Security Enhanced Linux Reference Policy

# Layer: apps

## Module: pipewire

Interfaces Templates

### Description:

PipeWire multimedia daemon.

### Interfaces:

pipewire_create_user_dirs( domain )

##### Summary

Create pipewire user socket /run/user/$UID/pipewire-0

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_domtrans( domain )

##### Summary

Execute a domain transition to run the PipeWire daemon.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

pipewire_domtrans_client( domain )

##### Summary

Execute a domain transition to run a PipeWire client utility (e.g. pw-cat).

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed to transition.

pipewire_mmap_rw_tmpfs_files( domain )

##### Summary

Allow a domain to read, write, and map PipeWire shared memory (tmpfs) files. These are memfd files passed between the daemon and its clients for zero-copy audio buffer sharing.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_read_home_files( domain )

##### Summary

Allow a domain to read PipeWire home directory content.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_rw_stream_sockets( domain )

##### Summary

Read and write connected PipeWire daemon stream sockets.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_socket_user_unlink( domain )

##### Summary

unlink pipewire user socket /run/user/$UID/pipewire-0

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_stream_connect( domain )

##### Summary

Connect to the PipeWire daemon over a Unix stream socket.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_use_client_fds( domain )

##### Summary

Use file descriptors inherited from PipeWire clients.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

pipewire_use_fds( domain )

##### Summary

Allow a domain to use file descriptors passed from PipeWire.

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access.

Return

### Templates:

pipewire_role( role_prefix , user_domain , user_exec_domain , role )

##### Summary

Role access for PipeWire (user-service mode). Call this from unprivuser.te / staff.te in the same way pulseaudio_role is called.

##### Parameters

Parameter: | Description:
--- | ---
role_prefix | The prefix of the user role (e.g., "user" for user_r).
user_domain | User domain for the role (e.g., user_t).
user_exec_domain | User exec domain for execute and transition access (e.g., user_application_exec_domain).
role | Role allowed access (e.g., user_r).

Return