trunk: add core xselinux support.
This commit is contained in:
Chris PeBenito
parent
e828954c63
commit
2c12b471ad
@ -1,3 +1,4 @@
|
||||
- Add core Security Enhanced X Windows support.
|
||||
- Fix winbind socket connection interface for default location of the
|
||||
sock_file.
|
||||
- Add wireshark module based on ethereal module.
|
||||
|
||||
2
Makefile
2
Makefile
@ -236,7 +236,7 @@ seusers := $(appconf)/seusers
|
||||
appdir := $(contextpath)
|
||||
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
|
||||
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
|
||||
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
|
||||
appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
|
||||
net_contexts := $(builddir)net_contexts
|
||||
|
||||
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
|
||||
|
||||
194
config/appconfig-mcs/x_contexts
Normal file
194
config/appconfig-mcs/x_contexts
Normal file
@ -0,0 +1,194 @@
|
||||
#
|
||||
# Config file for XSELinux extension
|
||||
#
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Clients
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# The default client rule defines a context to be used for all clients
|
||||
# connecting to the server from a remote host.
|
||||
#
|
||||
client * system_u:object_r:remote_xclient_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Properties
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Property rules map a property name to a context. A default property
|
||||
# rule indicated by an asterisk should follow all other property rules.
|
||||
#
|
||||
# Properties that normal clients may only read
|
||||
property XFree86_VT system_u:object_r:info_xproperty_t:s0
|
||||
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
|
||||
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
|
||||
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
|
||||
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
|
||||
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
|
||||
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
|
||||
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
|
||||
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
|
||||
|
||||
# Clipboard and selection properties
|
||||
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
|
||||
|
||||
# Default fallback type
|
||||
property * system_u:object_r:xproperty_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Extensions
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Extension rules map an extension name to a context. A default extension
|
||||
# rule indicated by an asterisk should follow all other extension rules.
|
||||
#
|
||||
# Standard extensions
|
||||
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
|
||||
extension SHAPE system_u:object_r:std_xext_t:s0
|
||||
extension SYNC system_u:object_r:std_xext_t:s0
|
||||
extension XC-MISC system_u:object_r:std_xext_t:s0
|
||||
extension XFIXES system_u:object_r:std_xext_t:s0
|
||||
extension XInputExtension system_u:object_r:std_xext_t:s0
|
||||
extension XKEYBOARD system_u:object_r:std_xext_t:s0
|
||||
extension DAMAGE system_u:object_r:std_xext_t:s0
|
||||
extension RENDER system_u:object_r:std_xext_t:s0
|
||||
extension XINERAMA system_u:object_r:std_xext_t:s0
|
||||
|
||||
# Direct hardware access extensions
|
||||
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
|
||||
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
|
||||
|
||||
# Screen management and multihead extensions
|
||||
extension RANDR system_u:object_r:output_xext_t:s0
|
||||
extension Composite system_u:object_r:output_xext_t:s0
|
||||
|
||||
# Screensaver, power management extensions
|
||||
extension DPMS system_u:object_r:screensaver_xext_t:s0
|
||||
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
|
||||
|
||||
# Shared memory extensions
|
||||
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
|
||||
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
|
||||
|
||||
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||
extension GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
|
||||
# Debugging, testing, and recording extensions
|
||||
extension RECORD system_u:object_r:debug_xext_t:s0
|
||||
extension X-Resource system_u:object_r:debug_xext_t:s0
|
||||
extension XTEST system_u:object_r:debug_xext_t:s0
|
||||
|
||||
# Security-related extensions
|
||||
extension SECURITY system_u:object_r:security_xext_t:s0
|
||||
extension SELinux system_u:object_r:security_xext_t:s0
|
||||
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
|
||||
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
|
||||
|
||||
# Video extensions
|
||||
extension XVideo system_u:object_r:video_xext_t:s0
|
||||
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
|
||||
|
||||
# Default fallback type
|
||||
extension * system_u:object_r:xext_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Selections
|
||||
##
|
||||
#
|
||||
|
||||
# Selection rules map a selection name to a context. A default selection
|
||||
# rule indicated by an asterisk should follow all other selection rules.
|
||||
#
|
||||
# Standard selections
|
||||
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
|
||||
|
||||
# Default fallback type
|
||||
selection * system_u:object_r:xselection_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Events
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Event rules map an event protocol name to a context. A default event
|
||||
# rule indicated by an asterisk should follow all other event rules.
|
||||
#
|
||||
# Input events
|
||||
event X11:KeyPress system_u:object_r:input_xevent_t:s0
|
||||
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
|
||||
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
|
||||
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
|
||||
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
|
||||
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
|
||||
|
||||
# Focus events
|
||||
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
|
||||
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
|
||||
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
|
||||
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
|
||||
|
||||
# Property events
|
||||
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
|
||||
|
||||
# Client message events
|
||||
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
|
||||
|
||||
# Manager events
|
||||
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:Expose system_u:object_r:manage_xevent_t:s0
|
||||
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
|
||||
|
||||
# Unknown events (that are not registered in the X server's name database)
|
||||
event <unknown> system_u:object_r:unknown_xevent_t:s0
|
||||
|
||||
# Default fallback type
|
||||
event * system_u:object_r:xevent_t:s0
|
||||
194
config/appconfig-mls/x_contexts
Normal file
194
config/appconfig-mls/x_contexts
Normal file
@ -0,0 +1,194 @@
|
||||
#
|
||||
# Config file for XSELinux extension
|
||||
#
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Clients
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# The default client rule defines a context to be used for all clients
|
||||
# connecting to the server from a remote host.
|
||||
#
|
||||
client * system_u:object_r:remote_xclient_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Properties
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Property rules map a property name to a context. A default property
|
||||
# rule indicated by an asterisk should follow all other property rules.
|
||||
#
|
||||
# Properties that normal clients may only read
|
||||
property XFree86_VT system_u:object_r:info_xproperty_t:s0
|
||||
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
|
||||
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
|
||||
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
|
||||
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
|
||||
property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
|
||||
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
|
||||
property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
|
||||
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
|
||||
|
||||
# Clipboard and selection properties
|
||||
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
|
||||
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
|
||||
|
||||
# Default fallback type
|
||||
property * system_u:object_r:xproperty_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Extensions
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Extension rules map an extension name to a context. A default extension
|
||||
# rule indicated by an asterisk should follow all other extension rules.
|
||||
#
|
||||
# Standard extensions
|
||||
extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
|
||||
extension SHAPE system_u:object_r:std_xext_t:s0
|
||||
extension SYNC system_u:object_r:std_xext_t:s0
|
||||
extension XC-MISC system_u:object_r:std_xext_t:s0
|
||||
extension XFIXES system_u:object_r:std_xext_t:s0
|
||||
extension XInputExtension system_u:object_r:std_xext_t:s0
|
||||
extension XKEYBOARD system_u:object_r:std_xext_t:s0
|
||||
extension DAMAGE system_u:object_r:std_xext_t:s0
|
||||
extension RENDER system_u:object_r:std_xext_t:s0
|
||||
extension XINERAMA system_u:object_r:std_xext_t:s0
|
||||
|
||||
# Direct hardware access extensions
|
||||
extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
|
||||
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
|
||||
|
||||
# Screen management and multihead extensions
|
||||
extension RANDR system_u:object_r:output_xext_t:s0
|
||||
extension Composite system_u:object_r:output_xext_t:s0
|
||||
|
||||
# Screensaver, power management extensions
|
||||
extension DPMS system_u:object_r:screensaver_xext_t:s0
|
||||
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
|
||||
|
||||
# Shared memory extensions
|
||||
extension MIT-SHM system_u:object_r:shmem_xext_t:s0
|
||||
extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
|
||||
|
||||
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||
extension GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
|
||||
|
||||
# Debugging, testing, and recording extensions
|
||||
extension RECORD system_u:object_r:debug_xext_t:s0
|
||||
extension X-Resource system_u:object_r:debug_xext_t:s0
|
||||
extension XTEST system_u:object_r:debug_xext_t:s0
|
||||
|
||||
# Security-related extensions
|
||||
extension SECURITY system_u:object_r:security_xext_t:s0
|
||||
extension SELinux system_u:object_r:security_xext_t:s0
|
||||
extension XAccessControlExtension system_u:object_r:security_xext_t:s0
|
||||
extension XC-APPGROUP system_u:object_r:security_xext_t:s0
|
||||
|
||||
# Video extensions
|
||||
extension XVideo system_u:object_r:video_xext_t:s0
|
||||
extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
|
||||
|
||||
# Default fallback type
|
||||
extension * system_u:object_r:xext_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Selections
|
||||
##
|
||||
#
|
||||
|
||||
# Selection rules map a selection name to a context. A default selection
|
||||
# rule indicated by an asterisk should follow all other selection rules.
|
||||
#
|
||||
# Standard selections
|
||||
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
|
||||
selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
|
||||
|
||||
# Default fallback type
|
||||
selection * system_u:object_r:xselection_t:s0
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Events
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Event rules map an event protocol name to a context. A default event
|
||||
# rule indicated by an asterisk should follow all other event rules.
|
||||
#
|
||||
# Input events
|
||||
event X11:KeyPress system_u:object_r:input_xevent_t:s0
|
||||
event X11:KeyRelease system_u:object_r:input_xevent_t:s0
|
||||
event X11:ButtonPress system_u:object_r:input_xevent_t:s0
|
||||
event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
|
||||
event X11:MotionNotify system_u:object_r:input_xevent_t:s0
|
||||
event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
|
||||
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
|
||||
|
||||
# Focus events
|
||||
event X11:FocusIn system_u:object_r:focus_xevent_t:s0
|
||||
event X11:FocusOut system_u:object_r:focus_xevent_t:s0
|
||||
event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
|
||||
event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
|
||||
|
||||
# Property events
|
||||
event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
|
||||
|
||||
# Client message events
|
||||
event X11:ClientMessage system_u:object_r:client_xevent_t:s0
|
||||
|
||||
# Manager events
|
||||
event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:MapRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:MapNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
|
||||
event X11:Expose system_u:object_r:manage_xevent_t:s0
|
||||
event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
|
||||
|
||||
# Unknown events (that are not registered in the X server's name database)
|
||||
event <unknown> system_u:object_r:unknown_xevent_t:s0
|
||||
|
||||
# Default fallback type
|
||||
event * system_u:object_r:xevent_t:s0
|
||||
194
config/appconfig-standard/x_contexts
Normal file
194
config/appconfig-standard/x_contexts
Normal file
@ -0,0 +1,194 @@
|
||||
#
|
||||
# Config file for XSELinux extension
|
||||
#
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Clients
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# The default client rule defines a context to be used for all clients
|
||||
# connecting to the server from a remote host.
|
||||
#
|
||||
client * system_u:object_r:remote_xclient_t
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Properties
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Property rules map a property name to a context. A default property
|
||||
# rule indicated by an asterisk should follow all other property rules.
|
||||
#
|
||||
# Properties that normal clients may only read
|
||||
property XFree86_VT system_u:object_r:info_xproperty_t
|
||||
property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t
|
||||
property RESOURCE_MANAGER system_u:object_r:info_xproperty_t
|
||||
property SCREEN_RESOURCES system_u:object_r:info_xproperty_t
|
||||
property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t
|
||||
property AT_SPI_IOR system_u:object_r:info_xproperty_t
|
||||
property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t
|
||||
property _NET_WORKAREA system_u:object_r:info_xproperty_t
|
||||
property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t
|
||||
|
||||
# Clipboard and selection properties
|
||||
property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t
|
||||
property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t
|
||||
|
||||
# Default fallback type
|
||||
property * system_u:object_r:xproperty_t
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Extensions
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Extension rules map an extension name to a context. A default extension
|
||||
# rule indicated by an asterisk should follow all other extension rules.
|
||||
#
|
||||
# Standard extensions
|
||||
extension BIG-REQUESTS system_u:object_r:std_xext_t
|
||||
extension SHAPE system_u:object_r:std_xext_t
|
||||
extension SYNC system_u:object_r:std_xext_t
|
||||
extension XC-MISC system_u:object_r:std_xext_t
|
||||
extension XFIXES system_u:object_r:std_xext_t
|
||||
extension XInputExtension system_u:object_r:std_xext_t
|
||||
extension XKEYBOARD system_u:object_r:std_xext_t
|
||||
extension DAMAGE system_u:object_r:std_xext_t
|
||||
extension RENDER system_u:object_r:std_xext_t
|
||||
extension XINERAMA system_u:object_r:std_xext_t
|
||||
|
||||
# Direct hardware access extensions
|
||||
extension XFree86-DGA system_u:object_r:directhw_xext_t
|
||||
extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t
|
||||
|
||||
# Screen management and multihead extensions
|
||||
extension RANDR system_u:object_r:output_xext_t
|
||||
extension Composite system_u:object_r:output_xext_t
|
||||
|
||||
# Screensaver, power management extensions
|
||||
extension DPMS system_u:object_r:screensaver_xext_t
|
||||
extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t
|
||||
|
||||
# Shared memory extensions
|
||||
extension MIT-SHM system_u:object_r:shmem_xext_t
|
||||
extension XFree86-Bigfont system_u:object_r:shmem_xext_t
|
||||
|
||||
# Accelerated graphics, OpenGL, direct rendering extensions
|
||||
extension GLX system_u:object_r:accelgraphics_xext_t
|
||||
extension NV-CONTROL system_u:object_r:accelgraphics_xext_t
|
||||
extension NV-GLX system_u:object_r:accelgraphics_xext_t
|
||||
extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t
|
||||
|
||||
# Debugging, testing, and recording extensions
|
||||
extension RECORD system_u:object_r:debug_xext_t
|
||||
extension X-Resource system_u:object_r:debug_xext_t
|
||||
extension XTEST system_u:object_r:debug_xext_t
|
||||
|
||||
# Security-related extensions
|
||||
extension SECURITY system_u:object_r:security_xext_t
|
||||
extension SELinux system_u:object_r:security_xext_t
|
||||
extension XAccessControlExtension system_u:object_r:security_xext_t
|
||||
extension XC-APPGROUP system_u:object_r:security_xext_t
|
||||
|
||||
# Video extensions
|
||||
extension XVideo system_u:object_r:video_xext_t
|
||||
extension XVideo-MotionCompensation system_u:object_r:video_xext_t
|
||||
|
||||
# Default fallback type
|
||||
extension * system_u:object_r:xext_t
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Selections
|
||||
##
|
||||
#
|
||||
|
||||
# Selection rules map a selection name to a context. A default selection
|
||||
# rule indicated by an asterisk should follow all other selection rules.
|
||||
#
|
||||
# Standard selections
|
||||
selection XA_PRIMARY system_u:object_r:clipboard_xselection_t
|
||||
selection XA_SECONDARY system_u:object_r:clipboard_xselection_t
|
||||
selection PRIMARY system_u:object_r:clipboard_xselection_t
|
||||
selection CLIPBOARD system_u:object_r:clipboard_xselection_t
|
||||
|
||||
# Default fallback type
|
||||
selection * system_u:object_r:xselection_t
|
||||
|
||||
|
||||
#
|
||||
##
|
||||
### Rules for X Events
|
||||
##
|
||||
#
|
||||
|
||||
#
|
||||
# Event rules map an event protocol name to a context. A default event
|
||||
# rule indicated by an asterisk should follow all other event rules.
|
||||
#
|
||||
# Input events
|
||||
event X11:KeyPress system_u:object_r:input_xevent_t
|
||||
event X11:KeyRelease system_u:object_r:input_xevent_t
|
||||
event X11:ButtonPress system_u:object_r:input_xevent_t
|
||||
event X11:ButtonRelease system_u:object_r:input_xevent_t
|
||||
event X11:MotionNotify system_u:object_r:input_xevent_t
|
||||
event X11:SelectionNotify system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t
|
||||
event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t
|
||||
event XInputExtension:ProximityIn system_u:object_r:input_xevent_t
|
||||
event XInputExtension:ProximityOut system_u:object_r:input_xevent_t
|
||||
|
||||
# Focus events
|
||||
event X11:FocusIn system_u:object_r:focus_xevent_t
|
||||
event X11:FocusOut system_u:object_r:focus_xevent_t
|
||||
event X11:EnterNotify system_u:object_r:focus_xevent_t
|
||||
event X11:LeaveNotify system_u:object_r:focus_xevent_t
|
||||
|
||||
# Property events
|
||||
event X11:PropertyNotify system_u:object_r:property_xevent_t
|
||||
|
||||
# Client message events
|
||||
event X11:ClientMessage system_u:object_r:client_xevent_t
|
||||
|
||||
# Manager events
|
||||
event X11:ConfigureRequest system_u:object_r:manage_xevent_t
|
||||
event X11:ResizeRequest system_u:object_r:manage_xevent_t
|
||||
event X11:MapRequest system_u:object_r:manage_xevent_t
|
||||
event X11:CirculateRequest system_u:object_r:manage_xevent_t
|
||||
event X11:CreateNotify system_u:object_r:manage_xevent_t
|
||||
event X11:DestroyNotify system_u:object_r:manage_xevent_t
|
||||
event X11:MapNotify system_u:object_r:manage_xevent_t
|
||||
event X11:UnmapNotify system_u:object_r:manage_xevent_t
|
||||
event X11:ReparentNotify system_u:object_r:manage_xevent_t
|
||||
event X11:ConfigureNotify system_u:object_r:manage_xevent_t
|
||||
event X11:GravityNotify system_u:object_r:manage_xevent_t
|
||||
event X11:CirculateNotify system_u:object_r:manage_xevent_t
|
||||
event X11:Expose system_u:object_r:manage_xevent_t
|
||||
event X11:VisibilityNotify system_u:object_r:manage_xevent_t
|
||||
|
||||
# Unknown events (that are not registered in the X server's name database)
|
||||
event <unknown> system_u:object_r:unknown_xevent_t
|
||||
|
||||
# Default fallback type
|
||||
event * system_u:object_r:xevent_t
|
||||
@ -416,141 +416,160 @@ class passwd
|
||||
#
|
||||
# SE-X Windows stuff
|
||||
#
|
||||
class drawable
|
||||
class x_drawable
|
||||
{
|
||||
create
|
||||
destroy
|
||||
draw
|
||||
copy
|
||||
getattr
|
||||
}
|
||||
|
||||
class gc
|
||||
{
|
||||
create
|
||||
free
|
||||
read
|
||||
write
|
||||
blend
|
||||
getattr
|
||||
setattr
|
||||
list_child
|
||||
add_child
|
||||
remove_child
|
||||
list_property
|
||||
get_property
|
||||
set_property
|
||||
manage
|
||||
override
|
||||
show
|
||||
hide
|
||||
send
|
||||
receive
|
||||
}
|
||||
|
||||
class window
|
||||
class x_screen
|
||||
{
|
||||
getattr
|
||||
setattr
|
||||
hide_cursor
|
||||
show_cursor
|
||||
saver_getattr
|
||||
saver_setattr
|
||||
saver_hide
|
||||
saver_show
|
||||
}
|
||||
|
||||
class x_gc
|
||||
{
|
||||
addchild
|
||||
create
|
||||
destroy
|
||||
map
|
||||
unmap
|
||||
chstack
|
||||
chproplist
|
||||
chprop
|
||||
listprop
|
||||
getattr
|
||||
setattr
|
||||
setfocus
|
||||
move
|
||||
chselection
|
||||
chparent
|
||||
ctrllife
|
||||
enumerate
|
||||
transparent
|
||||
mousemotion
|
||||
clientcomevent
|
||||
inputevent
|
||||
drawevent
|
||||
windowchangeevent
|
||||
windowchangerequest
|
||||
serverchangeevent
|
||||
extensionevent
|
||||
}
|
||||
|
||||
class font
|
||||
{
|
||||
load
|
||||
free
|
||||
getattr
|
||||
use
|
||||
}
|
||||
|
||||
class colormap
|
||||
class x_font
|
||||
{
|
||||
create
|
||||
free
|
||||
install
|
||||
uninstall
|
||||
list
|
||||
read
|
||||
store
|
||||
destroy
|
||||
getattr
|
||||
setattr
|
||||
add_glyph
|
||||
remove_glyph
|
||||
use
|
||||
}
|
||||
|
||||
class property
|
||||
class x_colormap
|
||||
{
|
||||
create
|
||||
free
|
||||
destroy
|
||||
read
|
||||
write
|
||||
getattr
|
||||
add_color
|
||||
remove_color
|
||||
install
|
||||
uninstall
|
||||
use
|
||||
}
|
||||
|
||||
class cursor
|
||||
class x_property
|
||||
{
|
||||
create
|
||||
createglyph
|
||||
free
|
||||
assign
|
||||
setattr
|
||||
}
|
||||
|
||||
class xclient
|
||||
{
|
||||
kill
|
||||
}
|
||||
|
||||
class xinput
|
||||
{
|
||||
lookup
|
||||
destroy
|
||||
read
|
||||
write
|
||||
append
|
||||
getattr
|
||||
setattr
|
||||
}
|
||||
|
||||
class x_selection
|
||||
{
|
||||
read
|
||||
write
|
||||
getattr
|
||||
setattr
|
||||
}
|
||||
|
||||
class x_cursor
|
||||
{
|
||||
create
|
||||
destroy
|
||||
read
|
||||
write
|
||||
getattr
|
||||
setattr
|
||||
use
|
||||
}
|
||||
|
||||
class x_client
|
||||
{
|
||||
destroy
|
||||
getattr
|
||||
setattr
|
||||
manage
|
||||
}
|
||||
|
||||
class x_device
|
||||
{
|
||||
getattr
|
||||
setattr
|
||||
use
|
||||
read
|
||||
write
|
||||
getfocus
|
||||
setfocus
|
||||
warppointer
|
||||
activegrab
|
||||
passivegrab
|
||||
ungrab
|
||||
bell
|
||||
mousemotion
|
||||
relabelinput
|
||||
}
|
||||
|
||||
class xserver
|
||||
{
|
||||
screensaver
|
||||
gethostlist
|
||||
sethostlist
|
||||
getfontpath
|
||||
setfontpath
|
||||
getattr
|
||||
force_cursor
|
||||
freeze
|
||||
grab
|
||||
ungrab
|
||||
manage
|
||||
}
|
||||
|
||||
class xextension
|
||||
class x_server
|
||||
{
|
||||
getattr
|
||||
setattr
|
||||
record
|
||||
debug
|
||||
grab
|
||||
manage
|
||||
}
|
||||
|
||||
class x_extension
|
||||
{
|
||||
query
|
||||
use
|
||||
}
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for controlling
|
||||
# PaX flags
|
||||
#
|
||||
class pax
|
||||
class x_resource
|
||||
{
|
||||
pageexec # Paging based non-executable pages
|
||||
emutramp # Emulate trampolines
|
||||
mprotect # Restrict mprotect()
|
||||
randmmap # Randomize mmap() base
|
||||
randexec # Randomize ET_EXEC base
|
||||
segmexec # Segmentation based non-executable pages
|
||||
read
|
||||
write
|
||||
}
|
||||
|
||||
class x_event
|
||||
{
|
||||
send
|
||||
receive
|
||||
}
|
||||
|
||||
class x_synthetic_event
|
||||
{
|
||||
send
|
||||
receive
|
||||
}
|
||||
|
||||
#
|
||||
|
||||
@ -50,21 +50,19 @@ class ipc
|
||||
# passwd/chfn/chsh
|
||||
class passwd # userspace
|
||||
|
||||
# SE-X Windows stuff
|
||||
class drawable # userspace
|
||||
class window # userspace
|
||||
class gc # userspace
|
||||
class font # userspace
|
||||
class colormap # userspace
|
||||
class property # userspace
|
||||
class cursor # userspace
|
||||
class xclient # userspace
|
||||
class xinput # userspace
|
||||
class xserver # userspace
|
||||
class xextension # userspace
|
||||
|
||||
# pax flags; deprecated--can be reclaimed
|
||||
class pax # userspace
|
||||
# SE-X Windows stuff (more classes below)
|
||||
class x_drawable # userspace
|
||||
class x_screen # userspace
|
||||
class x_gc # userspace
|
||||
class x_font # userspace
|
||||
class x_colormap # userspace
|
||||
class x_property # userspace
|
||||
class x_selection # userspace
|
||||
class x_cursor # userspace
|
||||
class x_client # userspace
|
||||
class x_device # userspace
|
||||
class x_server # userspace
|
||||
class x_extension # userspace
|
||||
|
||||
# extended netlink sockets
|
||||
class netlink_route_socket
|
||||
@ -112,4 +110,9 @@ class peer
|
||||
# Capabilities >= 32
|
||||
class capability2
|
||||
|
||||
# More SE-X Windows stuff
|
||||
class x_resource # userspace
|
||||
class x_event # userspace
|
||||
class x_synthetic_event # userspace
|
||||
|
||||
# FLASK
|
||||
|
||||
199
policy/mls
199
policy/mls
@ -371,78 +371,53 @@ mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec se
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the drawable class
|
||||
# MLS policy for the x_drawable class
|
||||
#
|
||||
|
||||
# the drawable "read" ops (implicit single level)
|
||||
mlsconstrain drawable { getattr copy }
|
||||
# the x_drawable "read" ops (implicit single level)
|
||||
mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the drawable "write" ops (implicit single level)
|
||||
mlsconstrain drawable { create destroy draw copy }
|
||||
# the x_drawable "write" ops (implicit single level)
|
||||
mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
# No MLS restrictions: x_drawable { show hide override }
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the x_gc class
|
||||
#
|
||||
|
||||
# the x_gc "read" ops (implicit single level)
|
||||
mlsconstrain x_gc { getattr use }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the x_gc "write" ops (implicit single level)
|
||||
mlsconstrain x_gc { create destroy setattr }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the gc class
|
||||
# MLS policy for the x_font class
|
||||
#
|
||||
|
||||
# the gc "read" ops (implicit single level)
|
||||
mlsconstrain gc getattr
|
||||
# the x_font "read" ops (implicit single level)
|
||||
mlsconstrain x_font { use }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the gc "write" ops (implicit single level)
|
||||
mlsconstrain gc { create free setattr }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the window class
|
||||
#
|
||||
|
||||
# the window "read" ops (implicit single level)
|
||||
mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the window "write" ops (implicit single level)
|
||||
mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ) or
|
||||
( t2 == mlstrustedobject ));
|
||||
|
||||
# these access vectors have no MLS restrictions
|
||||
# window { map unmap }
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the font class
|
||||
#
|
||||
|
||||
# the font "read" ops (implicit single level)
|
||||
mlsconstrain font { load getattr }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the font "write" ops (implicit single level)
|
||||
mlsconstrain font free
|
||||
# the x_font "write" ops (implicit single level)
|
||||
mlsconstrain x_font { create destroy add_glyph remove_glyph }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
@ -451,109 +426,147 @@ mlsconstrain font free
|
||||
# font use
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the colormap class
|
||||
# MLS policy for the x_colormap class
|
||||
#
|
||||
|
||||
# the colormap "read" ops (implicit single level)
|
||||
mlsconstrain colormap { list read getattr }
|
||||
# the x_colormap "read" ops (implicit single level)
|
||||
mlsconstrain x_colormap { read getattr use }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinreadcolormap ) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the colormap "write" ops (implicit single level)
|
||||
mlsconstrain colormap { create free install uninstall store setattr }
|
||||
# the x_colormap "write" ops (implicit single level)
|
||||
mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwritecolormap ) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the property class
|
||||
# MLS policy for the x_property class
|
||||
#
|
||||
|
||||
# the property "read" ops (implicit single level)
|
||||
mlsconstrain property { read }
|
||||
# the x_property "read" ops (implicit single level)
|
||||
mlsconstrain x_property { read getattr }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinreadproperty ) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the property "write" ops (implicit single level)
|
||||
mlsconstrain property { create free write }
|
||||
# the x_property "write" ops (implicit single level)
|
||||
mlsconstrain x_property { create destroy write append setattr }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwriteproperty ) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the cursor class
|
||||
# MLS policy for the x_cursor class
|
||||
#
|
||||
|
||||
# the cursor "write" ops (implicit single level)
|
||||
mlsconstrain cursor { create createglyph free assign setattr }
|
||||
# the x_cursor "read" ops (implicit single level)
|
||||
mlsconstrain x_cursor { read getattr use }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the x_cursor "write" ops (implicit single level)
|
||||
mlsconstrain x_cursor { create destroy write setattr }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the xclient class
|
||||
# MLS policy for the x_client class
|
||||
#
|
||||
|
||||
# the xclient "write" ops (implicit single level)
|
||||
mlsconstrain xclient kill
|
||||
# the x_client "read" ops (implicit single level)
|
||||
mlsconstrain x_client { getattr }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the x_client "write" ops (implicit single level)
|
||||
mlsconstrain x_client { destroy setattr manage }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the xinput class
|
||||
# MLS policy for the x_device class
|
||||
#
|
||||
|
||||
# these access vectors have no MLS restrictions
|
||||
# xinput ~{ relabelinput setattr }
|
||||
# the x_device "read" ops (implicit single level)
|
||||
mlsconstrain x_device { getattr use read getfocus grab }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the xinput "write" ops (implicit single level)
|
||||
mlsconstrain xinput { setattr relabelinput }
|
||||
# the x_device "write" ops (implicit single level)
|
||||
mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwritexinput ) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the xserver class
|
||||
# MLS policy for the x_server class
|
||||
#
|
||||
|
||||
# these access vectors have no MLS restrictions
|
||||
# xserver *
|
||||
|
||||
|
||||
# x_server *
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the xextension class
|
||||
# MLS policy for the x_extension class
|
||||
#
|
||||
|
||||
# these access vectors have no MLS restrictions
|
||||
# xextension { query use }
|
||||
# x_extension { query use }
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the x_resource class
|
||||
#
|
||||
|
||||
# the x_resource "read" ops (implicit single level)
|
||||
mlsconstrain x_resource { read }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the x_resource "write" ops (implicit single level)
|
||||
mlsconstrain x_resource { write }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwritexinput ) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
#
|
||||
# MLS policy for the x_event class
|
||||
#
|
||||
|
||||
# the x_event "read" ops (implicit single level)
|
||||
mlsconstrain x_event { receive }
|
||||
(( l1 dom l2 ) or
|
||||
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
|
||||
( t1 == mlsxwinread ));
|
||||
|
||||
# the x_event "write" ops (implicit single level)
|
||||
mlsconstrain x_event { send }
|
||||
(( l1 eq l2 ) or
|
||||
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
|
||||
( t1 == mlsxwinwritexinput ) or
|
||||
( t1 == mlsxwinwrite ));
|
||||
|
||||
|
||||
|
||||
#
|
||||
|
||||
@ -159,7 +159,7 @@ template(`ethereal_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_ethereal_t,$1_ethereal_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t)
|
||||
xserver_create_xdm_tmp_sockets($1_ethereal_t)
|
||||
')
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(ethereal,1.4.0)
|
||||
policy_module(ethereal,1.4.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -247,7 +247,7 @@ template(`evolution_per_role_template',`
|
||||
|
||||
mta_read_config($1_evolution_t)
|
||||
|
||||
xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t)
|
||||
xserver_read_xdm_tmp_files($1_evolution_t)
|
||||
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
@ -513,7 +513,7 @@ template(`evolution_per_role_template',`
|
||||
# until properly implemented
|
||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
|
||||
|
||||
xserver_user_client_template($1,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
|
||||
|
||||
# Access evolution home
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
@ -615,7 +615,7 @@ template(`evolution_per_role_template',`
|
||||
# until properly implemented
|
||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
|
||||
|
||||
xserver_user_client_template($1,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
|
||||
|
||||
# Access evolution home
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
@ -776,7 +776,7 @@ template(`evolution_per_role_template',`
|
||||
# until properly implemented
|
||||
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
|
||||
|
||||
xserver_user_client_template($1,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
|
||||
|
||||
optional_policy(`
|
||||
nscd_socket_use($1_evolution_webcal_t)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(evolution,1.5.0)
|
||||
policy_module(evolution,1.5.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -146,7 +146,7 @@ template(`games_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_games_t,$1_games_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t)
|
||||
xserver_create_xdm_tmp_sockets($1_games_t)
|
||||
xserver_read_xdm_lib_files($1_games_t)
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(games,1.5.0)
|
||||
policy_module(games,1.5.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -130,7 +130,7 @@ template(`gift_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_gift_t,$1_gift_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t)
|
||||
')
|
||||
|
||||
##############################
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(gift,1.3.0)
|
||||
policy_module(gift,1.3.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -164,7 +164,7 @@ template(`java_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
|
||||
')
|
||||
')
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(java,1.7.0)
|
||||
policy_module(java,1.7.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -191,7 +191,7 @@ template(`mozilla_per_role_template',`
|
||||
userdom_manage_user_tmp_files($1,$1_mozilla_t)
|
||||
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
|
||||
|
||||
xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t)
|
||||
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
|
||||
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(mozilla,1.5.0)
|
||||
policy_module(mozilla,1.5.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -342,7 +342,7 @@ template(`mplayer_per_role_template',`
|
||||
userdom_read_user_home_content_files($1,$1_mplayer_t)
|
||||
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
|
||||
|
||||
xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t)
|
||||
|
||||
# Read songs
|
||||
ifdef(`enable_mls',`',`
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(mplayer,1.4.0)
|
||||
policy_module(mplayer,1.4.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -160,7 +160,7 @@ template(`thunderbird_per_role_template',`
|
||||
# .kde/....gtkrc
|
||||
userdom_read_user_home_content_files($1,$1_thunderbird_t)
|
||||
|
||||
xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_thunderbird,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
|
||||
xserver_read_xdm_tmp_files($1_thunderbird_t)
|
||||
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(thunderbird,1.5.0)
|
||||
policy_module(thunderbird,1.5.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -134,6 +134,6 @@ template(`tvtime_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_tvtime_t,$1_tvtime_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_tvtime,$1_tvtime_t,$1_tvtime_tmpfs_t)
|
||||
')
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(tvtime,1.3.0)
|
||||
policy_module(tvtime,1.3.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -164,7 +164,7 @@ template(`vmware_per_role_template',`
|
||||
sysnet_dns_name_resolve($1_vmware_t)
|
||||
sysnet_read_config($1_vmware_t)
|
||||
|
||||
xserver_user_client_template($1,$1_vmware_t,$1_vmware_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_vmware,$1_vmware_t,$1_vmware_tmpfs_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(vmware,1.4.0)
|
||||
policy_module(vmware,1.4.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -609,6 +609,26 @@ interface(`mls_process_set_level',`
|
||||
typeattribute $1 mlsprocsetsl;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Make specified domain MLS trusted
|
||||
## for reading from X objects up to its clearance.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`mls_xwin_read_to_clearance',`
|
||||
gen_require(`
|
||||
attribute mlsxwinreadtoclr;
|
||||
')
|
||||
|
||||
typeattribute $1 mlsxwinreadtoclr;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Make specified domain MLS trusted
|
||||
@ -629,6 +649,26 @@ interface(`mls_xwin_read_all_levels',`
|
||||
typeattribute $1 mlsxwinread;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Make specified domain MLS trusted
|
||||
## for write to X objects up to its clearance.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <rolecap/>
|
||||
#
|
||||
interface(`mls_xwin_write_to_clearance',`
|
||||
gen_require(`
|
||||
attribute mlsxwinwritetoclr;
|
||||
')
|
||||
|
||||
typeattribute $1 mlsxwinwritetoclr;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Make specified domain MLS trusted
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(mls,1.6.1)
|
||||
policy_module(mls,1.6.2)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -107,7 +107,7 @@ template(`bluetooth_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
|
||||
xserver_user_x_domain_template($1, $1_bluetooth, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
|
||||
')
|
||||
')
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(bluetooth,2.0.0)
|
||||
policy_module(bluetooth,2.0.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -282,7 +282,7 @@ template(`ssh_per_role_template',`
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_user_client_template($1,$1_ssh_t,$1_ssh_tmpfs_t)
|
||||
xserver_user_x_domain_template($1,$1_ssh,$1_ssh_t,$1_ssh_tmpfs_t)
|
||||
xserver_domtrans_user_xauth($1,$1_ssh_t)
|
||||
')
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(ssh,1.9.0)
|
||||
policy_module(ssh,1.9.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -15,6 +15,11 @@
|
||||
template(`xserver_common_domain_template',`
|
||||
gen_require(`
|
||||
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
|
||||
|
||||
attribute x_server_domain;
|
||||
class x_drawable all_x_drawable_perms;
|
||||
class x_colormap all_x_colormap_perms;
|
||||
class x_screen all_x_screen_perms;
|
||||
')
|
||||
|
||||
##############################
|
||||
@ -22,7 +27,12 @@ template(`xserver_common_domain_template',`
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type $1_xserver_t;
|
||||
attribute $1_x_domain;
|
||||
attribute $1_input_xevent_type;
|
||||
|
||||
type $1_rootwindow_t, rootwindow_type;
|
||||
|
||||
type $1_xserver_t, x_server_domain;
|
||||
domain_type($1_xserver_t)
|
||||
domain_entry_file($1_xserver_t,xserver_exec_t)
|
||||
|
||||
@ -83,6 +93,9 @@ template(`xserver_common_domain_template',`
|
||||
manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t)
|
||||
logging_log_filetrans($1_xserver_t,xserver_log_t,file)
|
||||
|
||||
# Labeling rules for default windows and colormaps
|
||||
type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t;
|
||||
|
||||
kernel_read_system_state($1_xserver_t)
|
||||
kernel_read_device_sysctls($1_xserver_t)
|
||||
kernel_read_modprobe_sysctls($1_xserver_t)
|
||||
@ -142,6 +155,10 @@ template(`xserver_common_domain_template',`
|
||||
fs_search_auto_mountpoints($1_xserver_t)
|
||||
fs_search_ramfs($1_xserver_t)
|
||||
|
||||
selinux_validate_context($1_xserver_t)
|
||||
selinux_compute_access_vector($1_xserver_t)
|
||||
selinux_compute_create_context($1_xserver_t)
|
||||
|
||||
auth_use_nsswitch($1_xserver_t)
|
||||
|
||||
init_getpgid($1_xserver_t)
|
||||
@ -153,13 +170,15 @@ template(`xserver_common_domain_template',`
|
||||
libs_use_shared_libs($1_xserver_t)
|
||||
|
||||
logging_send_syslog_msg($1_xserver_t)
|
||||
logging_send_audit_msgs($1_xserver_t)
|
||||
|
||||
miscfiles_read_localization($1_xserver_t)
|
||||
miscfiles_read_fonts($1_xserver_t)
|
||||
|
||||
modutils_domtrans_insmod($1_xserver_t)
|
||||
|
||||
seutil_dontaudit_search_config($1_xserver_t)
|
||||
# read x_contexts
|
||||
seutil_read_default_contexts($1_xserver_t)
|
||||
|
||||
ifndef(`distro_redhat',`
|
||||
allow $1_xserver_t self:process { execmem execheap execstack };
|
||||
@ -169,6 +188,32 @@ template(`xserver_common_domain_template',`
|
||||
allow $1_xserver_t self:process { execmem execheap execstack };
|
||||
')
|
||||
|
||||
tunable_policy(`!xserver_object_manager',`
|
||||
# should be xserver_unconfined($1_xserver_t),
|
||||
# but typeattribute doesnt work in conditionals
|
||||
gen_require(`
|
||||
attribute x_server_domain, x_domain;
|
||||
attribute xproperty_type, xselection_type;
|
||||
attribute xextension_type, xevent_type;
|
||||
attribute rootwindow_type;
|
||||
|
||||
type remote_xclient_t;
|
||||
')
|
||||
allow $1_xserver_t x_server_domain:x_server *;
|
||||
allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *;
|
||||
allow $1_xserver_t x_server_domain:x_screen *;
|
||||
allow $1_xserver_t x_domain:x_gc *;
|
||||
allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *;
|
||||
allow $1_xserver_t xproperty_type:x_property *;
|
||||
allow $1_xserver_t xselection_type:x_selection *;
|
||||
allow $1_xserver_t x_domain:x_cursor *;
|
||||
allow $1_xserver_t { x_domain remote_xclient_t }:x_client *;
|
||||
allow $1_xserver_t { x_domain x_server_domain }:x_device *;
|
||||
allow $1_xserver_t xextension_type:x_extension *;
|
||||
allow $1_xserver_t { x_domain x_server_domain }:x_resource *;
|
||||
allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *;
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
apm_stream_connect($1_xserver_t)
|
||||
')
|
||||
@ -415,6 +460,47 @@ template(`xserver_per_role_template',`
|
||||
tunable_policy(`use_samba_home_dirs',`
|
||||
fs_manage_cifs_files($1_iceauth_t)
|
||||
')
|
||||
|
||||
##############################
|
||||
#
|
||||
# User X object manager local policy
|
||||
#
|
||||
|
||||
# Device rules
|
||||
allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell };
|
||||
|
||||
allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
|
||||
allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
|
||||
|
||||
# manage: xhost X11:ChangeHosts
|
||||
# freeze: metacity X11:GrabKey
|
||||
# force_cursor: metacity X11:GrabPointer
|
||||
allow $2 $1_xserver_t:x_device { manage freeze force_cursor };
|
||||
|
||||
# gnome-settings-daemon XKEYBOARD:SetControls
|
||||
allow $2 $1_xserver_t:x_server manage;
|
||||
|
||||
# gnome-settings-daemon RANDR:SelectInput
|
||||
allow $2 $1_xserver_t:x_resource write;
|
||||
|
||||
# metacity X11:InstallColormap X11:UninstallColormap
|
||||
allow $2 $1_rootwindow_t:x_colormap { install uninstall };
|
||||
|
||||
# read: gnome-settings-daemon RANDR:GetScreenSizeRange
|
||||
# write: gnome-settings-daemon RANDR:SelectInput
|
||||
# setattr: gnome-settings-daemon X11:GrabKey
|
||||
# manage: metacity X11:ChangeWindowAttributes
|
||||
allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
|
||||
|
||||
# setattr: metacity X11:InstallColormap
|
||||
allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr };
|
||||
|
||||
# xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
|
||||
allow $2 info_xproperty_t:x_property { create write append };
|
||||
|
||||
mls_xwin_read_to_clearance($1_xserver_t)
|
||||
|
||||
xserver_common_x_domain_template($1,$1,$2)
|
||||
')
|
||||
|
||||
#######################################
|
||||
@ -521,7 +607,7 @@ template(`xserver_rw_session_template',`
|
||||
## </param>
|
||||
#
|
||||
template(`xserver_user_client_template',`
|
||||
|
||||
# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
|
||||
gen_require(`
|
||||
type xdm_t, xdm_tmp_t;
|
||||
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
|
||||
@ -564,6 +650,279 @@ template(`xserver_user_client_template',`
|
||||
')
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Interface to provide X object permissions on a given X server to
|
||||
## an X client domain. Provides the minimal set required by a basic
|
||||
## X client application.
|
||||
## </summary>
|
||||
## <param name="user">
|
||||
## <summary>
|
||||
## The prefix of the X server domain (e.g., user
|
||||
## is the prefix for user_t).
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="prefix">
|
||||
## <summary>
|
||||
## The prefix of the X client domain (e.g., user
|
||||
## is the prefix for user_t).
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Client domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`xserver_common_x_domain_template',`
|
||||
gen_require(`
|
||||
type $1_rootwindow_t, std_xext_t, shmem_xext_t;
|
||||
type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
|
||||
type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
|
||||
type xevent_t, client_xevent_t;
|
||||
type clipboard_xselection_t, xselection_t;
|
||||
|
||||
attribute x_server_domain, x_domain;
|
||||
attribute xproperty_type;
|
||||
attribute xevent_type, xextension_type;
|
||||
attribute $1_x_domain, $1_input_xevent_type;
|
||||
|
||||
class x_drawable all_x_drawable_perms;
|
||||
class x_screen all_x_screen_perms;
|
||||
class x_gc all_x_gc_perms;
|
||||
class x_font all_x_font_perms;
|
||||
class x_colormap all_x_colormap_perms;
|
||||
class x_property all_x_property_perms;
|
||||
class x_selection all_x_selection_perms;
|
||||
class x_cursor all_x_cursor_perms;
|
||||
class x_client all_x_client_perms;
|
||||
class x_device all_x_device_perms;
|
||||
class x_server all_x_server_perms;
|
||||
class x_extension all_x_extension_perms;
|
||||
class x_resource all_x_resource_perms;
|
||||
class x_event all_x_event_perms;
|
||||
class x_synthetic_event all_x_synthetic_event_perms;
|
||||
')
|
||||
|
||||
##############################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
# Type attributes
|
||||
typeattribute $3 $1_x_domain, x_domain;
|
||||
|
||||
# Types for properties
|
||||
type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type;
|
||||
|
||||
# Types for events
|
||||
type $2_input_xevent_t, $1_input_xevent_type, xevent_type;
|
||||
type $2_property_xevent_t, xevent_type;
|
||||
type $2_focus_xevent_t, xevent_type;
|
||||
type $2_manage_xevent_t, xevent_type;
|
||||
type $2_default_xevent_t, xevent_type;
|
||||
type $2_client_xevent_t, xevent_type;
|
||||
|
||||
##############################
|
||||
#
|
||||
# Local Policy
|
||||
#
|
||||
|
||||
# Hacks
|
||||
# everyone can get the input focus of everyone else
|
||||
# this is a fundamental brokenness in the X protocol
|
||||
allow $3 { x_domain x_server_domain }:x_device getfocus;
|
||||
# everyone can grab the server
|
||||
# everyone does it, it is basically a free DOS attack
|
||||
allow $3 x_server_domain:x_server grab;
|
||||
# everyone can get the font path, etc.
|
||||
# this could leak out sensitive information
|
||||
allow $3 x_server_domain:x_server getattr;
|
||||
# everyone can do override-redirect windows.
|
||||
# this could be used to spoof labels
|
||||
allow $3 self:x_drawable override;
|
||||
# everyone can receive management events on the root window
|
||||
# allows to know when new windows appear, among other things
|
||||
allow $3 manage_xevent_t:x_event receive;
|
||||
|
||||
# X Server
|
||||
# can read server-owned resources
|
||||
allow $3 x_server_domain:x_resource read;
|
||||
# can mess with own clients
|
||||
allow $3 self:x_client { manage destroy };
|
||||
|
||||
# X Protocol Extensions
|
||||
allow $3 std_xext_t:x_extension { query use };
|
||||
allow $3 shmem_xext_t:x_extension { query use };
|
||||
dontaudit $3 xextension_type:x_extension { query use };
|
||||
|
||||
# X Properties
|
||||
# can read and write client properties
|
||||
allow $3 $2_xproperty_t:x_property { create destroy read write append };
|
||||
type_transition $3 xproperty_t:x_property $2_xproperty_t;
|
||||
# can read and write cut buffers
|
||||
allow $3 clipboard_xproperty_t:x_property { create read write append };
|
||||
# can read info properties
|
||||
allow $3 info_xproperty_t:x_property read;
|
||||
# can change properties of root window
|
||||
allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
|
||||
# can change properties of own windows
|
||||
allow $3 self:x_drawable { list_property get_property set_property };
|
||||
|
||||
# X Windows
|
||||
# operations allowed on root windows
|
||||
allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive };
|
||||
# operations allowed on my windows
|
||||
allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
|
||||
type_transition $3 $1_rootwindow_t:x_drawable $3;
|
||||
|
||||
# X Colormaps
|
||||
# can use the default colormap
|
||||
allow $3 $1_rootwindow_t:x_colormap { read use add_color };
|
||||
|
||||
# X Input
|
||||
# can receive own events
|
||||
allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive;
|
||||
type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
|
||||
type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
|
||||
type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
|
||||
type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
|
||||
type_transition $3 client_xevent_t:x_event $2_client_xevent_t;
|
||||
type_transition $3 xevent_t:x_event $2_default_xevent_t;
|
||||
# can receive certain root window events
|
||||
allow $3 focus_xevent_t:x_event receive;
|
||||
allow $3 property_xevent_t:x_event receive;
|
||||
allow $3 client_xevent_t:x_synthetic_event receive;
|
||||
allow $3 manage_xevent_t:x_synthetic_event receive;
|
||||
# can send ICCCM events to myself
|
||||
allow $3 $2_manage_xevent_t:x_synthetic_event send;
|
||||
# can send ICCCM events to the root window
|
||||
allow $3 manage_xevent_t:x_synthetic_event send;
|
||||
allow $3 client_xevent_t:x_synthetic_event send;
|
||||
|
||||
# X Selections
|
||||
# can use the clipboard
|
||||
allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
|
||||
# can query all other selections
|
||||
allow $3 xselection_t:x_selection { getattr read };
|
||||
|
||||
# Other X Objects
|
||||
# can create and use cursors
|
||||
allow $3 self:x_cursor *;
|
||||
# can create and use graphics contexts
|
||||
allow $3 self:x_gc *;
|
||||
# can create and use colormaps
|
||||
allow $3 self:x_colormap *;
|
||||
# can read and write own objects
|
||||
allow $3 self:x_resource { read write };
|
||||
|
||||
tunable_policy(`! xserver_object_manager',`
|
||||
# should be xserver_unconfined($3),
|
||||
# but typeattribute doesnt work in conditionals
|
||||
gen_require(`
|
||||
attribute x_server_domain, x_domain;
|
||||
attribute xproperty_type, xselection_type;
|
||||
attribute xextension_type, xevent_type;
|
||||
attribute rootwindow_type;
|
||||
|
||||
type remote_xclient_t;
|
||||
')
|
||||
allow $3 x_server_domain:x_server *;
|
||||
allow $3 { x_domain rootwindow_type }:x_drawable *;
|
||||
allow $3 x_server_domain:x_screen *;
|
||||
allow $3 x_domain:x_gc *;
|
||||
allow $3 { x_domain rootwindow_type }:x_colormap *;
|
||||
allow $3 xproperty_type:x_property *;
|
||||
allow $3 xselection_type:x_selection *;
|
||||
allow $3 x_domain:x_cursor *;
|
||||
allow $3 { x_domain remote_xclient_t }:x_client *;
|
||||
allow $3 { x_domain x_server_domain }:x_device *;
|
||||
allow $3 xextension_type:x_extension *;
|
||||
allow $3 { x_domain x_server_domain }:x_resource *;
|
||||
allow $3 xevent_type:{ x_event x_synthetic_event } *;
|
||||
')
|
||||
')
|
||||
|
||||
#######################################
|
||||
## <summary>
|
||||
## Interface to provide X object permissions on a given X server to
|
||||
## an X client domain. Provides the minimal set required by a basic
|
||||
## X client application.
|
||||
## </summary>
|
||||
## <param name="user">
|
||||
## <summary>
|
||||
## The prefix of the X server domain (e.g., user
|
||||
## is the prefix for user_t).
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="prefix">
|
||||
## <summary>
|
||||
## The prefix of the X client domain (e.g., user
|
||||
## is the prefix for user_t).
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Client domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="tmpfs_type">
|
||||
## <summary>
|
||||
## The type of the domain SYSV tmpfs files.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
template(`xserver_user_x_domain_template',`
|
||||
gen_require(`
|
||||
type xdm_t, xdm_tmp_t;
|
||||
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
|
||||
')
|
||||
|
||||
allow $3 self:shm create_shm_perms;
|
||||
allow $3 self:unix_dgram_socket create_socket_perms;
|
||||
allow $3 self:unix_stream_socket { connectto create_stream_socket_perms };
|
||||
|
||||
# Read .Xauthority file
|
||||
allow $3 $1_xauth_home_t:file { getattr read };
|
||||
allow $3 $1_iceauth_home_t:file { getattr read };
|
||||
|
||||
# for when /tmp/.X11-unix is created by the system
|
||||
allow $3 xdm_t:fd use;
|
||||
allow $3 xdm_t:fifo_file { getattr read write ioctl };
|
||||
allow $3 xdm_tmp_t:dir search;
|
||||
allow $3 xdm_tmp_t:sock_file { read write };
|
||||
dontaudit $3 xdm_t:tcp_socket { read write };
|
||||
|
||||
# Allow connections to X server.
|
||||
files_search_tmp($3)
|
||||
|
||||
miscfiles_read_fonts($3)
|
||||
|
||||
userdom_search_user_home_dirs($1,$3)
|
||||
# for .xsession-errors
|
||||
userdom_dontaudit_write_user_home_content_files($1,$3)
|
||||
|
||||
xserver_ro_session_template(xdm,$3,$4)
|
||||
xserver_rw_session_template($1,$3,$4)
|
||||
xserver_use_user_fonts($1,$3)
|
||||
|
||||
xserver_read_xdm_tmp_files($3)
|
||||
|
||||
# X object manager
|
||||
xserver_common_x_domain_template($1,$2,$3)
|
||||
|
||||
# Client write xserver shm
|
||||
tunable_policy(`allow_write_xshm',`
|
||||
allow $3 $1_xserver_t:shm rw_shm_perms;
|
||||
allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Read user fonts, user font configuration,
|
||||
@ -1312,3 +1671,23 @@ interface(`xserver_stream_connect_xdm_xserver',`
|
||||
files_search_tmp($1)
|
||||
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Interface to provide X object permissions on a given X server to
|
||||
## an X client domain. Gives the domain complete control over the
|
||||
## display.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`xserver_unconfined',`
|
||||
gen_require(`
|
||||
attribute xserver_unconfined_type;
|
||||
')
|
||||
|
||||
typeattribute $1 xserver_unconfined_type;
|
||||
')
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(xserver,1.7.0)
|
||||
policy_module(xserver,2.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
@ -21,14 +21,58 @@ gen_tunable(allow_write_xshm,false)
|
||||
## </desc>
|
||||
gen_tunable(xdm_sysadm_login,false)
|
||||
|
||||
## <desc>
|
||||
## <p>
|
||||
## Support X userspace object manager
|
||||
## </p>
|
||||
## </desc>
|
||||
gen_tunable(xserver_object_manager,false)
|
||||
|
||||
attribute fonts_type;
|
||||
attribute fonts_cache_type;
|
||||
attribute fonts_config_type;
|
||||
attribute xauth_home_type;
|
||||
|
||||
# Domains
|
||||
attribute xserver_unconfined_type;
|
||||
attribute x_server_domain;
|
||||
|
||||
# Per-object attributes
|
||||
attribute rootwindow_type;
|
||||
attribute x_domain;
|
||||
attribute xproperty_type;
|
||||
attribute xselection_type;
|
||||
attribute xextension_type;
|
||||
attribute xevent_type;
|
||||
|
||||
type accelgraphics_xext_t, xextension_type;
|
||||
type client_xevent_t, xevent_type;
|
||||
type clipboard_xproperty_t, xproperty_type;
|
||||
type clipboard_xselection_t, xselection_type;
|
||||
type debug_xext_t, xextension_type;
|
||||
type directhw_xext_t alias disallowed_xext_t, xextension_type;
|
||||
type focus_xevent_t, xevent_type;
|
||||
|
||||
type iceauth_exec_t;
|
||||
application_executable_file(iceauth_exec_t)
|
||||
|
||||
type info_xproperty_t, xproperty_type;
|
||||
type input_xevent_t, xevent_type;
|
||||
type manage_xevent_t, xevent_type;
|
||||
type output_xext_t, xextension_type;
|
||||
type property_xevent_t, xevent_type;
|
||||
type remote_xclient_t;
|
||||
type screensaver_xext_t, xextension_type;
|
||||
type security_xext_t, xextension_type;
|
||||
type shmem_xext_t, xextension_type;
|
||||
type std_xext_t, xextension_type;
|
||||
type video_xext_t, xextension_type;
|
||||
type unknown_xevent_t, xevent_type;
|
||||
type xevent_t alias default_xevent_t, xevent_type;
|
||||
type xext_t alias unknown_xext_t, xextension_type;
|
||||
type xproperty_t alias default_xproperty_t, xproperty_type;
|
||||
type xselection_t alias default_xselection_t, xselection_type;
|
||||
|
||||
type xauth_exec_t;
|
||||
application_executable_file(xauth_exec_t)
|
||||
|
||||
@ -79,6 +123,7 @@ type xserver_log_t;
|
||||
logging_log_file(xserver_log_t)
|
||||
|
||||
xserver_common_domain_template(xdm)
|
||||
xserver_common_x_domain_template(xdm,xdm,xdm_t)
|
||||
init_system_domain(xdm_xserver_t,xserver_exec_t)
|
||||
|
||||
ifdef(`enable_mcs',`
|
||||
@ -272,6 +317,7 @@ userdom_read_all_users_state(xdm_t)
|
||||
userdom_signal_all_users(xdm_t)
|
||||
|
||||
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
|
||||
xserver_unconfined(xdm_t)
|
||||
|
||||
tunable_policy(`use_nfs_home_dirs',`
|
||||
fs_manage_nfs_dirs(xdm_t)
|
||||
@ -441,6 +487,25 @@ optional_policy(`
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Rules for unconfined access to this module
|
||||
#
|
||||
|
||||
allow xserver_unconfined_type x_server_domain:x_server *;
|
||||
allow xserver_unconfined_type { x_domain rootwindow_type }:x_drawable *;
|
||||
allow xserver_unconfined_type x_server_domain:x_screen *;
|
||||
allow xserver_unconfined_type x_domain:x_gc *;
|
||||
allow xserver_unconfined_type { x_domain rootwindow_type }:x_colormap *;
|
||||
allow xserver_unconfined_type xproperty_type:x_property *;
|
||||
allow xserver_unconfined_type xselection_type:x_selection *;
|
||||
allow xserver_unconfined_type x_domain:x_cursor *;
|
||||
allow xserver_unconfined_type { x_domain remote_xclient_t }:x_client *;
|
||||
allow xserver_unconfined_type { x_domain x_server_domain }:x_device *;
|
||||
allow xserver_unconfined_type xextension_type:x_extension *;
|
||||
allow xserver_unconfined_type { x_domain x_server_domain }:x_resource *;
|
||||
allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
|
||||
|
||||
ifdef(`TODO',`
|
||||
# Need to further investigate these permissions and
|
||||
# perhaps define derived types.
|
||||
|
||||
@ -95,6 +95,10 @@ interface(`unconfined_domain_noaudit',`
|
||||
optional_policy(`
|
||||
storage_unconfined($1)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_unconfined($1)
|
||||
')
|
||||
')
|
||||
|
||||
########################################
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
|
||||
policy_module(unconfined,2.1.0)
|
||||
policy_module(unconfined,2.1.1)
|
||||
|
||||
########################################
|
||||
#
|
||||
|
||||
@ -74,6 +74,7 @@ make NAME=%{polname2} TYPE=%{type2} DISTRO=%{distro} DIRECT_INITRC=%{direct_init
|
||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/x_contexts
|
||||
%dir %{_sysconfdir}/selinux/*/contexts/files
|
||||
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts
|
||||
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template
|
||||
@ -117,6 +118,7 @@ SELinux Reference policy targeted base module.
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/x_contexts
|
||||
%dir %{_sysconfdir}/selinux/%{polname1}/contexts/files
|
||||
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts
|
||||
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template
|
||||
@ -162,6 +164,7 @@ SELinux Reference policy strict base module.
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context
|
||||
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/x_contexts
|
||||
%dir %{_sysconfdir}/selinux/%{polname2}/contexts/files
|
||||
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts
|
||||
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template
|
||||
|
||||
Loading…
Reference in New Issue
Block a user