last bits of xserver

refpolicy/policy/modules/services/ssh.if

@@ -202,6 +202,10 @@ template(`ssh_per_userdomain_template',`
 		nscd_use_socket($1_ssh_t)
 	')
 
+	optional_policy(`xserver',`
+		xserver_domtrans_user_xauth($1,$1_ssh_t)
+	')
+
 	ifdef(`TODO',`
 
 	# Read /var/run, /var/log.
@@ -550,15 +554,65 @@ template(`ssh_server_template', `
 ')
 
 ########################################
-## <summary>Read ssh server keys</summary>
+## <summary>
+##	Send a SIGCHLD signal to the ssh server.
+## </summary>
 ## <param name="domain">
-##	The type of the process performing this action.
+##	Domain allowed access.
+## </param>
+#
+interface(`ssh_sigchld',`
+	gen_require(`
+		type sshd_t;
+	')
+
+	allow $1 sshd_t:process sigchld;
+')
+
+########################################
+## <summary>
+##	Read a ssh server unnamed pipe.
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
+#
+interface(`ssh_read_pipe',`
+	gen_require(`
+		type sshd_t;
+	')
+
+	allow $1 sshd_t:fifo_file { getattr read };
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read and write
+##	ssh server TCP sockets.
+## </summary>
+## <param name="domain">
+##	Domain to not audit.
+## </param>
+#
+interface(`ssh_dontaudit_rw_tcp_socket',`
+	gen_require(`
+		type sshd_t;
+	')
+
+	dontaudit $1 sshd_t:tcp_socket { read write };
+')
+
+########################################
+## <summary>
+##	Read ssh server keys
+## </summary>
+## <param name="domain">
+##	Domain allowed access.
 ## </param>
 #
 interface(`ssh_dontaudit_read_server_keys',`
 	gen_require(`
 		type sshd_key_t;
-		class file { getattr read };
 	')
 
 	dontaudit $1 sshd_key_t:file { getattr read };

refpolicy/policy/modules/services/xdm.te

@@ -121,6 +121,8 @@ ifdef(`strict_policy',`
 	allow xdm_t xdm_var_run_t:dir manage_dir_perms;
 	allow xdm_t xdm_var_run_t:fifo_file manage_file_perms;
 	files_filetrans_pid(xdm_t,xdm_var_run_t,{ dir fifo_file })
+
+	xserver_dontaudit_read_all_users_iceauth(xdm_t)
 ')
 
 ifdef(`targeted_policy',`

refpolicy/policy/modules/services/xserver.if

@@ -305,6 +305,16 @@ template(`xserver_per_userdomain_template',`
 
 	allow $2 $1_xauth_t:process signal;
 
+	# allow ps to show xauth
+	allow $2 $1_xauth_t:dir { search getattr read };
+	allow $2 $1_xauth_t:{ file lnk_file } { read getattr };
+	allow $2 $1_xauth_t:process getattr;
+	# We need to suppress this denial because procps tries to access
+	# /proc/pid/environ and this now triggers a ptrace check in recent kernels
+	# (2.4 and 2.6).  Might want to change procps to not do this, or only if
+	# running in a privileged domain.
+	dontaudit $2 $1_xauth_t:process ptrace;
+
 	allow $2 $1_xauth_home_t:file manage_file_perms;
 	allow $2 $1_xauth_home_t:file { relabelfrom relabelto };
 
@@ -325,6 +335,7 @@ template(`xserver_per_userdomain_template',`
 	sysnet_dns_name_resolve($1_xauth_t)
 
 	userdom_use_user_terminals($1,$1_xauth_t)
+	userdom_read_user_tmp_files($1,$1_xauth_t)
 
 	tunable_policy(`use_nfs_home_dirs',`
 		fs_manage_nfs_files($1_xauth_t)
@@ -338,20 +349,11 @@ template(`xserver_per_userdomain_template',`
 		nis_use_ypbind($1_xauth_t)
 	')
 
-	ifdef(`TODO',`
+	optional_policy(`ssh',`
-	ifdef(`ssh.te', `
+		ssh_sigchld($1_xauth_t)
-		domain_auto_trans($1_ssh_t, xauth_exec_t, $1_xauth_t)
+		ssh_read_pipe($1_xauth_t)
-		dontaudit $1_xauth_t $1_ssh_t:tcp_socket { read write };
+		ssh_dontaudit_rw_tcp_socket($1_xauth_t)
-
+	')
-		allow $1_xauth_t sshd_t:fifo_file { getattr read };
-		allow $1_xauth_t sshd_t:process sigchld;
-	')dnl end if ssh
-
-	# allow ps to show xauth
-	can_ps($1_t, $1_xauth_t)
-
-	allow $1_xauth_t $1_tmp_t:file { getattr ioctl read };
-	') dnl end TODO
 
 	##############################
 	#
@@ -367,6 +369,16 @@ template(`xserver_per_userdomain_template',`
 	allow $1_iceauth_t $1_iceauth_home_t:file manage_file_perms;
 	userdom_filetrans_user_home_dir($1,$1_iceauth_t,$1_iceauth_home_t,file)
 
+	# allow ps to show iceauth
+	allow $2 $1_iceauth_t:dir { search getattr read };
+	allow $2 $1_iceauth_t:{ file lnk_file } { read getattr };
+	allow $2 $1_iceauth_t:process getattr;
+	# We need to suppress this denial because procps tries to access
+	# /proc/pid/environ and this now triggers a ptrace check in recent kernels
+	# (2.4 and 2.6).  Might want to change procps to not do this, or only if
+	# running in a privileged domain.
+	dontaudit $2 $1_iceauth_t:process ptrace;
+
 	allow $2 $1_iceauth_home_t:file manage_file_perms;
 	allow $2 $1_iceauth_home_t:file { relabelfrom relabelto };
 
@@ -384,13 +396,6 @@ template(`xserver_per_userdomain_template',`
 	tunable_policy(`use_samba_home_dirs',`
 		fs_manage_cifs_files($1_iceauth_t)
 	')
-
-	ifdef(`TODO',`
-	# Supress xdm trying to restore .ICEauthority permissions
-	ifdef(`xdm.te', `
-	dontaudit xdm_t $1_iceauth_home_t:file r_file_perms;
-	')
-	') dnl end TODO
 ')
 
 #######################################
@@ -449,3 +454,53 @@ template(`xserver_displaymgr_domain_template',`
 	allow $1_xserver_t xdm_tmpfs_t:file rw_file_perms;
 	') dnl end TODO
 ')
+
+########################################
+## <summary>
+##	Transition to a user Xauthority domain.
+## </summary>
+## <desc>
+##	<p>
+##	Transition to a user Xauthority domain.
+##	</p>
+##	<p>
+##	This is a templated interface, and should only
+##	be called from a per-userdomain template.
+##	</p>
+## </desc>
+## <param name="userdomain_prefix">
+##	The prefix of the user domain (e.g., user
+##	is the prefix for user_t).
+## </param>
+## <param name="domain">
+##	Domain allowed access.
+## </param>
+#
+template(`xserver_domtrans_user_xauth',`
+	gen_require(`
+		type $1_xauth_t, xauth_exec_t;
+	')
+
+	domain_auto_trans($2, xauth_exec_t, $1_xauth_t)
+	allow $2 $1_xauth_t:fd use;
+	allow $1_xauth_t $2:fd use;
+	allow $1_xauth_t $2:fifo_file rw_file_perms;
+	allow $1_xauth_t $2:process sigchld;
+')
+
+########################################
+## <summary>
+##	Do not audit attempts to read all user
+##	.ICEauthority files.
+## </summary>
+## <param name="domain">
+##	Domain do not audit.
+## </param>
+#
+interface(`xserver_dontaudit_read_all_users_iceauth',`
+	gen_require(`
+		attribute iceauth_home_type;
+	')
+
+	dontaudit $1 iceauth_home_type:file r_file_perms;
+')

refpolicy/policy/modules/services/xserver.te

@@ -6,6 +6,8 @@ policy_module(xserver,1.0.0)
 # Declarations
 #
 
+attribute iceauth_home_type;
+
 type ice_tmp_t;
 files_tmp_file(ice_tmp_t)