This file is indexed.

/usr/share/selinux/ubuntu/include/apps/mozilla.if is in selinux-policy-ubuntu-dev 0.2.20091117-0ubuntu2.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below.

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
## <summary>Policy for Mozilla and related web browsers</summary>

########################################
## <summary>
##	Role access for mozilla
## </summary>
## <param name="role">
##	<summary>
##	Role allowed access
##	</summary>
## </param>
## <param name="domain">
##	<summary>
##	User domain for the role
##	</summary>
## </param>
#
interface(`mozilla_role',`
	gen_require(`
		type mozilla_t, mozilla_exec_t, mozilla_home_t;
	')

	role $1 types mozilla_t;

	domain_auto_trans($2, mozilla_exec_t, mozilla_t)
	# Unrestricted inheritance from the caller.
	allow $2 mozilla_t:process { noatsecure siginh rlimitinh };
	allow mozilla_t $2:fd use;
	allow mozilla_t $2:process { sigchld signull };
	allow mozilla_t $2:unix_stream_socket connectto;

	# Allow the user domain to signal/ps.
	ps_process_pattern($2, mozilla_t)
	allow $2 mozilla_t:process signal_perms;

	allow $2 mozilla_t:fd use;
	allow $2 mozilla_t:shm { associate getattr };
	allow $2 mozilla_t:shm { unix_read unix_write };
	allow $2 mozilla_t:unix_stream_socket connectto;

	# X access, Home files
	manage_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
	manage_files_pattern($2, mozilla_home_t, mozilla_home_t)
	manage_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
	relabel_dirs_pattern($2, mozilla_home_t, mozilla_home_t)
	relabel_files_pattern($2, mozilla_home_t, mozilla_home_t)
	relabel_lnk_files_pattern($2, mozilla_home_t, mozilla_home_t)
')

########################################
## <summary>
##	Read mozilla home directory content
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`mozilla_read_user_home_files',`
	gen_require(`
		type mozilla_home_t;
	')

	allow $1 mozilla_home_t:dir list_dir_perms;
	allow $1 mozilla_home_t:file read_file_perms;
	userdom_search_user_home_dirs($1)
')

########################################
## <summary>
##	Write mozilla home directory content
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`mozilla_write_user_home_files',`
	gen_require(`
		type mozilla_home_t;
	')

	write_files_pattern($1, mozilla_home_t, mozilla_home_t)
	userdom_search_user_home_dirs($1)
')

########################################
## <summary>
##	Run mozilla in the mozilla domain.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`mozilla_domtrans',`
	gen_require(`
		type mozilla_t, mozilla_exec_t;
	')

	domtrans_pattern($1, mozilla_exec_t, mozilla_t)
')

########################################
## <summary>
##	Send and receive messages from
##	mozilla over dbus.
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`mozilla_dbus_chat',`
	gen_require(`
		type mozilla_t;
		class dbus send_msg;
	')

	allow $1 mozilla_t:dbus send_msg;
	allow mozilla_t $1:dbus send_msg;
')

########################################
## <summary>
##	read/write mozilla per user tcp_socket
## </summary>
## <param name="domain">
##	<summary>
##	Domain allowed access.
##	</summary>
## </param>
#
interface(`mozilla_rw_tcp_sockets',`
	gen_require(`
		type mozilla_t;
	')

	allow $1 mozilla_t:tcp_socket rw_socket_perms;
')