rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity
fb52482a1f
selinux-policy/policy/modules/apps/gnome.if

603 lines
12 KiB
Plaintext
Raw Normal View History

This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## <summary>GNU network object model environment (GNOME)</summary>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
############################################################
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## <summary>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
## Role access for gnome
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## </summary>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
## <param name="role">
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## <summary>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
## Role allowed access
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## </summary>
## </param>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
## <param name="domain">
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## <summary>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
## User domain for the role
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## </summary>
## </param>
#
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
interface(`gnome_role',`
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
gen_require(`
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
type gconfd_t, gconfd_exec_t;
type gconf_tmp_t;
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
')
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
role $1 types gconfd_t;
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
domain_auto_trans($2, gconfd_exec_t, gconfd_t)
allow gconfd_t $2:fd use;
allow gconfd_t $2:fifo_file write;
allow gconfd_t $2:unix_stream_socket connectto;
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
ps_process_pattern($2, gconfd_t)
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
#gnome_stream_connect_gconf_template($1, $2)
read_files_pattern($2, gconf_tmp_t, gconf_tmp_t)
allow $2 gconfd_t:unix_stream_socket connectto;
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
')
trunk: additional whitespace fixes.
2008-10-17 15:52:39 +00:00
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
########################################
## <summary>
Update f14
2010-08-26 14:27:35 +00:00
## gconf connection template.
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## </summary>
## </param>
#
Update f14
2010-08-26 14:27:35 +00:00
interface(`gnome_stream_connect_gconf',`
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
gen_require(`
Update f14
2010-08-26 14:27:35 +00:00
type gconfd_t, gconf_tmp_t;
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
Update f14
2010-08-26 14:27:35 +00:00
read_files_pattern($1, gconf_tmp_t, gconf_tmp_t)
allow $1 gconfd_t:unix_stream_socket connectto;
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
Update f14
2010-08-26 14:27:35 +00:00
########################################
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## <summary>
Update f14
2010-08-26 14:27:35 +00:00
## Run gconfd in gconfd domain.
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
Update f14
2010-08-26 14:27:35 +00:00
interface(`gnome_domtrans_gconfd',`
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
gen_require(`
Update f14
2010-08-26 14:27:35 +00:00
type gconfd_t, gconfd_exec_t;
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
Update f14
2010-08-26 14:27:35 +00:00
domtrans_pattern($1, gconfd_exec_t, gconfd_t)
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
########################################
## <summary>
Update f14
2010-08-26 14:27:35 +00:00
## Dontaudit search gnome homedir content (.config)
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
This patch adds a GConf policy to refpolicy. This policy is much tighter than the GConf policy from the old example policy. It only allows gconfd to access configuration data stored by GConf. Users can modify configuration data using gconftool-2 or gconf-editor, both of which use gconfd. GConf manages multiple configuration sources, so gconfd should be used to make any changes anyway. Normal users who aren't trying to directly edit the configuration data of GConf won't notice anything different. There is also a difference between this policy and the old example policy in handling directories in /tmp. The old example policy labeled /tmp/gconfd-USER with ROLE_gconfd_tmp_t, but, since there was no use of the file_type_auto_trans macro, if that directory was deleted gconfd would create one labeled as tmp_t. This policy uses the files_tmp-filetrans macro to cause a directory in /tmp created by gconfd to be labeled as $1_tmp_t. It is not labeled with $1_gconf_tmp_t, because if /tmp/orbit-USER is deleted, gconfd will create it (through use of ORBit) and it would get the $1_gconf_tmp_t label. By having gconfd create $1_tmp_t directories in /tmp and $1_gconf_tmp_t files and directories in directories labeled with $1_tmp_t, it can control its data without requiring any future bonobo or Gnome policies to have access to $1_gconf_tmp_t. This patch is related to work that I am doing in making gconfd an userspace object manager. If any user program can modify the configuration data that GConf stores, than making gconfd an userspace object manager would be useless. Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>
2006-10-02 15:22:48 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
## </summary>
## </param>
#
Update f14
2010-08-26 14:27:35 +00:00
interface(`gnome_dontaudit_search_config',`
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
gen_require(`
Update f14
2010-08-26 14:27:35 +00:00
attribute gnome_home_type;
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
')
Update f14
2010-08-26 14:27:35 +00:00
dontaudit $1 gnome_home_type:dir search_dir_perms;
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
')
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
########################################
## <summary>
Update f14
2010-08-26 14:27:35 +00:00
## manage gnome homedir content (.config)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
## </param>
#
Update f14
2010-08-26 14:27:35 +00:00
interface(`gnome_manage_config',`
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
gen_require(`
attribute gnome_home_type;
')
Update f14
2010-08-26 14:27:35 +00:00
allow $1 gnome_home_type:dir manage_dir_perms;
allow $1 gnome_home_type:file manage_file_perms;
allow $1 gnome_home_type:lnk_file manage_lnk_file_perms;
userdom_search_user_home_dirs($1)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
')
########################################
## <summary>
## Send general signals to all gconf domains.
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
interface(`gnome_signal_all',`
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
gen_require(`
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
attribute gnomedomain;
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
allow $1 gnomedomain:process signal;
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
')
########################################
## <summary>
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## Create objects in a Gnome cache home directory
## with an automatic type transition to
## a specified private type.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="private_type">
## <summary>
## The type of the object to create.
## </summary>
## </param>
## <param name="object_class">
## <summary>
## The class of the object to be created.
## </summary>
## </param>
#
interface(`gnome_cache_filetrans',`
gen_require(`
type cache_home_t;
')
filetrans_pattern($1, cache_home_t, $2, $3)
userdom_search_user_home_dirs($1)
')
########################################
## <summary>
## Read generic cache home files (.cache)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_read_generic_cache_files',`
gen_require(`
type cache_home_t;
')
read_files_pattern($1, cache_home_t, cache_home_t)
userdom_search_user_home_dirs($1)
')
########################################
## <summary>
## Set attributes of cache home dir (.cache)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_setattr_cache_home_dir',`
gen_require(`
type cache_home_t;
')
setattr_dirs_pattern($1, cache_home_t, cache_home_t)
userdom_search_user_home_dirs($1)
')
More fixes
2010-08-30 15:15:53 +00:00
########################################
## <summary>
## append to generic cache home files (.cache)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_append_generic_cache_files',`
gen_require(`
type cache_home_t;
')
append_files_pattern($1, cache_home_t, cache_home_t)
userdom_search_user_home_dirs($1)
')
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
########################################
## <summary>
## write to generic cache home files (.cache)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_write_generic_cache_files',`
gen_require(`
type cache_home_t;
')
write_files_pattern($1, cache_home_t, cache_home_t)
userdom_search_user_home_dirs($1)
')
Update f14
2010-08-26 14:27:35 +00:00
########################################
## <summary>
## read gnome homedir content (.config)
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
Update f14
2010-08-26 14:27:35 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
Update f14
2010-08-26 14:27:35 +00:00
## </summary>
## </param>
#
template(`gnome_read_config',`
gen_require(`
attribute gnome_home_type;
')
list_dirs_pattern($1, gnome_home_type, gnome_home_type)
read_files_pattern($1, gnome_home_type, gnome_home_type)
read_lnk_files_pattern($1, gnome_home_type, gnome_home_type)
')
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
########################################
## <summary>
## Create objects in a Gnome gconf home directory
## with an automatic type transition to
## a specified private type.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="private_type">
## <summary>
## The type of the object to create.
## </summary>
## </param>
## <param name="object_class">
## <summary>
## The class of the object to be created.
## </summary>
## </param>
#
interface(`gnome_data_filetrans',`
gen_require(`
type data_home_t;
')
filetrans_pattern($1, data_home_t, $2, $3)
gnome_search_gconf($1)
')
########################################
## <summary>
## Create gconf_home_t objects in the /root directory
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="object_class">
## <summary>
## The class of the object to be created.
## </summary>
## </param>
#
interface(`gnome_admin_home_gconf_filetrans',`
gen_require(`
type gconf_home_t;
')
userdom_admin_home_dir_filetrans($1, gconf_home_t, $2)
')
########################################
## <summary>
## read gconf config files
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
## </param>
#
Fixed badly chosen type of interface for some interfaces
2010-09-21 07:09:43 +00:00
interface(`gnome_read_gconf_config',`
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
gen_require(`
type gconf_etc_t;
')
allow $1 gconf_etc_t:dir list_dir_perms;
read_files_pattern($1, gconf_etc_t, gconf_etc_t)
')
#######################################
## <summary>
## Manage gconf config files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_manage_gconf_config',`
gen_require(`
type gconf_etc_t;
')
allow $1 gconf_etc_t:dir list_dir_perms;
manage_files_pattern($1, gconf_etc_t, gconf_etc_t)
')
########################################
## <summary>
## Execute gconf programs in
## in the caller domain.
## </summary>
## <param name="domain">
## <summary>
Part of gnome patch from Dan Walsh.
2010-08-12 13:21:36 +00:00
## Domain allowed access.
## </summary>
## </param>
#
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
interface(`gnome_exec_gconf',`
gen_require(`
type gconfd_exec_t;
')
can_exec($1, gconfd_exec_t)
')
########################################
## <summary>
## Read gconf home files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_read_gconf_home_files',`
gen_require(`
type gconf_home_t;
type data_home_t;
')
Search parent directory to be able to interact with targets content.
2010-09-23 14:22:26 +00:00
userdom_search_user_home_dirs($1)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
allow $1 gconf_home_t:dir list_dir_perms;
allow $1 data_home_t:dir list_dir_perms;
read_files_pattern($1, gconf_home_t, gconf_home_t)
read_files_pattern($1, data_home_t, data_home_t)
')
########################################
## <summary>
## search gconf homedir (.local)
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
## </param>
#
interface(`gnome_search_gconf',`
gen_require(`
type gconf_home_t;
')
allow $1 gconf_home_t:dir search_dir_perms;
userdom_search_user_home_dirs($1)
')
Add labels for /lib/readahead. Add back gnome_setattr interface
2010-09-13 20:15:43 +00:00
########################################
## <summary>
## Set attributes of Gnome config dirs.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_setattr_config_dirs',`
gen_require(`
type gnome_home_t;
')
setattr_dirs_pattern($1, gnome_home_t, gnome_home_t)
files_search_home($1)
')
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
########################################
## <summary>
## Append gconf home files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_append_gconf_home_files',`
gen_require(`
type gconf_home_t;
')
append_files_pattern($1, gconf_home_t, gconf_home_t)
')
########################################
## <summary>
## manage gconf home files
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_manage_gconf_home_files',`
gen_require(`
type gconf_home_t;
')
allow $1 gconf_home_t:dir list_dir_perms;
manage_files_pattern($1, gconf_home_t, gconf_home_t)
')
########################################
## <summary>
## Connect to gnome over an unix stream socket.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## </summary>
## </param>
#
interface(`gnome_stream_connect',`
gen_require(`
attribute gnome_home_type;
')
# Connect to pulseaudit server
stream_connect_pattern($1, gnome_home_type, gnome_home_type, $2)
')
########################################
## <summary>
Policy fixes
2010-08-30 12:57:06 +00:00
## list gnome homedir content (.config)
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
## </summary>
## </param>
#
Fixed badly chosen type of interface for some interfaces
2010-09-21 07:09:43 +00:00
interface(`gnome_list_home_config',`
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
gen_require(`
type config_home_t;
')
allow $1 config_home_t:dir list_dir_perms;
')
Fix gnome_setattr_config_home Allow exec of sandbox_file_type by calling apps Fix typos
2010-09-13 18:47:02 +00:00
########################################
## <summary>
## Set attributes of gnome homedir content (.config)
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
template(`gnome_setattr_home_config',`
gen_require(`
type config_home_t;
')
setattr_dirs_pattern($1, config_home_t, config_home_t)
userdom_search_user_home_dirs($1)
')
Policy fixes
2010-08-30 12:57:06 +00:00
########################################
## <summary>
## read gnome homedir content (.config)
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
Policy fixes
2010-08-30 12:57:06 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
Policy fixes
2010-08-30 12:57:06 +00:00
## </summary>
## </param>
#
Fixed badly chosen type of interface for some interfaces
2010-09-21 07:09:43 +00:00
interface(`gnome_read_home_config',`
Policy fixes
2010-08-30 12:57:06 +00:00
gen_require(`
type config_home_t;
')
read_files_pattern($1, config_home_t, config_home_t)
')
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port
2010-09-07 20:23:09 +00:00
########################################
## <summary>
## manage gnome homedir content (.config)
## </summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## <param name="domain">
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port
2010-09-07 20:23:09 +00:00
## <summary>
Fix gnome interface definitions
2010-09-08 14:10:20 +00:00
## Domain allowed access.
Allow iptables to read shorewall tmp files Change chfn and passwd to use auth_use_pam so they can send dbus messages to fprintd label vlc as an execmem_exec_t Lots of fixes for mozilla_plugin to run google vidio chat Allow telepath_msn to execute ldconfig and its own tmp files Fix labels on hugepages Allow mdadm to read files on /dev Remove permissive domains and change back to unconfined Allow freshclam to execute shell and bin_t Allow devicekit_power to transition to dhcpc Add boolean to allow icecast to connect to any port
2010-09-07 20:23:09 +00:00
## </summary>
## </param>
#
template(`gnome_manage_home_config',`
gen_require(`
type config_home_t;
')
manage_files_pattern($1, config_home_t, config_home_t)
')
UPdate for f14 policy
2010-08-26 13:41:21 +00:00
########################################
## <summary>
## Read/Write all inherited gnome home config
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_rw_inherited_config',`
gen_require(`
attribute gnome_home_type;
')
allow $1 gnome_home_type:file rw_inherited_file_perms;
')
########################################
## <summary>
## Send and receive messages from
## gconf system service over dbus.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`gnome_dbus_chat_gconfdefault',`
gen_require(`
type gconfdefaultsm_t;
class dbus send_msg;
')
allow $1 gconfdefaultsm_t:dbus send_msg;
allow gconfdefaultsm_t $1:dbus send_msg;
')
Reference in New Issue Copy Permalink