clean up xscreensaver.
This commit is contained in:
parent
31f9c109c1
commit
1d3b9e384c
@ -16,6 +16,7 @@
|
|||||||
modemmanager(Dan Walsh)
|
modemmanager(Dan Walsh)
|
||||||
nslcd (Dan Walsh)
|
nslcd (Dan Walsh)
|
||||||
shorewall (Dan Walsh)
|
shorewall (Dan Walsh)
|
||||||
|
xscreensaver (Corentin Labbe)
|
||||||
|
|
||||||
* Thu Jul 30 2009 Chris PeBenito <selinux@tresys.com> - 2.20090730
|
* Thu Jul 30 2009 Chris PeBenito <selinux@tresys.com> - 2.20090730
|
||||||
- Gentoo fixes for init scripts and system startup.
|
- Gentoo fixes for init scripts and system startup.
|
||||||
|
@ -1,4 +1,4 @@
|
|||||||
## <summary>xscreensaver policy interface</summary>
|
## <summary>X Screensaver</summary>
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
@ -24,11 +24,7 @@ interface(`xscreensaver_role',`
|
|||||||
|
|
||||||
domtrans_pattern($2, xscreensaver_exec_t, xscreensaver_t)
|
domtrans_pattern($2, xscreensaver_exec_t, xscreensaver_t)
|
||||||
|
|
||||||
allow xscreensaver_t $2:fd use;
|
|
||||||
|
|
||||||
# Allow the user domain to signal/ps.
|
# Allow the user domain to signal/ps.
|
||||||
ps_process_pattern($2, xscreensaver_t)
|
ps_process_pattern($2, xscreensaver_t)
|
||||||
allow $2 xscreensaver_t:process signal_perms;
|
allow $2 xscreensaver_t:process signal_perms;
|
||||||
allow xscreensaver_t $2:process sigchld;
|
|
||||||
|
|
||||||
')
|
')
|
||||||
|
@ -1,3 +1,4 @@
|
|||||||
|
|
||||||
policy_module(xscreensaver, 1.0.0)
|
policy_module(xscreensaver, 1.0.0)
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
@ -8,6 +9,7 @@ policy_module(xscreensaver, 1.0.0)
|
|||||||
type xscreensaver_t;
|
type xscreensaver_t;
|
||||||
type xscreensaver_exec_t;
|
type xscreensaver_exec_t;
|
||||||
application_domain(xscreensaver_t, xscreensaver_exec_t)
|
application_domain(xscreensaver_t, xscreensaver_exec_t)
|
||||||
|
ubac_constrained(xscreensaver_t)
|
||||||
|
|
||||||
type xscreensaver_tmpfs_t;
|
type xscreensaver_tmpfs_t;
|
||||||
files_tmpfs_file(xscreensaver_tmpfs_t)
|
files_tmpfs_file(xscreensaver_tmpfs_t)
|
||||||
@ -17,36 +19,27 @@ ubac_constrained(xscreensaver_tmpfs_t)
|
|||||||
#
|
#
|
||||||
# Local policy
|
# Local policy
|
||||||
#
|
#
|
||||||
auth_use_nsswitch(xscreensaver_t)
|
|
||||||
|
|
||||||
logging_send_audit_msgs(xscreensaver_t)
|
|
||||||
logging_send_syslog_msg(xscreensaver_t)
|
|
||||||
miscfiles_read_localization(xscreensaver_t)
|
|
||||||
|
|
||||||
allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
|
allow xscreensaver_t self:fifo_file rw_fifo_file_perms;
|
||||||
allow xscreensaver_t self:process signal;
|
allow xscreensaver_t self:process signal;
|
||||||
|
|
||||||
#access to .icons and ~/.xscreensaver
|
kernel_read_system_state(xscreensaver_t)
|
||||||
userdom_read_user_home_content_files(xscreensaver_t)
|
|
||||||
|
|
||||||
userdom_use_user_ptys(xscreensaver_t)
|
|
||||||
|
|
||||||
files_read_usr_files(xscreensaver_t)
|
files_read_usr_files(xscreensaver_t)
|
||||||
|
|
||||||
|
auth_use_nsswitch(xscreensaver_t)
|
||||||
auth_domtrans_chk_passwd(xscreensaver_t)
|
auth_domtrans_chk_passwd(xscreensaver_t)
|
||||||
|
|
||||||
#/var/run/utmp
|
#/var/run/utmp
|
||||||
init_read_utmp(xscreensaver_t)
|
init_read_utmp(xscreensaver_t)
|
||||||
|
|
||||||
########################################
|
logging_send_audit_msgs(xscreensaver_t)
|
||||||
#
|
logging_send_syslog_msg(xscreensaver_t)
|
||||||
# X Serveur and co
|
|
||||||
#
|
miscfiles_read_localization(xscreensaver_t)
|
||||||
|
|
||||||
|
userdom_use_user_ptys(xscreensaver_t)
|
||||||
|
#access to .icons and ~/.xscreensaver
|
||||||
|
userdom_read_user_home_content_files(xscreensaver_t)
|
||||||
|
|
||||||
xserver_user_x_domain_template(xscreensaver, xscreensaver_t, xscreensaver_tmpfs_t)
|
xserver_user_x_domain_template(xscreensaver, xscreensaver_t, xscreensaver_tmpfs_t)
|
||||||
|
|
||||||
########################################
|
|
||||||
#
|
|
||||||
# process, kernel and /proc /dev /sys
|
|
||||||
#
|
|
||||||
|
|
||||||
kernel_read_system_state(xscreensaver_t)
|
|
||||||
|
Loading…
Reference in New Issue
Block a user