diff options
author | John Turner <jturner.usa@gmail.com> | 2025-08-20 18:15:24 -0400 |
---|---|---|
committer | John Turner <jturner.usa@gmail.com> | 2025-08-21 17:47:14 -0400 |
commit | ebf8a5222434ed15b16b3fb8015ebedac795bb65 (patch) | |
tree | eb7bfabb72adce39bcc558857211acccdbb3cf3f /src/file/homefile/userhomefile.cil | |
parent | d423f2bca3f9161c3c9abd58898e8cc3744a0832 (diff) | |
download | selinux-policy-ebf8a5222434ed15b16b3fb8015ebedac795bb65.tar.gz |
rework how user files work
Instead of assuming all user files exist under $HOME, we create a
.file.user module and typeattribute. This allows user files to exist
in places outside of $HOME. Also we changed filecon so that $HOME
itself is user.home.file rather than home.file.
Diffstat (limited to 'src/file/homefile/userhomefile.cil')
-rw-r--r-- | src/file/homefile/userhomefile.cil | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/src/file/homefile/userhomefile.cil b/src/file/homefile/userhomefile.cil new file mode 100644 index 0000000..838c845 --- /dev/null +++ b/src/file/homefile/userhomefile.cil @@ -0,0 +1,34 @@ +(in file.unconfined + (call .user.home.home_file_type_transition_file (typeattr dir "*"))) + +(in file.home + (block user + (macro type ((type ARG1)) + (typeattributeset typeattr ARG1)) + + (typeattribute typeattr) + + (call .file.home.type (typeattr)) + (call .file.user.type (typeattr)) + (call .xattr.associate_fs (typeattr)) + + (block base_template + (blockabstract base_template) + (blockinherit .file.user.base_template) + (call .file.home.user.type (file))) + + (block template + (blockabstract template) + (blockinherit .file.home.user.base_template) + (blockinherit .file.macro_template_dirs) + (blockinherit .file.macro_template_files) + (blockinherit .file.macro_template_lnk_files)))) + +(in user + (block home + (macro home_file_type_transition_file ((type ARG1) (class ARG2) (name ARG3)) + (call .home.file_type_transition (ARG1 file ARG2 ARG3))) + + (blockinherit file.home.user.template) + (filecon "HOME_DIR" dir file_context) + (filecon "HOME_DIR/.*" any file_context))) |