/usr/share/selinux/ubuntu/include/apps/mozilla.if is in selinux-policy-ubuntu-dev 0.2.20091117-0ubuntu2.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 | ## <summary>Policy for Mozilla and related web browsers</summary>
########################################
## <summary>
## Role access for mozilla
## </summary>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
## <param name="domain">
## <summary>
## User domain for the role
## </summary>
## </param>
#
interface(`mozilla_role',`
gen_require(`
type mozilla_t, mozilla_exec_t, mozilla_home_t;
')
role $1 types mozilla_t;
domain_auto_trans($2, mozilla_exec_t, mozilla_t)
# Unrestricted inheritance from the caller.
allow $2 mozilla_t:process { noatsecure siginh rlimitinh };
allow mozilla_t $2:fd use;
allow mozilla_t $2:process { sigchld signull };
allow mozilla_t $2:unix_stream_socket connectto;
# Allow the user domain to signal/ps.
ps_process_pattern($2, mozilla_t)
allow $2 mozilla_t:process signal_perms;
allow $2 mozilla_t:fd use;
allow $2 mozilla_t:shm { associate getattr };
allow $2 mozilla_t:shm { unix_read unix_write };
allow $2 mozilla_t:unix_stream_socket connectto;
# X access, Home files
manage_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
manage_files_pattern($2, mozilla_home_t, mozilla_home_t)
manage_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
')
########################################
## <summary>
## Read mozilla home directory content
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`mozilla_read_user_home_files',`
gen_require(`
type mozilla_home_t;
')
allow $1 mozilla_home_t:dir list_dir_perms;
allow $1 mozilla_home_t:file read_file_perms;
userdom_search_user_home_dirs($1)
')
########################################
## <summary>
## Write mozilla home directory content
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`mozilla_write_user_home_files',`
gen_require(`
type mozilla_home_t;
')
write_files_pattern($1, mozilla_home_t, mozilla_home_t)
userdom_search_user_home_dirs($1)
')
########################################
## <summary>
## Run mozilla in the mozilla domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`mozilla_domtrans',`
gen_require(`
type mozilla_t, mozilla_exec_t;
')
domtrans_pattern($1, mozilla_exec_t, mozilla_t)
')
########################################
## <summary>
## Send and receive messages from
## mozilla over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`mozilla_dbus_chat',`
gen_require(`
type mozilla_t;
class dbus send_msg;
')
allow $1 mozilla_t:dbus send_msg;
allow mozilla_t $1:dbus send_msg;
')
########################################
## <summary>
## read/write mozilla per user tcp_socket
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`mozilla_rw_tcp_sockets',`
gen_require(`
type mozilla_t;
')
allow $1 mozilla_t:tcp_socket rw_socket_perms;
')
|