trunk: add core xselinux support.

This commit is contained in:
Chris PeBenito 2008-04-01 20:23:23 +00:00
parent e828954c63
commit 2c12b471ad
40 changed files with 1347 additions and 238 deletions

View File

@ -1,3 +1,4 @@
- Add core Security Enhanced X Windows support.
- Fix winbind socket connection interface for default location of the
sock_file.
- Add wireshark module based on ethereal module.

View File

@ -236,7 +236,7 @@ seusers := $(appconf)/seusers
appdir := $(contextpath)
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
net_contexts := $(builddir)net_contexts
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)

View File

@ -0,0 +1,194 @@
#
# Config file for XSELinux extension
#
#
##
### Rules for X Clients
##
#
#
# The default client rule defines a context to be used for all clients
# connecting to the server from a remote host.
#
client * system_u:object_r:remote_xclient_t:s0
#
##
### Rules for X Properties
##
#
#
# Property rules map a property name to a context. A default property
# rule indicated by an asterisk should follow all other property rules.
#
# Properties that normal clients may only read
property XFree86_VT system_u:object_r:info_xproperty_t:s0
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
# Clipboard and selection properties
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
# Default fallback type
property * system_u:object_r:xproperty_t:s0
#
##
### Rules for X Extensions
##
#
#
# Extension rules map an extension name to a context. A default extension
# rule indicated by an asterisk should follow all other extension rules.
#
# Standard extensions
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
extension SHAPE system_u:object_r:std_xext_t:s0
extension SYNC system_u:object_r:std_xext_t:s0
extension XC-MISC system_u:object_r:std_xext_t:s0
extension XFIXES system_u:object_r:std_xext_t:s0
extension XInputExtension system_u:object_r:std_xext_t:s0
extension XKEYBOARD system_u:object_r:std_xext_t:s0
extension DAMAGE system_u:object_r:std_xext_t:s0
extension RENDER system_u:object_r:std_xext_t:s0
extension XINERAMA system_u:object_r:std_xext_t:s0
# Direct hardware access extensions
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
# Screen management and multihead extensions
extension RANDR system_u:object_r:output_xext_t:s0
extension Composite system_u:object_r:output_xext_t:s0
# Screensaver, power management extensions
extension DPMS system_u:object_r:screensaver_xext_t:s0
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
# Shared memory extensions
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
# Accelerated graphics, OpenGL, direct rendering extensions
extension GLX system_u:object_r:accelgraphics_xext_t:s0
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
# Debugging, testing, and recording extensions
extension RECORD system_u:object_r:debug_xext_t:s0
extension X-Resource system_u:object_r:debug_xext_t:s0
extension XTEST system_u:object_r:debug_xext_t:s0
# Security-related extensions
extension SECURITY system_u:object_r:security_xext_t:s0
extension SELinux system_u:object_r:security_xext_t:s0
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
# Video extensions
extension XVideo system_u:object_r:video_xext_t:s0
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
# Default fallback type
extension * system_u:object_r:xext_t:s0
#
##
### Rules for X Selections
##
#
# Selection rules map a selection name to a context. A default selection
# rule indicated by an asterisk should follow all other selection rules.
#
# Standard selections
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
# Default fallback type
selection * system_u:object_r:xselection_t:s0
#
##
### Rules for X Events
##
#
#
# Event rules map an event protocol name to a context. A default event
# rule indicated by an asterisk should follow all other event rules.
#
# Input events
event X11:KeyPress system_u:object_r:input_xevent_t:s0
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
# Focus events
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
# Property events
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
# Client message events
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
# Manager events
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
event X11:Expose system_u:object_r:manage_xevent_t:s0
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
# Unknown events (that are not registered in the X server's name database)
event <unknown> system_u:object_r:unknown_xevent_t:s0
# Default fallback type
event * system_u:object_r:xevent_t:s0

View File

@ -0,0 +1,194 @@
#
# Config file for XSELinux extension
#
#
##
### Rules for X Clients
##
#
#
# The default client rule defines a context to be used for all clients
# connecting to the server from a remote host.
#
client * system_u:object_r:remote_xclient_t:s0
#
##
### Rules for X Properties
##
#
#
# Property rules map a property name to a context. A default property
# rule indicated by an asterisk should follow all other property rules.
#
# Properties that normal clients may only read
property XFree86_VT system_u:object_r:info_xproperty_t:s0
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
# Clipboard and selection properties
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
# Default fallback type
property * system_u:object_r:xproperty_t:s0
#
##
### Rules for X Extensions
##
#
#
# Extension rules map an extension name to a context. A default extension
# rule indicated by an asterisk should follow all other extension rules.
#
# Standard extensions
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
extension SHAPE system_u:object_r:std_xext_t:s0
extension SYNC system_u:object_r:std_xext_t:s0
extension XC-MISC system_u:object_r:std_xext_t:s0
extension XFIXES system_u:object_r:std_xext_t:s0
extension XInputExtension system_u:object_r:std_xext_t:s0
extension XKEYBOARD system_u:object_r:std_xext_t:s0
extension DAMAGE system_u:object_r:std_xext_t:s0
extension RENDER system_u:object_r:std_xext_t:s0
extension XINERAMA system_u:object_r:std_xext_t:s0
# Direct hardware access extensions
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
# Screen management and multihead extensions
extension RANDR system_u:object_r:output_xext_t:s0
extension Composite system_u:object_r:output_xext_t:s0
# Screensaver, power management extensions
extension DPMS system_u:object_r:screensaver_xext_t:s0
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
# Shared memory extensions
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
# Accelerated graphics, OpenGL, direct rendering extensions
extension GLX system_u:object_r:accelgraphics_xext_t:s0
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
# Debugging, testing, and recording extensions
extension RECORD system_u:object_r:debug_xext_t:s0
extension X-Resource system_u:object_r:debug_xext_t:s0
extension XTEST system_u:object_r:debug_xext_t:s0
# Security-related extensions
extension SECURITY system_u:object_r:security_xext_t:s0
extension SELinux system_u:object_r:security_xext_t:s0
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
# Video extensions
extension XVideo system_u:object_r:video_xext_t:s0
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
# Default fallback type
extension * system_u:object_r:xext_t:s0
#
##
### Rules for X Selections
##
#
# Selection rules map a selection name to a context. A default selection
# rule indicated by an asterisk should follow all other selection rules.
#
# Standard selections
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
# Default fallback type
selection * system_u:object_r:xselection_t:s0
#
##
### Rules for X Events
##
#
#
# Event rules map an event protocol name to a context. A default event
# rule indicated by an asterisk should follow all other event rules.
#
# Input events
event X11:KeyPress system_u:object_r:input_xevent_t:s0
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
# Focus events
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
# Property events
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
# Client message events
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
# Manager events
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
event X11:Expose system_u:object_r:manage_xevent_t:s0
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
# Unknown events (that are not registered in the X server's name database)
event <unknown> system_u:object_r:unknown_xevent_t:s0
# Default fallback type
event * system_u:object_r:xevent_t:s0

View File

@ -0,0 +1,194 @@
#
# Config file for XSELinux extension
#
#
##
### Rules for X Clients
##
#
#
# The default client rule defines a context to be used for all clients
# connecting to the server from a remote host.
#
client * system_u:object_r:remote_xclient_t
#
##
### Rules for X Properties
##
#
#
# Property rules map a property name to a context. A default property
# rule indicated by an asterisk should follow all other property rules.
#
# Properties that normal clients may only read
property XFree86_VT system_u:object_r:info_xproperty_t
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t
property AT_SPI_IOR system_u:object_r:info_xproperty_t
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t
property _NET_WORKAREA system_u:object_r:info_xproperty_t
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t
# Clipboard and selection properties
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t
# Default fallback type
property * system_u:object_r:xproperty_t
#
##
### Rules for X Extensions
##
#
#
# Extension rules map an extension name to a context. A default extension
# rule indicated by an asterisk should follow all other extension rules.
#
# Standard extensions
extension BIG-REQUESTS system_u:object_r:std_xext_t
extension SHAPE system_u:object_r:std_xext_t
extension SYNC system_u:object_r:std_xext_t
extension XC-MISC system_u:object_r:std_xext_t
extension XFIXES system_u:object_r:std_xext_t
extension XInputExtension system_u:object_r:std_xext_t
extension XKEYBOARD system_u:object_r:std_xext_t
extension DAMAGE system_u:object_r:std_xext_t
extension RENDER system_u:object_r:std_xext_t
extension XINERAMA system_u:object_r:std_xext_t
# Direct hardware access extensions
extension XFree86-DGA system_u:object_r:directhw_xext_t
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t
# Screen management and multihead extensions
extension RANDR system_u:object_r:output_xext_t
extension Composite system_u:object_r:output_xext_t
# Screensaver, power management extensions
extension DPMS system_u:object_r:screensaver_xext_t
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t
# Shared memory extensions
extension MIT-SHM system_u:object_r:shmem_xext_t
extension XFree86-Bigfont system_u:object_r:shmem_xext_t
# Accelerated graphics, OpenGL, direct rendering extensions
extension GLX system_u:object_r:accelgraphics_xext_t
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t
extension NV-GLX system_u:object_r:accelgraphics_xext_t
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t
# Debugging, testing, and recording extensions
extension RECORD system_u:object_r:debug_xext_t
extension X-Resource system_u:object_r:debug_xext_t
extension XTEST system_u:object_r:debug_xext_t
# Security-related extensions
extension SECURITY system_u:object_r:security_xext_t
extension SELinux system_u:object_r:security_xext_t
extension XAccessControlExtension system_u:object_r:security_xext_t
extension XC-APPGROUP system_u:object_r:security_xext_t
# Video extensions
extension XVideo system_u:object_r:video_xext_t
extension XVideo-MotionCompensation system_u:object_r:video_xext_t
# Default fallback type
extension * system_u:object_r:xext_t
#
##
### Rules for X Selections
##
#
# Selection rules map a selection name to a context. A default selection
# rule indicated by an asterisk should follow all other selection rules.
#
# Standard selections
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t
selection PRIMARY system_u:object_r:clipboard_xselection_t
selection CLIPBOARD system_u:object_r:clipboard_xselection_t
# Default fallback type
selection * system_u:object_r:xselection_t
#
##
### Rules for X Events
##
#
#
# Event rules map an event protocol name to a context. A default event
# rule indicated by an asterisk should follow all other event rules.
#
# Input events
event X11:KeyPress system_u:object_r:input_xevent_t
event X11:KeyRelease system_u:object_r:input_xevent_t
event X11:ButtonPress system_u:object_r:input_xevent_t
event X11:ButtonRelease system_u:object_r:input_xevent_t
event X11:MotionNotify system_u:object_r:input_xevent_t
event X11:SelectionNotify system_u:object_r:input_xevent_t
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t
# Focus events
event X11:FocusIn system_u:object_r:focus_xevent_t
event X11:FocusOut system_u:object_r:focus_xevent_t
event X11:EnterNotify system_u:object_r:focus_xevent_t
event X11:LeaveNotify system_u:object_r:focus_xevent_t
# Property events
event X11:PropertyNotify system_u:object_r:property_xevent_t
# Client message events
event X11:ClientMessage system_u:object_r:client_xevent_t
# Manager events
event X11:ConfigureRequest system_u:object_r:manage_xevent_t
event X11:ResizeRequest system_u:object_r:manage_xevent_t
event X11:MapRequest system_u:object_r:manage_xevent_t
event X11:CirculateRequest system_u:object_r:manage_xevent_t
event X11:CreateNotify system_u:object_r:manage_xevent_t
event X11:DestroyNotify system_u:object_r:manage_xevent_t
event X11:MapNotify system_u:object_r:manage_xevent_t
event X11:UnmapNotify system_u:object_r:manage_xevent_t
event X11:ReparentNotify system_u:object_r:manage_xevent_t
event X11:ConfigureNotify system_u:object_r:manage_xevent_t
event X11:GravityNotify system_u:object_r:manage_xevent_t
event X11:CirculateNotify system_u:object_r:manage_xevent_t
event X11:Expose system_u:object_r:manage_xevent_t
event X11:VisibilityNotify system_u:object_r:manage_xevent_t
# Unknown events (that are not registered in the X server's name database)
event <unknown> system_u:object_r:unknown_xevent_t
# Default fallback type
event * system_u:object_r:xevent_t

View File

@ -416,141 +416,160 @@ class passwd
#
# SE-X Windows stuff
#
class drawable
class x_drawable
{
create
destroy
draw
copy
getattr
}
class gc
{
create
free
read
write
blend
getattr
setattr
list_child
add_child
remove_child
list_property
get_property
set_property
manage
override
show
hide
send
receive
}
class window
class x_screen
{
getattr
setattr
hide_cursor
show_cursor
saver_getattr
saver_setattr
saver_hide
saver_show
}
class x_gc
{
addchild
create
destroy
map
unmap
chstack
chproplist
chprop
listprop
getattr
setattr
setfocus
move
chselection
chparent
ctrllife
enumerate
transparent
mousemotion
clientcomevent
inputevent
drawevent
windowchangeevent
windowchangerequest
serverchangeevent
extensionevent
}
class font
{
load
free
getattr
use
}
class colormap
class x_font
{
create
free
install
uninstall
list
read
store
destroy
getattr
setattr
add_glyph
remove_glyph
use
}
class property
class x_colormap
{
create
free
destroy
read
write
getattr
add_color
remove_color
install
uninstall
use
}
class cursor
class x_property
{
create
createglyph
free
assign
setattr
}
class xclient
{
kill
}
class xinput
{
lookup
destroy
read
write
append
getattr
setattr
}
class x_selection
{
read
write
getattr
setattr
}
class x_cursor
{
create
destroy
read
write
getattr
setattr
use
}
class x_client
{
destroy
getattr
setattr
manage
}
class x_device
{
getattr
setattr
use
read
write
getfocus
setfocus
warppointer
activegrab
passivegrab
ungrab
bell
mousemotion
relabelinput
}
class xserver
{
screensaver
gethostlist
sethostlist
getfontpath
setfontpath
getattr
force_cursor
freeze
grab
ungrab
manage
}
class xextension
class x_server
{
getattr
setattr
record
debug
grab
manage
}
class x_extension
{
query
use
}
#
# Define the access vector interpretation for controlling
# PaX flags
#
class pax
class x_resource
{
pageexec # Paging based non-executable pages
emutramp # Emulate trampolines
mprotect # Restrict mprotect()
randmmap # Randomize mmap() base
randexec # Randomize ET_EXEC base
segmexec # Segmentation based non-executable pages
read
write
}
class x_event
{
send
receive
}
class x_synthetic_event
{
send
receive
}
#

View File

@ -50,21 +50,19 @@ class ipc
# passwd/chfn/chsh
class passwd # userspace
# SE-X Windows stuff
class drawable # userspace
class window # userspace
class gc # userspace
class font # userspace
class colormap # userspace
class property # userspace
class cursor # userspace
class xclient # userspace
class xinput # userspace
class xserver # userspace
class xextension # userspace
# pax flags; deprecated--can be reclaimed
class pax # userspace
# SE-X Windows stuff (more classes below)
class x_drawable # userspace
class x_screen # userspace
class x_gc # userspace
class x_font # userspace
class x_colormap # userspace
class x_property # userspace
class x_selection # userspace
class x_cursor # userspace
class x_client # userspace
class x_device # userspace
class x_server # userspace
class x_extension # userspace
# extended netlink sockets
class netlink_route_socket
@ -112,4 +110,9 @@ class peer
# Capabilities >= 32
class capability2
# More SE-X Windows stuff
class x_resource # userspace
class x_event # userspace
class x_synthetic_event # userspace
# FLASK

View File

@ -371,78 +371,53 @@ mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec se
#
# MLS policy for the drawable class
# MLS policy for the x_drawable class
#
# the drawable "read" ops (implicit single level)
mlsconstrain drawable { getattr copy }
# the x_drawable "read" ops (implicit single level)
mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the drawable "write" ops (implicit single level)
mlsconstrain drawable { create destroy draw copy }
# the x_drawable "write" ops (implicit single level)
mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
# No MLS restrictions: x_drawable { show hide override }
#
# MLS policy for the x_gc class
#
# the x_gc "read" ops (implicit single level)
mlsconstrain x_gc { getattr use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the x_gc "write" ops (implicit single level)
mlsconstrain x_gc { create destroy setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the gc class
# MLS policy for the x_font class
#
# the gc "read" ops (implicit single level)
mlsconstrain gc getattr
# the x_font "read" ops (implicit single level)
mlsconstrain x_font { use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the gc "write" ops (implicit single level)
mlsconstrain gc { create free setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the window class
#
# the window "read" ops (implicit single level)
mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the window "write" ops (implicit single level)
mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ) or
( t2 == mlstrustedobject ));
# these access vectors have no MLS restrictions
# window { map unmap }
#
# MLS policy for the font class
#
# the font "read" ops (implicit single level)
mlsconstrain font { load getattr }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the font "write" ops (implicit single level)
mlsconstrain font free
# the x_font "write" ops (implicit single level)
mlsconstrain x_font { create destroy add_glyph remove_glyph }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
@ -451,109 +426,147 @@ mlsconstrain font free
# font use
#
# MLS policy for the colormap class
# MLS policy for the x_colormap class
#
# the colormap "read" ops (implicit single level)
mlsconstrain colormap { list read getattr }
# the x_colormap "read" ops (implicit single level)
mlsconstrain x_colormap { read getattr use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadcolormap ) or
( t1 == mlsxwinread ));
# the colormap "write" ops (implicit single level)
mlsconstrain colormap { create free install uninstall store setattr }
# the x_colormap "write" ops (implicit single level)
mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritecolormap ) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the property class
# MLS policy for the x_property class
#
# the property "read" ops (implicit single level)
mlsconstrain property { read }
# the x_property "read" ops (implicit single level)
mlsconstrain x_property { read getattr }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadproperty ) or
( t1 == mlsxwinread ));
# the property "write" ops (implicit single level)
mlsconstrain property { create free write }
# the x_property "write" ops (implicit single level)
mlsconstrain x_property { create destroy write append setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwriteproperty ) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the cursor class
# MLS policy for the x_cursor class
#
# the cursor "write" ops (implicit single level)
mlsconstrain cursor { create createglyph free assign setattr }
# the x_cursor "read" ops (implicit single level)
mlsconstrain x_cursor { read getattr use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the x_cursor "write" ops (implicit single level)
mlsconstrain x_cursor { create destroy write setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the xclient class
# MLS policy for the x_client class
#
# the xclient "write" ops (implicit single level)
mlsconstrain xclient kill
# the x_client "read" ops (implicit single level)
mlsconstrain x_client { getattr }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the x_client "write" ops (implicit single level)
mlsconstrain x_client { destroy setattr manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the xinput class
# MLS policy for the x_device class
#
# these access vectors have no MLS restrictions
# xinput ~{ relabelinput setattr }
# the x_device "read" ops (implicit single level)
mlsconstrain x_device { getattr use read getfocus grab }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the xinput "write" ops (implicit single level)
mlsconstrain xinput { setattr relabelinput }
# the x_device "write" ops (implicit single level)
mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritexinput ) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the xserver class
# MLS policy for the x_server class
#
# these access vectors have no MLS restrictions
# xserver *
# x_server *
#
# MLS policy for the xextension class
# MLS policy for the x_extension class
#
# these access vectors have no MLS restrictions
# xextension { query use }
# x_extension { query use }
#
# MLS policy for the x_resource class
#
# the x_resource "read" ops (implicit single level)
mlsconstrain x_resource { read }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the x_resource "write" ops (implicit single level)
mlsconstrain x_resource { write }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritexinput ) or
( t1 == mlsxwinwrite ));
#
# MLS policy for the x_event class
#
# the x_event "read" ops (implicit single level)
mlsconstrain x_event { receive }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
# the x_event "write" ops (implicit single level)
mlsconstrain x_event { send }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritexinput ) or
( t1 == mlsxwinwrite ));
#

View File

@ -159,7 +159,7 @@ template(`ethereal_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_ethereal_t,$1_ethereal_tmpfs_t)
xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t)
xserver_create_xdm_tmp_sockets($1_ethereal_t)
')

View File

@ -1,5 +1,5 @@
policy_module(ethereal,1.4.0)
policy_module(ethereal,1.4.1)
########################################
#

View File

@ -247,7 +247,7 @@ template(`evolution_per_role_template',`
mta_read_config($1_evolution_t)
xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t)
xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t)
xserver_read_xdm_tmp_files($1_evolution_t)
tunable_policy(`use_nfs_home_dirs',`
@ -513,7 +513,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
xserver_user_client_template($1,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
# Access evolution home
tunable_policy(`use_nfs_home_dirs',`
@ -615,7 +615,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
xserver_user_client_template($1,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
# Access evolution home
tunable_policy(`use_nfs_home_dirs',`
@ -776,7 +776,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
xserver_user_client_template($1,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
optional_policy(`
nscd_socket_use($1_evolution_webcal_t)

View File

@ -1,5 +1,5 @@
policy_module(evolution,1.5.0)
policy_module(evolution,1.5.1)
########################################
#

View File

@ -146,7 +146,7 @@ template(`games_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_games_t,$1_games_tmpfs_t)
xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t)
xserver_create_xdm_tmp_sockets($1_games_t)
xserver_read_xdm_lib_files($1_games_t)
')

View File

@ -1,5 +1,5 @@
policy_module(games,1.5.0)
policy_module(games,1.5.1)
########################################
#

View File

@ -130,7 +130,7 @@ template(`gift_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_gift_t,$1_gift_tmpfs_t)
xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t)
')
##############################

View File

@ -1,5 +1,5 @@
policy_module(gift,1.3.0)
policy_module(gift,1.3.1)
########################################
#

View File

@ -164,7 +164,7 @@ template(`java_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
')
')

View File

@ -1,5 +1,5 @@
policy_module(java,1.7.0)
policy_module(java,1.7.1)
########################################
#

View File

@ -191,7 +191,7 @@ template(`mozilla_per_role_template',`
userdom_manage_user_tmp_files($1,$1_mozilla_t)
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)

View File

@ -1,5 +1,5 @@
policy_module(mozilla,1.5.0)
policy_module(mozilla,1.5.1)
########################################
#

View File

@ -342,7 +342,7 @@ template(`mplayer_per_role_template',`
userdom_read_user_home_content_files($1,$1_mplayer_t)
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t)
xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t)
# Read songs
ifdef(`enable_mls',`',`

View File

@ -1,5 +1,5 @@
policy_module(mplayer,1.4.0)
policy_module(mplayer,1.4.1)
########################################
#

View File

@ -160,7 +160,7 @@ template(`thunderbird_per_role_template',`
# .kde/....gtkrc
userdom_read_user_home_content_files($1,$1_thunderbird_t)
xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
xserver_user_x_domain_template($1,$1_thunderbird,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
xserver_read_xdm_tmp_files($1_thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)

View File

@ -1,5 +1,5 @@
policy_module(thunderbird,1.5.0)
policy_module(thunderbird,1.5.1)
########################################
#

View File

@ -134,6 +134,6 @@ template(`tvtime_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_tvtime_t,$1_tvtime_tmpfs_t)
xserver_user_x_domain_template($1,$1_tvtime,$1_tvtime_t,$1_tvtime_tmpfs_t)
')
')

View File

@ -1,5 +1,5 @@
policy_module(tvtime,1.3.0)
policy_module(tvtime,1.3.1)
########################################
#

View File

@ -164,7 +164,7 @@ template(`vmware_per_role_template',`
sysnet_dns_name_resolve($1_vmware_t)
sysnet_read_config($1_vmware_t)
xserver_user_client_template($1,$1_vmware_t,$1_vmware_tmpfs_t)
xserver_user_x_domain_template($1,$1_vmware,$1_vmware_t,$1_vmware_tmpfs_t)
')
########################################

View File

@ -1,5 +1,5 @@
policy_module(vmware,1.4.0)
policy_module(vmware,1.4.1)
########################################
#

View File

@ -609,6 +609,26 @@ interface(`mls_process_set_level',`
typeattribute $1 mlsprocsetsl;
')
########################################
## <summary>
## Make specified domain MLS trusted
## for reading from X objects up to its clearance.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`mls_xwin_read_to_clearance',`
gen_require(`
attribute mlsxwinreadtoclr;
')
typeattribute $1 mlsxwinreadtoclr;
')
########################################
## <summary>
## Make specified domain MLS trusted
@ -629,6 +649,26 @@ interface(`mls_xwin_read_all_levels',`
typeattribute $1 mlsxwinread;
')
########################################
## <summary>
## Make specified domain MLS trusted
## for write to X objects up to its clearance.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`mls_xwin_write_to_clearance',`
gen_require(`
attribute mlsxwinwritetoclr;
')
typeattribute $1 mlsxwinwritetoclr;
')
########################################
## <summary>
## Make specified domain MLS trusted

View File

@ -1,5 +1,5 @@
policy_module(mls,1.6.1)
policy_module(mls,1.6.2)
########################################
#

View File

@ -107,7 +107,7 @@ template(`bluetooth_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
xserver_user_x_domain_template($1, $1_bluetooth, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
')
')

View File

@ -1,5 +1,5 @@
policy_module(bluetooth,2.0.0)
policy_module(bluetooth,2.0.1)
########################################
#

View File

@ -282,7 +282,7 @@ template(`ssh_per_role_template',`
')
optional_policy(`
xserver_user_client_template($1,$1_ssh_t,$1_ssh_tmpfs_t)
xserver_user_x_domain_template($1,$1_ssh,$1_ssh_t,$1_ssh_tmpfs_t)
xserver_domtrans_user_xauth($1,$1_ssh_t)
')

View File

@ -1,5 +1,5 @@
policy_module(ssh,1.9.0)
policy_module(ssh,1.9.1)
########################################
#

View File

@ -15,6 +15,11 @@
template(`xserver_common_domain_template',`
gen_require(`
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
attribute x_server_domain;
class x_drawable all_x_drawable_perms;
class x_colormap all_x_colormap_perms;
class x_screen all_x_screen_perms;
')
##############################
@ -22,7 +27,12 @@ template(`xserver_common_domain_template',`
# Declarations
#
type $1_xserver_t;
attribute $1_x_domain;
attribute $1_input_xevent_type;
type $1_rootwindow_t, rootwindow_type;
type $1_xserver_t, x_server_domain;
domain_type($1_xserver_t)
domain_entry_file($1_xserver_t,xserver_exec_t)
@ -83,6 +93,9 @@ template(`xserver_common_domain_template',`
manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t)
logging_log_filetrans($1_xserver_t,xserver_log_t,file)
# Labeling rules for default windows and colormaps
type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t;
kernel_read_system_state($1_xserver_t)
kernel_read_device_sysctls($1_xserver_t)
kernel_read_modprobe_sysctls($1_xserver_t)
@ -142,6 +155,10 @@ template(`xserver_common_domain_template',`
fs_search_auto_mountpoints($1_xserver_t)
fs_search_ramfs($1_xserver_t)
selinux_validate_context($1_xserver_t)
selinux_compute_access_vector($1_xserver_t)
selinux_compute_create_context($1_xserver_t)
auth_use_nsswitch($1_xserver_t)
init_getpgid($1_xserver_t)
@ -153,13 +170,15 @@ template(`xserver_common_domain_template',`
libs_use_shared_libs($1_xserver_t)
logging_send_syslog_msg($1_xserver_t)
logging_send_audit_msgs($1_xserver_t)
miscfiles_read_localization($1_xserver_t)
miscfiles_read_fonts($1_xserver_t)
modutils_domtrans_insmod($1_xserver_t)
seutil_dontaudit_search_config($1_xserver_t)
# read x_contexts
seutil_read_default_contexts($1_xserver_t)
ifndef(`distro_redhat',`
allow $1_xserver_t self:process { execmem execheap execstack };
@ -169,6 +188,32 @@ template(`xserver_common_domain_template',`
allow $1_xserver_t self:process { execmem execheap execstack };
')
tunable_policy(`!xserver_object_manager',`
# should be xserver_unconfined($1_xserver_t),
# but typeattribute doesnt work in conditionals
gen_require(`
attribute x_server_domain, x_domain;
attribute xproperty_type, xselection_type;
attribute xextension_type, xevent_type;
attribute rootwindow_type;
type remote_xclient_t;
')
allow $1_xserver_t x_server_domain:x_server *;
allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *;
allow $1_xserver_t x_server_domain:x_screen *;
allow $1_xserver_t x_domain:x_gc *;
allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *;
allow $1_xserver_t xproperty_type:x_property *;
allow $1_xserver_t xselection_type:x_selection *;
allow $1_xserver_t x_domain:x_cursor *;
allow $1_xserver_t { x_domain remote_xclient_t }:x_client *;
allow $1_xserver_t { x_domain x_server_domain }:x_device *;
allow $1_xserver_t xextension_type:x_extension *;
allow $1_xserver_t { x_domain x_server_domain }:x_resource *;
allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *;
')
optional_policy(`
apm_stream_connect($1_xserver_t)
')
@ -415,6 +460,47 @@ template(`xserver_per_role_template',`
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_iceauth_t)
')
##############################
#
# User X object manager local policy
#
# Device rules
allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell };
allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
# manage: xhost X11:ChangeHosts
# freeze: metacity X11:GrabKey
# force_cursor: metacity X11:GrabPointer
allow $2 $1_xserver_t:x_device { manage freeze force_cursor };
# gnome-settings-daemon XKEYBOARD:SetControls
allow $2 $1_xserver_t:x_server manage;
# gnome-settings-daemon RANDR:SelectInput
allow $2 $1_xserver_t:x_resource write;
# metacity X11:InstallColormap X11:UninstallColormap
allow $2 $1_rootwindow_t:x_colormap { install uninstall };
# read: gnome-settings-daemon RANDR:GetScreenSizeRange
# write: gnome-settings-daemon RANDR:SelectInput
# setattr: gnome-settings-daemon X11:GrabKey
# manage: metacity X11:ChangeWindowAttributes
allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
# setattr: metacity X11:InstallColormap
allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr };
# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
allow $2 info_xproperty_t:x_property { create write append };
mls_xwin_read_to_clearance($1_xserver_t)
xserver_common_x_domain_template($1,$1,$2)
')
#######################################
@ -521,7 +607,7 @@ template(`xserver_rw_session_template',`
## </param>
#
template(`xserver_user_client_template',`
# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
gen_require(`
type xdm_t, xdm_tmp_t;
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
@ -564,6 +650,279 @@ template(`xserver_user_client_template',`
')
')
#######################################
## <summary>
## Interface to provide X object permissions on a given X server to
## an X client domain. Provides the minimal set required by a basic
## X client application.
## </summary>
## <param name="user">
## <summary>
## The prefix of the X server domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="prefix">
## <summary>
## The prefix of the X client domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Client domain allowed access.
## </summary>
## </param>
#
template(`xserver_common_x_domain_template',`
gen_require(`
type $1_rootwindow_t, std_xext_t, shmem_xext_t;
type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
type xevent_t, client_xevent_t;
type clipboard_xselection_t, xselection_t;
attribute x_server_domain, x_domain;
attribute xproperty_type;
attribute xevent_type, xextension_type;
attribute $1_x_domain, $1_input_xevent_type;
class x_drawable all_x_drawable_perms;
class x_screen all_x_screen_perms;
class x_gc all_x_gc_perms;
class x_font all_x_font_perms;
class x_colormap all_x_colormap_perms;
class x_property all_x_property_perms;
class x_selection all_x_selection_perms;
class x_cursor all_x_cursor_perms;
class x_client all_x_client_perms;
class x_device all_x_device_perms;
class x_server all_x_server_perms;
class x_extension all_x_extension_perms;
class x_resource all_x_resource_perms;
class x_event all_x_event_perms;
class x_synthetic_event all_x_synthetic_event_perms;
')
##############################
#
# Declarations
#
# Type attributes
typeattribute $3 $1_x_domain, x_domain;
# Types for properties
type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type;
# Types for events
type $2_input_xevent_t, $1_input_xevent_type, xevent_type;
type $2_property_xevent_t, xevent_type;
type $2_focus_xevent_t, xevent_type;
type $2_manage_xevent_t, xevent_type;
type $2_default_xevent_t, xevent_type;
type $2_client_xevent_t, xevent_type;
##############################
#
# Local Policy
#
# Hacks
# everyone can get the input focus of everyone else
# this is a fundamental brokenness in the X protocol
allow $3 { x_domain x_server_domain }:x_device getfocus;
# everyone can grab the server
# everyone does it, it is basically a free DOS attack
allow $3 x_server_domain:x_server grab;
# everyone can get the font path, etc.
# this could leak out sensitive information
allow $3 x_server_domain:x_server getattr;
# everyone can do override-redirect windows.
# this could be used to spoof labels
allow $3 self:x_drawable override;
# everyone can receive management events on the root window
# allows to know when new windows appear, among other things
allow $3 manage_xevent_t:x_event receive;
# X Server
# can read server-owned resources
allow $3 x_server_domain:x_resource read;
# can mess with own clients
allow $3 self:x_client { manage destroy };
# X Protocol Extensions
allow $3 std_xext_t:x_extension { query use };
allow $3 shmem_xext_t:x_extension { query use };
dontaudit $3 xextension_type:x_extension { query use };
# X Properties
# can read and write client properties
allow $3 $2_xproperty_t:x_property { create destroy read write append };
type_transition $3 xproperty_t:x_property $2_xproperty_t;
# can read and write cut buffers
allow $3 clipboard_xproperty_t:x_property { create read write append };
# can read info properties
allow $3 info_xproperty_t:x_property read;
# can change properties of root window
allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
# can change properties of own windows
allow $3 self:x_drawable { list_property get_property set_property };
# X Windows
# operations allowed on root windows
allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive };
# operations allowed on my windows
allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
type_transition $3 $1_rootwindow_t:x_drawable $3;
# X Colormaps
# can use the default colormap
allow $3 $1_rootwindow_t:x_colormap { read use add_color };
# X Input
# can receive own events
allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive;
allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive;
allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive;
allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive;
allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive;
allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive;
type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
type_transition $3 client_xevent_t:x_event $2_client_xevent_t;
type_transition $3 xevent_t:x_event $2_default_xevent_t;
# can receive certain root window events
allow $3 focus_xevent_t:x_event receive;
allow $3 property_xevent_t:x_event receive;
allow $3 client_xevent_t:x_synthetic_event receive;
allow $3 manage_xevent_t:x_synthetic_event receive;
# can send ICCCM events to myself
allow $3 $2_manage_xevent_t:x_synthetic_event send;
# can send ICCCM events to the root window
allow $3 manage_xevent_t:x_synthetic_event send;
allow $3 client_xevent_t:x_synthetic_event send;
# X Selections
# can use the clipboard
allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
# can query all other selections
allow $3 xselection_t:x_selection { getattr read };
# Other X Objects
# can create and use cursors
allow $3 self:x_cursor *;
# can create and use graphics contexts
allow $3 self:x_gc *;
# can create and use colormaps
allow $3 self:x_colormap *;
# can read and write own objects
allow $3 self:x_resource { read write };
tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined($3),
# but typeattribute doesnt work in conditionals
gen_require(`
attribute x_server_domain, x_domain;
attribute xproperty_type, xselection_type;
attribute xextension_type, xevent_type;
attribute rootwindow_type;
type remote_xclient_t;
')
allow $3 x_server_domain:x_server *;
allow $3 { x_domain rootwindow_type }:x_drawable *;
allow $3 x_server_domain:x_screen *;
allow $3 x_domain:x_gc *;
allow $3 { x_domain rootwindow_type }:x_colormap *;
allow $3 xproperty_type:x_property *;
allow $3 xselection_type:x_selection *;
allow $3 x_domain:x_cursor *;
allow $3 { x_domain remote_xclient_t }:x_client *;
allow $3 { x_domain x_server_domain }:x_device *;
allow $3 xextension_type:x_extension *;
allow $3 { x_domain x_server_domain }:x_resource *;
allow $3 xevent_type:{ x_event x_synthetic_event } *;
')
')
#######################################
## <summary>
## Interface to provide X object permissions on a given X server to
## an X client domain. Provides the minimal set required by a basic
## X client application.
## </summary>
## <param name="user">
## <summary>
## The prefix of the X server domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="prefix">
## <summary>
## The prefix of the X client domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="domain">
## <summary>
## Client domain allowed access.
## </summary>
## </param>
## <param name="tmpfs_type">
## <summary>
## The type of the domain SYSV tmpfs files.
## </summary>
## </param>
#
template(`xserver_user_x_domain_template',`
gen_require(`
type xdm_t, xdm_tmp_t;
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
')
allow $3 self:shm create_shm_perms;
allow $3 self:unix_dgram_socket create_socket_perms;
allow $3 self:unix_stream_socket { connectto create_stream_socket_perms };
# Read .Xauthority file
allow $3 $1_xauth_home_t:file { getattr read };
allow $3 $1_iceauth_home_t:file { getattr read };
# for when /tmp/.X11-unix is created by the system
allow $3 xdm_t:fd use;
allow $3 xdm_t:fifo_file { getattr read write ioctl };
allow $3 xdm_tmp_t:dir search;
allow $3 xdm_tmp_t:sock_file { read write };
dontaudit $3 xdm_t:tcp_socket { read write };
# Allow connections to X server.
files_search_tmp($3)
miscfiles_read_fonts($3)
userdom_search_user_home_dirs($1,$3)
# for .xsession-errors
userdom_dontaudit_write_user_home_content_files($1,$3)
xserver_ro_session_template(xdm,$3,$4)
xserver_rw_session_template($1,$3,$4)
xserver_use_user_fonts($1,$3)
xserver_read_xdm_tmp_files($3)
# X object manager
xserver_common_x_domain_template($1,$2,$3)
# Client write xserver shm
tunable_policy(`allow_write_xshm',`
allow $3 $1_xserver_t:shm rw_shm_perms;
allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
')
')
########################################
## <summary>
## Read user fonts, user font configuration,
@ -1312,3 +1671,23 @@ interface(`xserver_stream_connect_xdm_xserver',`
files_search_tmp($1)
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
')
########################################
## <summary>
## Interface to provide X object permissions on a given X server to
## an X client domain. Gives the domain complete control over the
## display.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`xserver_unconfined',`
gen_require(`
attribute xserver_unconfined_type;
')
typeattribute $1 xserver_unconfined_type;
')

View File

@ -1,5 +1,5 @@
policy_module(xserver,1.7.0)
policy_module(xserver,2.0.0)
########################################
#
@ -21,14 +21,58 @@ gen_tunable(allow_write_xshm,false)
## </desc>
gen_tunable(xdm_sysadm_login,false)
## <desc>
## <p>
## Support X userspace object manager
## </p>
## </desc>
gen_tunable(xserver_object_manager,false)
attribute fonts_type;
attribute fonts_cache_type;
attribute fonts_config_type;
attribute xauth_home_type;
# Domains
attribute xserver_unconfined_type;
attribute x_server_domain;
# Per-object attributes
attribute rootwindow_type;
attribute x_domain;
attribute xproperty_type;
attribute xselection_type;
attribute xextension_type;
attribute xevent_type;
type accelgraphics_xext_t, xextension_type;
type client_xevent_t, xevent_type;
type clipboard_xproperty_t, xproperty_type;
type clipboard_xselection_t, xselection_type;
type debug_xext_t, xextension_type;
type directhw_xext_t alias disallowed_xext_t, xextension_type;
type focus_xevent_t, xevent_type;
type iceauth_exec_t;
application_executable_file(iceauth_exec_t)
type info_xproperty_t, xproperty_type;
type input_xevent_t, xevent_type;
type manage_xevent_t, xevent_type;
type output_xext_t, xextension_type;
type property_xevent_t, xevent_type;
type remote_xclient_t;
type screensaver_xext_t, xextension_type;
type security_xext_t, xextension_type;
type shmem_xext_t, xextension_type;
type std_xext_t, xextension_type;
type video_xext_t, xextension_type;
type unknown_xevent_t, xevent_type;
type xevent_t alias default_xevent_t, xevent_type;
type xext_t alias unknown_xext_t, xextension_type;
type xproperty_t alias default_xproperty_t, xproperty_type;
type xselection_t alias default_xselection_t, xselection_type;
type xauth_exec_t;
application_executable_file(xauth_exec_t)
@ -79,6 +123,7 @@ type xserver_log_t;
logging_log_file(xserver_log_t)
xserver_common_domain_template(xdm)
xserver_common_x_domain_template(xdm,xdm,xdm_t)
init_system_domain(xdm_xserver_t,xserver_exec_t)
ifdef(`enable_mcs',`
@ -272,6 +317,7 @@ userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
xserver_unconfined(xdm_t)
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xdm_t)
@ -441,6 +487,25 @@ optional_policy(`
')
')
########################################
#
# Rules for unconfined access to this module
#
allow xserver_unconfined_type x_server_domain:x_server *;
allow xserver_unconfined_type { x_domain rootwindow_type }:x_drawable *;
allow xserver_unconfined_type x_server_domain:x_screen *;
allow xserver_unconfined_type x_domain:x_gc *;
allow xserver_unconfined_type { x_domain rootwindow_type }:x_colormap *;
allow xserver_unconfined_type xproperty_type:x_property *;
allow xserver_unconfined_type xselection_type:x_selection *;
allow xserver_unconfined_type x_domain:x_cursor *;
allow xserver_unconfined_type { x_domain remote_xclient_t }:x_client *;
allow xserver_unconfined_type { x_domain x_server_domain }:x_device *;
allow xserver_unconfined_type xextension_type:x_extension *;
allow xserver_unconfined_type { x_domain x_server_domain }:x_resource *;
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
ifdef(`TODO',`
# Need to further investigate these permissions and
# perhaps define derived types.

View File

@ -95,6 +95,10 @@ interface(`unconfined_domain_noaudit',`
optional_policy(`
storage_unconfined($1)
')
optional_policy(`
xserver_unconfined($1)
')
')
########################################

View File

@ -1,5 +1,5 @@
policy_module(unconfined,2.1.0)
policy_module(unconfined,2.1.1)
########################################
#

View File

@ -74,6 +74,7 @@ make NAME=%{polname2} TYPE=%{type2} DISTRO=%{distro} DIRECT_INITRC=%{direct_init
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/x_contexts
%dir %{_sysconfdir}/selinux/*/contexts/files
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template
@ -117,6 +118,7 @@ SELinux Reference policy targeted base module.
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/x_contexts
%dir %{_sysconfdir}/selinux/%{polname1}/contexts/files
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template
@ -162,6 +164,7 @@ SELinux Reference policy strict base module.
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/x_contexts
%dir %{_sysconfdir}/selinux/%{polname2}/contexts/files
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template