160 lines
3.7 KiB
Plaintext
160 lines
3.7 KiB
Plaintext
|
#
|
||
|
|
# Macros for mplayer
|
||
|
|
#
|
||
|
|
# Author: Ivan Gyurdiev <ivg2@cornell.edu>
|
||
|
|
#
|
||
|
|
# mplayer_domains(user) declares domains for mplayer, gmplayer,
|
||
|
|
# and mencoder
|
||
|
|
|
||
|
|
#####################################################
|
||
|
|
# mplayer_common(role_prefix, mplayer_domain) #
|
||
|
|
#####################################################
|
||
|
|
|
||
|
|
define(`mplayer_common',`
|
||
|
|
|
||
|
|
# Read global config
|
||
|
|
r_dir_file($1_$2_t, mplayer_etc_t)
|
||
|
|
|
||
|
|
# Allow the user domain to signal/ps.
|
||
|
|
can_ps($1_t, $1_$2_t)
|
||
|
|
allow $1_t $1_$2_t:process signal_perms;
|
||
|
|
|
||
|
|
# Read data in /usr/share (fonts, icons..)
|
||
|
|
r_dir_file($1_$2_t, usr_t)
|
||
|
|
|
||
|
|
# Read /proc files and directories
|
||
|
|
# Necessary for /proc/meminfo, /proc/cpuinfo, etc..
|
||
|
|
allow $1_$2_t proc_t:dir search;
|
||
|
|
allow $1_$2_t proc_t:file { getattr read };
|
||
|
|
|
||
|
|
# Sysctl on kernel version
|
||
|
|
read_sysctl($1_$2_t)
|
||
|
|
|
||
|
|
# Allow ps, shared libs, locale, terminal access
|
||
|
|
can_ps($1_t, $1_$2_t)
|
||
|
|
uses_shlib($1_$2_t)
|
||
|
|
read_locale($1_$2_t)
|
||
|
|
access_terminal($1_$2_t, $1)
|
||
|
|
|
||
|
|
# Required for win32 binary loader
|
||
|
|
allow $1_$2_t zero_device_t:chr_file { read write execute };
|
||
|
|
if (allow_execmem) {
|
||
|
|
allow $1_$2_t self:process execmem;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (allow_execmod) {
|
||
|
|
allow $1_$2_t zero_device_t:chr_file execmod;
|
||
|
|
}
|
||
|
|
allow $1_$2_t texrel_shlib_t:file execmod;
|
||
|
|
|
||
|
|
# Access to DVD/CD/V4L
|
||
|
|
allow $1_$2_t device_t:dir r_dir_perms;
|
||
|
|
allow $1_$2_t device_t:lnk_file { getattr read };
|
||
|
|
allow $1_$2_t removable_device_t:blk_file { getattr read };
|
||
|
|
allow $1_$2_t v4l_device_t:chr_file { getattr read };
|
||
|
|
|
||
|
|
# Legacy domain issues
|
||
|
|
if (allow_mplayer_execstack) {
|
||
|
|
legacy_domain($1_$2)
|
||
|
|
allow $1_$2_t lib_t:file execute;
|
||
|
|
allow $1_$2_t locale_t:file execute;
|
||
|
|
allow $1_$2_t sound_device_t:chr_file execute;
|
||
|
|
}
|
||
|
|
')
|
||
|
|
|
||
|
|
###################################
|
||
|
|
# mplayer_domain(role_prefix) #
|
||
|
|
###################################
|
||
|
|
|
||
|
|
define(`mplayer_domain',`
|
||
|
|
|
||
|
|
type $1_mplayer_t, domain, nscd_client_domain;
|
||
|
|
|
||
|
|
# Type transition
|
||
|
|
domain_auto_trans($1_t, mplayer_exec_t, $1_mplayer_t)
|
||
|
|
role $1_r types $1_mplayer_t;
|
||
|
|
|
||
|
|
# Home access, X access
|
||
|
|
home_domain($1, mplayer)
|
||
|
|
x_client_domain($1_mplayer, $1)
|
||
|
|
|
||
|
|
# Mplayer common stuff
|
||
|
|
mplayer_common($1, mplayer)
|
||
|
|
|
||
|
|
# Fork
|
||
|
|
allow $1_mplayer_t self:process { fork signal_perms getsched };
|
||
|
|
allow $1_mplayer_t self:fifo_file rw_file_perms;
|
||
|
|
|
||
|
|
# Audio, alsa.conf
|
||
|
|
allow $1_mplayer_t sound_device_t:chr_file rw_file_perms;
|
||
|
|
allow $1_mplayer_t etc_t:file { getattr read };
|
||
|
|
r_dir_file($1_mplayer_t, alsa_etc_rw_t);
|
||
|
|
|
||
|
|
# RTC clock
|
||
|
|
allow $1_mplayer_t clock_device_t:chr_file { ioctl read };
|
||
|
|
|
||
|
|
# Legacy domain issues
|
||
|
|
if (allow_mplayer_execstack) {
|
||
|
|
allow $1_mplayer_t $1_mplayer_tmpfs_t:file execute;
|
||
|
|
}
|
||
|
|
|
||
|
|
#======gmplayer gui==========#
|
||
|
|
# File dialogs
|
||
|
|
dontaudit_getattr($1_mplayer_t)
|
||
|
|
dontaudit_read_dir($1_mplayer_t)
|
||
|
|
dontaudit_search_dir($1_mplayer_t)
|
||
|
|
|
||
|
|
# Unfortunately the ancient file dialog starts in /
|
||
|
|
allow $1_mplayer_t home_root_t:dir read;
|
||
|
|
|
||
|
|
# Read /etc/mtab
|
||
|
|
allow $1_mplayer_t etc_runtime_t:file { read getattr };
|
||
|
|
|
||
|
|
# Run bash/sed (??)
|
||
|
|
allow $1_mplayer_t bin_t:dir search;
|
||
|
|
allow $1_mplayer_t bin_t:lnk_file read;
|
||
|
|
can_exec($1_mplayer_t, bin_t)
|
||
|
|
can_exec($1_mplayer_t, shell_exec_t)
|
||
|
|
#============================#
|
||
|
|
|
||
|
|
# Read songs
|
||
|
|
read_content($1_mplayer_t, $1)
|
||
|
|
|
||
|
|
') dnl end mplayer_domain
|
||
|
|
|
||
|
|
###################################
|
||
|
|
# mencoder_domain(role_prefix) #
|
||
|
|
###################################
|
||
|
|
|
||
|
|
define(`mencoder_domain',`
|
||
|
|
|
||
|
|
type $1_mencoder_t, domain;
|
||
|
|
|
||
|
|
# Type transition
|
||
|
|
domain_auto_trans($1_t, mencoder_exec_t, $1_mencoder_t)
|
||
|
|
role $1_r types $1_mencoder_t;
|
||
|
|
|
||
|
|
# Access mplayer home domain
|
||
|
|
home_domain_access($1_mencoder_t, $1, mplayer)
|
||
|
|
|
||
|
|
# Mplayer common stuff
|
||
|
|
mplayer_common($1, mencoder)
|
||
|
|
|
||
|
|
# Read content to encode
|
||
|
|
read_content($1_mencoder_t, $1)
|
||
|
|
|
||
|
|
# Save encoded files
|
||
|
|
write_trusted($1_mencoder_t, $1)
|
||
|
|
|
||
|
|
') dnl end mencoder_domain
|
||
|
|
|
||
|
|
#############################
|
||
|
|
# mplayer_domains(role) #
|
||
|
|
#############################
|
||
|
|
|
||
|
|
define(`mplayer_domains', `
|
||
|
|
mplayer_domain($1)
|
||
|
|
mencoder_domain($1)
|
||
|
|
') dnl end mplayer_domains
|
||
|
|
|