read_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	fs_search_tmpfs($1)
+	read_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+')
+
+########################################
+## <summary>
+##	Unlink user tmpfs files.
+## </summary>
+## <desc>
+##	<p>
+##	Read/write user tmpfs files.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+template(`unprivuser_delete_tmpfs_files',`
+	gen_require(`
+		type user_tmpfs_t;
+	')
+
+	fs_search_tmpfs($1)
+	allow $1 user_tmpfs_t:dir list_dir_perms;
+	delete_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+	read_lnk_files_pattern($1, user_tmpfs_t, user_tmpfs_t)
+')
+
+########################################
+## <summary>
+##	append all unprivileged users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_append_home_content_files',`
+	gen_require(`
+		attribute user_home_dir_type, user_home_type;
+	')
+
+	files_search_home($1)
+	allow $1 user_home_type:dir list_dir_perms;
+	append_files_pattern($1, { user_home_dir_type user_home_type }, user_home_type)
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_append_nfs_files($1)
+	')
+	tunable_policy(`use_samba_home_dirs',`
+		fs_append_cifs_files($1)
+	')
+')
+
+########################################
+## <summary>
+##	dontaudit append all unprivileged users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_dontaudit_append_home_content_files',`
+	gen_require(`
+		attribute user_home_type;
+	')
+
+	dontaudit $1 user_home_type:file  append_file_perms;
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_dontaudit_append_nfs_files($1)
+	')
+	tunable_policy(`use_samba_home_dirs',`
+		fs_dontaudit_append_cifs_files($1)
+	')
+')
+
+########################################
+## <summary>
+##	dontaudit Read all unprivileged users home directory
+##	files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`unprivuser_dontaudit_read_home_content_files',`
+	gen_require(`
+		attribute user_home_dir_type, user_home_type;
+	')
+
+	files_search_home($1)
+	dontaudit $1 user_home_type:dir list_dir_perms;
+	dontaudit $1 user_home_type:file read_file_perms;
+	dontaudit $1 user_home_type:file read_lnk_file_perms;
+
+	tunable_policy(`use_nfs_home_dirs',`
+		fs_dontaudit_read_nfs_files($1)
+	')
+
+	tunable_policy(`use_samba_home_dirs',`
+		fs_dontaudit_read_cifs_files($1)
+	')
+')
+
--- nsaserefpolicy/policy/modules/roles/unprivuser.te	2008-08-07 11:15:11.000000000 -0400
+++ serefpolicy-3.5.5/policy/modules/roles/unprivuser.te	2008-08-14 13:53:54.000000000 -0400
@@ -13,3 +13,23 @@
 
 userdom_unpriv_user_template(user)
 
+optional_policy(`
+	cron_per_role_template(user, user_t, user_r)
+')
+
+optional_policy(`
+	kerneloops_dontaudit_dbus_chat(user_t)
+')
+
+optional_policy(`
+	postgresql_userdom_template(user, user_t, user_r)
+')
+
+optional_policy(`
+	rpm_dontaudit_dbus_chat(user_t)
+')
+
+optional_policy(`
+	setroubleshoot_dontaudit_stream_connect(user_t)
+')
+
