84 lines
2.0 KiB
Plaintext
84 lines
2.0 KiB
Plaintext
|
#
|
||
|
|
# Macros for xauth domains.
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# Author: Russell Coker <russell@coker.com.au>
|
||
|
|
#
|
||
|
|
|
||
|
|
#
|
||
|
|
# xauth_domain(domain_prefix)
|
||
|
|
#
|
||
|
|
# Define a derived domain for the xauth program when executed
|
||
|
|
# by a user domain.
|
||
|
|
#
|
||
|
|
# The type declaration for the executable type for this program is
|
||
|
|
# provided separately in domains/program/xauth.te.
|
||
|
|
#
|
||
|
|
undefine(`xauth_domain')
|
||
|
|
ifdef(`xauth.te', `
|
||
|
|
define(`xauth_domain',`
|
||
|
|
# Derived domain based on the calling user domain and the program.
|
||
|
|
type $1_xauth_t, domain;
|
||
|
|
|
||
|
|
allow $1_xauth_t self:process signal;
|
||
|
|
|
||
|
|
home_domain($1, xauth)
|
||
|
|
file_type_auto_trans($1_xauth_t, $1_home_dir_t, $1_xauth_home_t, file)
|
||
|
|
|
||
|
|
# Transition from the user domain to this domain.
|
||
|
|
domain_auto_trans($1_t, xauth_exec_t, $1_xauth_t)
|
||
|
|
ifdef(`ssh.te', `
|
||
|
|
domain_auto_trans($1_ssh_t, xauth_exec_t, $1_xauth_t)
|
||
|
|
allow $1_xauth_t sshd_t:fifo_file { getattr read };
|
||
|
|
dontaudit $1_xauth_t $1_ssh_t:tcp_socket { read write };
|
||
|
|
allow $1_xauth_t sshd_t:process sigchld;
|
||
|
|
')dnl end if ssh
|
||
|
|
|
||
|
|
# The user role is authorized for this domain.
|
||
|
|
role $1_r types $1_xauth_t;
|
||
|
|
|
||
|
|
# Inherit and use descriptors from gnome-pty-helper.
|
||
|
|
ifdef(`gnome-pty-helper.te', `
|
||
|
|
allow $1_xauth_t $1_gph_t:fd use;
|
||
|
|
')
|
||
|
|
|
||
|
|
allow $1_xauth_t privfd:fd use;
|
||
|
|
allow $1_xauth_t ptmx_t:chr_file { read write };
|
||
|
|
|
||
|
|
# allow ps to show xauth
|
||
|
|
can_ps($1_t, $1_xauth_t)
|
||
|
|
allow $1_t $1_xauth_t:process signal;
|
||
|
|
|
||
|
|
uses_shlib($1_xauth_t)
|
||
|
|
|
||
|
|
# allow DNS lookups...
|
||
|
|
can_resolve($1_xauth_t)
|
||
|
|
can_ypbind($1_xauth_t)
|
||
|
|
ifdef(`named.te', `
|
||
|
|
can_udp_send($1_xauth_t, named_t)
|
||
|
|
can_udp_send(named_t, $1_xauth_t)
|
||
|
|
')dnl end if named.te
|
||
|
|
|
||
|
|
allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
|
||
|
|
allow $1_xauth_t etc_t:file { getattr read };
|
||
|
|
allow $1_xauth_t fs_t:filesystem getattr;
|
||
|
|
|
||
|
|
# Write to the user domain tty.
|
||
|
|
access_terminal($1_xauth_t, $1)
|
||
|
|
|
||
|
|
# Scan /var/run.
|
||
|
|
allow $1_xauth_t var_t:dir search;
|
||
|
|
allow $1_xauth_t var_run_t:dir search;
|
||
|
|
|
||
|
|
tmp_domain($1_xauth)
|
||
|
|
allow $1_xauth_t $1_tmp_t:file { getattr ioctl read };
|
||
|
|
|
||
|
|
')dnl end xauth_domain macro
|
||
|
|
|
||
|
|
', `
|
||
|
|
|
||
|
|
define(`xauth_domain',`')
|
||
|
|
|
||
|
|
')dnl end if xauth.te
|