Security Enhanced Linux Reference Policy

# Layer: apps

## Module: chromium

Tunables Interfaces Templates

### Description:

Chromium browser

### Tunables:

chromium_bind_tcp_unreserved_ports

##### Default value

false

##### Description

Allow chromium to bind to tcp ports

Although not needed for regular browsing, some chrome extensions need to bind to tcp ports and accept connections.

chromium_dri

##### Default value

true

##### Description

Allow chromium to access direct rendering interface

Needed for good performance on complex sites

chromium_exec_heap

##### Default value

false

##### Description

Allow chromium to execute heap

chromium_manage_all_user_content

##### Default value

false

##### Description

Grant the chromium domains manage rights on all user content

chromium_manage_generic_user_content

##### Default value

false

##### Description

Grant the chromium domains manage rights on generic user content

chromium_ptrace

##### Default value

false

##### Description

Allow chromium to ptrace itself

chromium_read_all_user_content

##### Default value

false

##### Description

Grant the chromium domains read access to all user content

chromium_read_generic_user_content

##### Default value

true

##### Description

Grant the chromium domains read access to generic user content

chromium_read_system_info

##### Default value

false

##### Description

Allow chromium to read system information

Although not needed for regular browsing, this will allow chromium to update its own memory consumption based on system state, support additional debugging, detect specific devices, etc.

chromium_rw_usb_dev

##### Default value

false

##### Description

Allow chromium to read/write USB devices

Although not needed for regular browsing, used for debugging over usb or using FIDO U2F tokens.

Return

### Interfaces:

chromium_domtrans( domain )

##### Summary

Execute a domain transition to the chromium domain (chromium_t)

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access

chromium_run( domain , role )

##### Summary

Execute chromium in the chromium domain and allow the specified role to access the chromium domain

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access
role | Role allowed access

chromium_rw_tmp_pipes( domain )

##### Summary

Read-write access to Chromiums' temporary fifo files

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain allowed access

chromium_tmp_filetrans( domain , private_type , class , filename )

##### Summary

Automatically use the specified type for resources created in chromium's temporary locations

##### Parameters

Parameter: | Description:
--- | ---
domain | Domain that creates the resource(s)
private_type | Private file type.
class | Type of the resource created
filename | The name of the resource being created

Return

### Templates:

chromium_role( role_prefix , user_domain , user_exec_domain , role )

##### Summary

Role access for chromium

##### Parameters

Parameter: | Description:
--- | ---
role_prefix | The prefix of the user role (e.g., user is the prefix for user_r).
user_domain | User domain for the role.
user_exec_domain | User exec domain for execute and transition access.
role | Role allowed access

Return