selinux-policy/policy/modules/apps/wine.te

policy_module(wine, 1.7.2)

########################################
#
# Declarations
#

## <desc>
## <p>
##	Ignore wine mmap_zero errors.
## </p>
## </desc>
gen_tunable(wine_mmap_zero_ignore, false)

type wine_t;
type wine_exec_t;
application_domain(wine_t, wine_exec_t)
ubac_constrained(wine_t)
role system_r types wine_t;

type wine_tmp_t;
files_tmp_file(wine_tmp_t)
ubac_constrained(wine_tmp_t)

########################################
#
# Local policy
#

allow wine_t self:process { execstack execmem execheap };
allow wine_t self:fifo_file manage_fifo_file_perms;

can_exec(wine_t, wine_exec_t)

manage_dirs_pattern(wine_t, wine_tmp_t, wine_tmp_t)
manage_files_pattern(wine_t, wine_tmp_t, wine_tmp_t)
files_tmp_filetrans(wine_t, wine_tmp_t, { file dir })

domain_mmap_low(wine_t)

files_execmod_all_files(wine_t)

userdom_use_user_terminals(wine_t)

tunable_policy(`wine_mmap_zero_ignore',`
	dontaudit wine_t self:memprotect mmap_zero;
')

optional_policy(`
	hal_dbus_chat(wine_t)
')

optional_policy(`
	unconfined_domain_noaudit(wine_t)
')

optional_policy(`
	xserver_read_xdm_pid(wine_t)
	xserver_rw_shm(wine_t)
')
Module version bump and changelog entry for conditional mmap_zero patch. 2010-09-01 14:08:09 +00:00			`policy_module(wine, 1.7.2)`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00
			`########################################`
			`#`
			`# Declarations`
			`#`

1/1] Make the ability to mmap zero conditional where this is fapplicable. Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() : Inspired by similar implementation in Fedora. Wine and vbetool do not always actually need the ability to mmap a low area of the address space. In some cases this can be silently denied. Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean. Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space. Rename domain_mmap_low interface to domain_mmap_low_uncond. Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-01 13:32:55 +00:00			`## <desc>`
			`## <p>`
			`## Ignore wine mmap_zero errors.`
			`## </p>`
			`## </desc>`
			`gen_tunable(wine_mmap_zero_ignore, false)`

patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00			`type wine_t;`
			`type wine_exec_t;`
trunk: massive whitespace cleanup from dominick grift. 2008-07-23 21:38:39 +00:00			`application_domain(wine_t, wine_exec_t)`
Wine patch from Dan Walsh. 2010-02-19 14:17:51 +00:00			`ubac_constrained(wine_t)`
			`role system_r types wine_t;`

			`type wine_tmp_t;`
			`files_tmp_file(wine_tmp_t)`
			`ubac_constrained(wine_tmp_t)`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00
			`########################################`
			`#`
			`# Local policy`
			`#`

Wine patch from Dan Walsh. 2010-02-19 14:17:51 +00:00			`allow wine_t self:process { execstack execmem execheap };`
			`allow wine_t self:fifo_file manage_fifo_file_perms;`

			`can_exec(wine_t, wine_exec_t)`

			`manage_dirs_pattern(wine_t, wine_tmp_t, wine_tmp_t)`
			`manage_files_pattern(wine_t, wine_tmp_t, wine_tmp_t)`
			`files_tmp_filetrans(wine_t, wine_tmp_t, { file dir })`

			`domain_mmap_low(wine_t)`

			`files_execmod_all_files(wine_t)`

trunk: merge UBAC. 2008-11-05 16:10:46 +00:00			`userdom_use_user_terminals(wine_t)`

1/1] Make the ability to mmap zero conditional where this is fapplicable. Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() : Inspired by similar implementation in Fedora. Wine and vbetool do not always actually need the ability to mmap a low area of the address space. In some cases this can be silently denied. Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean. Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space. Rename domain_mmap_low interface to domain_mmap_low_uncond. Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability. Signed-off-by: Dominick Grift <domg472@gmail.com> 2010-09-01 13:32:55 +00:00			tunable_policy(`wine_mmap_zero_ignore',`
			`dontaudit wine_t self:memprotect mmap_zero;`
			`')`

trunk: merge strict and targeted policies. merge shlib_t into lib_t. 2007-10-02 16:04:50 +00:00			optional_policy(`
Wine patch from Dan Walsh. 2010-02-19 14:17:51 +00:00			`hal_dbus_chat(wine_t)`
			`')`

			optional_policy(`
patch from dan Wed, 01 Feb 2006 08:33:30 -0500 2006-02-06 22:47:46 +00:00			`unconfined_domain_noaudit(wine_t)`
Wine patch from Dan Walsh. 2010-02-19 14:17:51 +00:00			`')`
patch from dan Tue, 06 Jun 2006 22:50:46 -0400 2006-06-07 17:43:10 +00:00
Wine patch from Dan Walsh. 2010-02-19 14:17:51 +00:00			optional_policy(`
			`xserver_read_xdm_pid(wine_t)`
			`xserver_rw_shm(wine_t)`
patch from Dan, sent Thu, 19 Jan 2006 14:16:26 -0500 2006-01-19 23:00:23 +00:00			`')`