metalefty/xrdp-next
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Some SELinux policy additions/improvements.

Browse Source
This commit is contained in:
Bojan Smojver 2018-04-22 16:37:17 +10:00
parent 50a24a40bf
commit 18ba1a2928
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
xrdp.spec
View File

@ -7,7 +7,7 @@ Summary: Open source remote desktop protocol (RDP) server
Name: xrdp Name: xrdp
Epoch: 1 Epoch: 1
Version: 0.9.6 Version: 0.9.6
Release: 1%{?dist} Release: 2%{?dist}
License: ASL 2.0 License: ASL 2.0
Group: Applications/Internet Group: Applications/Internet
URL: http://www.xrdp.org/ URL: http://www.xrdp.org/
@ -259,6 +259,10 @@ fi
%{_datadir}/selinux/*/%{name}.pp %{_datadir}/selinux/*/%{name}.pp
%changelog %changelog
* Sun Apr 22 2018 Bojan Smojver <bojan@rexurive.com> - 1:0.9.6-2
- Allow oddjob-mkhomedir in SELinux policy (stolen from grishin-a)
- Allow no new privileges transition in SELinux policy
* Tue Mar 27 2018 Bojan Smojver <bojan@rexurive.com> - 1:0.9.6-1 * Tue Mar 27 2018 Bojan Smojver <bojan@rexurive.com> - 1:0.9.6-1
- Bump up to 0.9.6 - Bump up to 0.9.6

13
xrdp.te
View File

@ -1,17 +1,24 @@
module xrdp 1.0.0; module xrdp 1.0.1;
require { require {
type unconfined_service_t; type unconfined_service_t;
type unconfined_t; type unconfined_t;
type xserver_exec_t; type xserver_exec_t;
type xserver_t;
type oddjob_t;
type oddjob_mkhomedir_exec_t;
class process transition; class process transition;
class file entrypoint; class file entrypoint;
class process2 nnp_transition;
} }
#============= unconfined_service_t ============== #============= unconfined_service_t ==============
allow unconfined_service_t unconfined_t:process transition; allow unconfined_service_t unconfined_t:process transition;
allow unconfined_service_t oddjob_mkhomedir_exec_t:file entrypoint;
#============= unconfined_t ============== #============= unconfined_t ==============
allow unconfined_t xserver_exec_t:file entrypoint; allow unconfined_t xserver_exec_t:file entrypoint;
allow unconfined_t xserver_t:process2 nnp_transition;
#============= oddjob_t ==============
allow oddjob_t unconfined_service_t:process transition;