policy_module(telepathy, 1.0.0) ######################################## # # Telepathy global personal declarations. # attribute tp_domains; ######################################## # # Telepathy Butterfly personal declarations. # type tp_butterfly_t, tp_domains; type tp_butterfly_exec_t; application_domain(tp_butterfly_t, tp_butterfly_exec_t) ubac_constrained(tp_butterfly_t) type tp_butterfly_tmp_t; files_tmp_file(tp_butterfly_tmp_t) ubac_constrained(tp_butterfly_tmp_t) ######################################## # # Telepathy Gabble personal declarations. # type tp_gabble_t, tp_domains; type tp_gabble_exec_t; application_domain(tp_gabble_t, tp_gabble_exec_t) ubac_constrained(tp_gabble_t) ######################################## # # Telepathy Haze personal declarations. # type tp_haze_t, tp_domains; type tp_haze_exec_t; application_domain(tp_haze_t, tp_haze_exec_t) ubac_constrained(tp_haze_t) type tp_haze_tmp_t; files_tmp_file(tp_haze_tmp_t) ubac_constrained(tp_haze_tmp_t) ######################################## # # Telepathy Idle personal declarations. # type tp_idle_t, tp_domains; type tp_idle_exec_t; application_domain(tp_idle_t, tp_idle_exec_t) ubac_constrained(tp_idle_t) ######################################## # # Telepathy Mission-Control personal declarations. # type tp_mission_control_t, tp_domains; type tp_mission_control_exec_t; application_domain(tp_mission_control_t, tp_mission_control_exec_t) ubac_constrained(tp_mission_control_t) type tp_mission_control_home_t; userdom_user_home_content(tp_mission_control_home_t) ######################################## # # Telepathy Salut personal declarations. # type tp_salut_t, tp_domains; type tp_salut_exec_t; application_domain(tp_salut_t, tp_salut_exec_t) ubac_constrained(tp_salut_t) type tp_salut_tmp_t; files_tmp_file(tp_salut_tmp_t) ubac_constrained(tp_salut_tmp_t) ######################################## # # Telepathy Sofiasip personal declarations. # type tp_sofiasip_t, tp_domains; type tp_sofiasip_exec_t; application_domain(tp_sofiasip_t, tp_sofiasip_exec_t) ubac_constrained(tp_sofiasip_t) ######################################## # # Telepathy Stream-Engine personal declarations. # type tp_stream_engine_t, tp_domains; type tp_stream_engine_exec_t; application_domain(tp_stream_engine_t, tp_stream_engine_exec_t) ubac_constrained(tp_stream_engine_t) ######################################## # # Telepathy global personal policy. # allow tp_domains self:process { getsched signal }; allow tp_domains self:fifo_file rw_fifo_file_perms; corenet_all_recvfrom_netlabel(tp_domains) corenet_all_recvfrom_unlabeled(tp_domains) corenet_tcp_bind_generic_node(tp_domains) corenet_tcp_sendrecv_generic_if(tp_domains) corenet_tcp_sendrecv_generic_node(tp_domains) fs_search_auto_mountpoints(tp_domains) miscfiles_read_localization(tp_domains) # This interface seems too coarse. We do not want to search user_tmp_t dirs # or write sock_files user_tmp_t. We just want :unix_stream_socket connectto; # Besides even if we wanted to, we could not, because this interface does not # facilitate files_search_tmp which appears to be a bug. userdom_stream_connect(tp_domains) userdom_use_user_terminals(tp_domains) optional_policy(` nis_use_ypbind(tp_domains) ') optional_policy(` nscd_read_pid(tp_domains) ') optional_policy(` telepathy_dbus_chat(tp_domains) ') optional_policy(` # These are dontaudited. xserver_rw_xdm_pipes(tp_domains) ') ######################################## # # Telepathy Butterfly personal policy. # allow tp_butterfly_t self:netlink_route_socket create_netlink_socket_perms; allow tp_butterfly_t self:tcp_socket create_socket_perms; allow tp_butterfly_t self:udp_socket create_socket_perms; allow tp_butterfly_t self:unix_dgram_socket { write create connect }; manage_files_pattern(tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) exec_files_pattern(tp_butterfly_t, tp_butterfly_tmp_t, tp_butterfly_tmp_t) files_tmp_filetrans(tp_butterfly_t, tp_butterfly_tmp_t, file) corenet_sendrecv_http_client_packets(tp_butterfly_t) corenet_sendrecv_msnp_client_packets(tp_butterfly_t) corenet_tcp_connect_http_port(tp_butterfly_t) corenet_tcp_connect_msnp_port(tp_butterfly_t) # uname. corecmd_exec_bin(tp_butterfly_t) corecmd_exec_shell(tp_butterfly_t) corecmd_read_bin_symlinks(tp_butterfly_t) dev_read_urand(tp_butterfly_t) files_read_etc_files(tp_butterfly_t) kernel_read_system_state(tp_butterfly_t) logging_send_syslog_msg(tp_butterfly_t) sysnet_read_config(tp_butterfly_t) optional_policy(` abrt_read_config(tp_butterfly_t) ') optional_policy(` automount_dontaudit_getattr_tmp_dirs(tp_butterfly_t) ') optional_policy(` gnome_read_gconf_home_files(tp_butterfly_t) ') ######################################## # # Telepathy Gabble personal policy. # allow tp_gabble_t self:netlink_route_socket create_netlink_socket_perms; allow tp_gabble_t self:tcp_socket create_socket_perms; allow tp_gabble_t self:udp_socket create_socket_perms; allow tp_gabble_t self:unix_dgram_socket { write read create getattr sendto }; corenet_sendrecv_jabber_client_client_packets(tp_gabble_t) corenet_tcp_connect_jabber_client_port(tp_gabble_t) corenet_sendrecv_http_client_packets(tp_gabble_t) corenet_tcp_connect_http_port(tp_gabble_t) corenet_sendrecv_vnc_client_packets(tp_gabble_t) corenet_tcp_connect_vnc_port(tp_gabble_t) dev_read_rand(tp_gabble_t) dev_read_urand(tp_gabble_t) files_read_etc_files(tp_gabble_t) miscfiles_read_certs(tp_gabble_t) sysnet_read_config(tp_gabble_t) optional_policy(` dbus_system_bus_client(tp_gabble_t) ') ######################################## # # Telepathy Haze personal policy. # # There are two Telepathy connection managers that support MSN: # Butterfly, which is an MSN-specific CM built on pymsn, and Haze, # which uses libpurple. # Prior to libpurple 2.5.0, Haze's MSN support was rudimentary, but # libpurple 2.5.0 and newer reduce the gap between Haze and Butterfly considerably. # Still, you will probably have a better experience if you use Butterfly. # semanage fcontext -a -t tp_butterfly_exec_t /usr/libexec/telepathy-haze. ######################################## # # Telepathy Idle personal policy. # allow tp_idle_t self:netlink_route_socket create_netlink_socket_perms; allow tp_idle_t self:tcp_socket create_socket_perms; allow tp_idle_t self:udp_socket create_socket_perms; corenet_sendrecv_ircd_client_packets(tp_idle_t) corenet_tcp_connect_ircd_port(tp_idle_t) files_read_etc_files(tp_idle_t) sysnet_read_config(tp_idle_t) ######################################## # # Telepathy Mission-Control personal policy. # manage_dirs_pattern(tp_mission_control_t, tp_mission_control_home_t, tp_mission_control_home_t) manage_files_pattern(tp_mission_control_t, tp_mission_control_home_t, tp_mission_control_home_t) userdom_user_home_dir_filetrans(tp_mission_control_t, tp_mission_control_home_t, { dir file }) userdom_search_user_home_dirs(tp_mission_control_t) # ~/.cache/.mc_connections. optional_policy(` manage_files_pattern(tp_mission_control_t, tp_mission_control_home_t, tp_mission_control_home_t) gnome_config_filetrans(tp_mission_control_t, tp_mission_control_home_t, file) ') files_read_etc_files(tp_mission_control_t) files_read_usr_files(tp_mission_control_t) # It tries to setattr to ~/.cache (700), which is none of its business. # For now audit attempts because it may need similar permission for legit purposes. # userdom_dontaudit_setattr_user_home_content_dirs(tp_mission_control_t) tunable_policy(`use_nfs_home_dirs', ` fs_manage_nfs_dirs(tp_mission_control_t) fs_manage_nfs_files(tp_mission_control_t) ') tunable_policy(`use_samba_home_dirs', ` fs_manage_cifs_dirs(tp_mission_control_t) fs_manage_cifs_files(tp_mission_control_t) ') optional_policy(` gnome_read_gconf_home_files(tp_mission_control_t) ') ######################################## # # Telepathy Salut personal policy. # allow tp_salut_t self:netlink_route_socket create_netlink_socket_perms; allow tp_salut_t self:tcp_socket { create_socket_perms accept listen }; allow tp_salut_t self:udp_socket create_socket_perms; manage_sock_files_pattern(tp_salut_t, tp_salut_tmp_t, tp_salut_tmp_t) files_tmp_filetrans(tp_salut_t, tp_salut_tmp_t, sock_file) corenet_sendrecv_presence_server_packets(tp_salut_t) corenet_tcp_bind_presence_port(tp_salut_t) corenet_tcp_connect_presence_port(tp_salut_t) # Needs to connect to (port_t) 50176:tcp (does not seem to be a random port) for file transfers. dev_read_urand(tp_salut_t) files_read_etc_files(tp_salut_t) sysnet_read_config(tp_salut_t) optional_policy(` avahi_dbus_chat(tp_salut_t) ') optional_policy(` dbus_system_bus_client(tp_salut_t) ') ######################################## # # Telepathy Sofiasip personal policy. # allow tp_sofiasip_t self:netlink_route_socket create_netlink_socket_perms; allow tp_sofiasip_t self:rawip_socket { create_socket_perms listen }; allow tp_sofiasip_t self:tcp_socket { create_socket_perms listen }; allow tp_sofiasip_t self:udp_socket create_socket_perms; corenet_sendrecv_sip_client_packets(tp_sofiasip_t) corenet_tcp_connect_sip_port(tp_sofiasip_t) corenet_raw_bind_generic_node(tp_sofiasip_t) corenet_udp_bind_generic_node(tp_sofiasip_t) dev_read_urand(tp_sofiasip_t) kernel_request_load_module(tp_sofiasip_t) sysnet_read_config(tp_sofiasip_t) ######################################## # # Telepathy Stream-Engine personal policy. #