rpms/selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fixes for xguest to run java plugin

Browse Source
This commit is contained in:
Daniel J Walsh 2008-01-13 13:20:05 +00:00
parent 4be3ba520d
commit 754ef886a2
1 changed files with 148 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

183
policy-20071130.patch
View File

@ -957,7 +957,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.fc
/var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0) /var/lib/alternatives(/.*)? gen_context(system_u:object_r:rpm_var_lib_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if serefpolicy-3.2.5/policy/modules/admin/rpm.if
--- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400 --- nsaserefpolicy/policy/modules/admin/rpm.if 2007-05-18 11:12:44.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-08 08:11:14.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/admin/rpm.if 2008-01-11 15:53:03.000000000 -0500
@@ -152,6 +152,24 @@ @@ -152,6 +152,24 @@
######################################## ########################################
@ -1180,7 +1180,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/admin/rpm.if
+ +
+######################################## +########################################
+## <summary> +## <summary>
+## Transition to system_r when execute an init script +## Transition to system_r when execute an rpm script
+## </summary> +## </summary>
+## <desc> +## <desc>
+## <p> +## <p>
@ -2702,7 +2702,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.fc
+/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0) +/usr/bin/octave-[^/]* -- gen_context(system_u:object_r:java_exec_t,s0)
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if serefpolicy-3.2.5/policy/modules/apps/java.if
--- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400 --- nsaserefpolicy/policy/modules/apps/java.if 2007-10-12 08:56:02.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/apps/java.if 2007-12-22 07:16:08.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/apps/java.if 2008-01-13 08:11:05.000000000 -0500
@@ -32,7 +32,7 @@ @@ -32,7 +32,7 @@
## </summary> ## </summary>
## </param> ## </param>
@ -2712,23 +2712,33 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
gen_require(` gen_require(`
type java_exec_t; type java_exec_t;
') ')
@@ -57,7 +57,7 @@ @@ -57,14 +57,16 @@
# Local policy # Local policy
# #
- allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem }; - allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem };
+ allow $1_javaplugin_t self:process { signal_perms getsched setsched execmem execstack }; + allow $1_javaplugin_t self:process { execmem execstack signal_perms getsched ptrace setsched };
allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms; allow $1_javaplugin_t self:fifo_file rw_fifo_file_perms;
allow $1_javaplugin_t self:tcp_socket create_socket_perms; - allow $1_javaplugin_t self:tcp_socket create_socket_perms;
+ allow $1_javaplugin_t self:tcp_socket create_stream_socket_perms;
allow $1_javaplugin_t self:udp_socket create_socket_perms; allow $1_javaplugin_t self:udp_socket create_socket_perms;
@@ -76,13 +76,10 @@
+ allow $1_javaplugin_t $1_t:process signull;
+ allow $1_javaplugin_t $1_t:unix_stream_socket connectto;
+ allow $1_t $1_javaplugin_t:unix_stream_socket connectto;
allow $1_javaplugin_t $2:unix_stream_socket connectto;
allow $1_javaplugin_t $2:unix_stream_socket { read write };
- userdom_write_user_tmp_sockets($1,$1_javaplugin_t)
manage_dirs_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
manage_files_pattern($1_javaplugin_t,$1_javaplugin_tmp_t,$1_javaplugin_tmp_t)
@@ -76,13 +78,9 @@
manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t) manage_sock_files_pattern($1_javaplugin_t,$1_javaplugin_tmpfs_t,$1_javaplugin_tmpfs_t)
fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file }) fs_tmpfs_filetrans($1_javaplugin_t,$1_javaplugin_tmpfs_t,{ file lnk_file sock_file fifo_file })
- rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t) - rw_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
- read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t) - read_files_pattern($1_javaplugin_t,$1_home_t,$1_home_t)
- -
+ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
can_exec($1_javaplugin_t, java_exec_t) can_exec($1_javaplugin_t, java_exec_t)
- # The user role is authorized for this domain. - # The user role is authorized for this domain.
@ -2737,11 +2747,65 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
allow $1_javaplugin_t $2:fd use; allow $1_javaplugin_t $2:fd use;
# Unrestricted inheritance from the caller. # Unrestricted inheritance from the caller.
allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh }; allow $2 $1_javaplugin_t:process { noatsecure siginh rlimitinh };
@@ -166,6 +163,62 @@ @@ -94,7 +92,7 @@
optional_policy(` kernel_read_system_state($1_javaplugin_t)
xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
') # Search bin directory under javaplugin for javaplugin executable
- corecmd_search_bin($1_javaplugin_t)
+ corecmd_exec_bin($1_javaplugin_t)
corenet_all_recvfrom_unlabeled($1_javaplugin_t)
corenet_all_recvfrom_netlabel($1_javaplugin_t)
@@ -107,10 +105,12 @@
corenet_tcp_connect_all_ports($1_javaplugin_t)
corenet_sendrecv_all_client_packets($1_javaplugin_t)
+ dev_list_sysfs($1_javaplugin_t)
dev_read_sound($1_javaplugin_t)
dev_write_sound($1_javaplugin_t)
dev_read_urand($1_javaplugin_t)
dev_read_rand($1_javaplugin_t)
+ dev_write_rand($1_javaplugin_t)
files_read_etc_files($1_javaplugin_t)
files_read_usr_files($1_javaplugin_t)
@@ -122,6 +122,9 @@
fs_getattr_xattr_fs($1_javaplugin_t)
fs_dontaudit_rw_tmpfs_files($1_javaplugin_t)
+ fs_getattr_tmpfs($1_javaplugin_t)
+ +
+ auth_use_nsswitch($1_javaplugin_t)
libs_use_ld_so($1_javaplugin_t)
libs_use_shared_libs($1_javaplugin_t)
@@ -132,11 +135,14 @@
# Read global fonts and font config
miscfiles_read_fonts($1_javaplugin_t)
- sysnet_read_config($1_javaplugin_t)
-
+ userdom_manage_unpriv_users_home_content_files($1_javaplugin_t)
userdom_dontaudit_use_user_terminals($1,$1_javaplugin_t)
userdom_dontaudit_setattr_user_home_content_files($1,$1_javaplugin_t)
userdom_dontaudit_exec_user_home_content_files($1,$1_javaplugin_t)
+ userdom_manage_user_tmp_dirs($1,$1_javaplugin_t)
+ userdom_manage_user_tmp_files($1,$1_javaplugin_t)
+ userdom_manage_user_tmp_sockets($1,$1_javaplugin_t)
+ userdom_read_user_tmpfs_files($1,$1_javaplugin_t)
userdom_manage_user_home_content_dirs($1,$1_javaplugin_t)
userdom_manage_user_home_content_files($1,$1_javaplugin_t)
userdom_manage_user_home_content_symlinks($1,$1_javaplugin_t)
@@ -156,15 +162,63 @@
')
optional_policy(`
- nis_use_ypbind($1_javaplugin_t)
+ xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
')
- optional_policy(`
- nscd_socket_use($1_javaplugin_t)
+') +')
+ +
+####################################### +#######################################
@ -2774,8 +2838,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+template(`java_per_role_template',` +template(`java_per_role_template',`
+ gen_require(` + gen_require(`
+ type java_exec_t; + type java_exec_t;
+ ') ')
+
+ type $1_java_t; + type $1_java_t;
+ domain_type($1_java_t) + domain_type($1_java_t)
+ domain_entry_file($1_java_t,java_exec_t) + domain_entry_file($1_java_t,java_exec_t)
@ -2794,13 +2858,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/java.if
+ +
+ fs_dontaudit_rw_tmpfs_files($1_java_t) + fs_dontaudit_rw_tmpfs_files($1_java_t)
+ +
+ optional_policy(` optional_policy(`
- xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
+ xserver_xdm_rw_shm($1_java_t) + xserver_xdm_rw_shm($1_java_t)
+ ') ')
') ')
######################################## @@ -219,3 +273,67 @@
@@ -219,3 +272,67 @@
corecmd_search_bin($1) corecmd_search_bin($1)
domtrans_pattern($1, java_exec_t, java_t) domtrans_pattern($1, java_exec_t, java_t)
') ')
@ -3073,7 +3137,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.
# /bin # /bin
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/apps/mozilla.if serefpolicy-3.2.5/policy/modules/apps/mozilla.if
--- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400 --- nsaserefpolicy/policy/modules/apps/mozilla.if 2007-10-29 07:52:48.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-11 13:41:19.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/apps/mozilla.if 2008-01-13 08:06:37.000000000 -0500
@@ -35,7 +35,10 @@ @@ -35,7 +35,10 @@
template(`mozilla_per_role_template',` template(`mozilla_per_role_template',`
gen_require(` gen_require(`
@ -4929,6 +4993,18 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel
') ')
######################################## ########################################
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/kernel.te serefpolicy-3.2.5/policy/modules/kernel/kernel.te
--- nsaserefpolicy/policy/modules/kernel/kernel.te 2007-12-19 05:32:07.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/kernel/kernel.te 2008-01-11 15:13:01.000000000 -0500
@@ -363,7 +363,7 @@
allow kern_unconfined proc_type:{ dir file lnk_file } *;
-allow kern_unconfined sysctl_t:{ dir file } *;
+allow kern_unconfined sysctl_type:{ dir file } *;
allow kern_unconfined kernel_t:system *;
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.2.5/policy/modules/kernel/selinux.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/kernel/selinux.if serefpolicy-3.2.5/policy/modules/kernel/selinux.if
--- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-11-16 13:45:14.000000000 -0500 --- nsaserefpolicy/policy/modules/kernel/selinux.if 2007-11-16 13:45:14.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/kernel/selinux.if 2007-12-19 05:38:09.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/kernel/selinux.if 2007-12-19 05:38:09.000000000 -0500
@ -16194,7 +16270,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/selinu
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.5/policy/modules/system/sysnetwork.if diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.if serefpolicy-3.2.5/policy/modules/system/sysnetwork.if
--- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400 --- nsaserefpolicy/policy/modules/system/sysnetwork.if 2007-07-16 14:09:49.000000000 -0400
+++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2007-12-19 05:38:09.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.if 2008-01-11 15:56:47.000000000 -0500
@@ -145,6 +145,25 @@ @@ -145,6 +145,25 @@
######################################## ########################################
@ -16241,7 +16317,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
') ')
######################################## ########################################
@@ -556,3 +581,23 @@ @@ -556,3 +581,49 @@
files_search_etc($1) files_search_etc($1)
allow $1 net_conf_t:file read_file_perms; allow $1 net_conf_t:file read_file_perms;
') ')
@ -16265,6 +16341,32 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnet
+ dontaudit $1 dhcpc_t:fd use; + dontaudit $1 dhcpc_t:fd use;
+') +')
+ +
+########################################
+## <summary>
+## Transition to system_r when execute an dhclient script
+## </summary>
+## <desc>
+## <p>
+## Execute dhclient script in a specified role
+## </p>
+## <p>
+## No interprocess communication (signals, pipes,
+## etc.) is provided by this interface since
+## the domains are not owned by this module.
+## </p>
+## </desc>
+## <param name="source_role">
+## <summary>
+## Role to transition from.
+## </summary>
+## </param>
+interface(`sysnet_role_transition_dhcpc',`
+ gen_require(`
+ type dhclient_exec_t;
+ ')
+
+ role_transition $1 dhcpc_exec_t system_r;
+')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.5/policy/modules/system/sysnetwork.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/sysnetwork.te serefpolicy-3.2.5/policy/modules/system/sysnetwork.te
--- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/system/sysnetwork.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.te 2007-12-19 05:38:09.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/sysnetwork.te 2007-12-19 05:38:09.000000000 -0500
@ -16703,8 +16805,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconfined.te serefpolicy-3.2.5/policy/modules/system/unconfined.te
--- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500 --- nsaserefpolicy/policy/modules/system/unconfined.te 2007-12-19 05:32:17.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2007-12-20 09:13:54.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/system/unconfined.te 2008-01-11 15:57:35.000000000 -0500
@@ -9,32 +9,49 @@ @@ -9,32 +9,48 @@
# usage in this module of types created by these # usage in this module of types created by these
# calls is not correct, however we dont currently # calls is not correct, however we dont currently
# have another method to add access to these types # have another method to add access to these types
@ -16723,7 +16825,6 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
+allow system_r unconfined_r; +allow system_r unconfined_r;
+allow unconfined_r system_r; +allow unconfined_r system_r;
+init_script_role_transition(unconfined_r) +init_script_role_transition(unconfined_r)
+rpm_role_transition(unconfined_r)
type unconfined_execmem_t; type unconfined_execmem_t;
type unconfined_execmem_exec_t; type unconfined_execmem_exec_t;
@ -16758,7 +16859,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) libs_run_ldconfig(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
@@ -42,7 +59,10 @@ @@ -42,7 +58,10 @@
logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) logging_run_auditctl(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) mount_run_unconfined(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
@ -16769,7 +16870,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) seutil_run_setfiles(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) seutil_run_semanage(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
@@ -51,13 +71,13 @@ @@ -51,13 +70,13 @@
userdom_priveleged_home_dir_manager(unconfined_t) userdom_priveleged_home_dir_manager(unconfined_t)
optional_policy(` optional_policy(`
@ -16785,7 +16886,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
unconfined_domain(httpd_unconfined_script_t) unconfined_domain(httpd_unconfined_script_t)
') ')
@@ -69,11 +89,11 @@ @@ -69,11 +88,11 @@
bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) bootloader_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
') ')
@ -16802,7 +16903,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
optional_policy(` optional_policy(`
init_dbus_chat_script(unconfined_t) init_dbus_chat_script(unconfined_t)
@@ -107,6 +127,10 @@ @@ -107,6 +126,10 @@
optional_policy(` optional_policy(`
oddjob_dbus_chat(unconfined_t) oddjob_dbus_chat(unconfined_t)
') ')
@ -16813,7 +16914,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -118,11 +142,7 @@ @@ -118,11 +141,7 @@
') ')
optional_policy(` optional_policy(`
@ -16826,7 +16927,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -134,14 +154,6 @@ @@ -134,14 +153,6 @@
') ')
optional_policy(` optional_policy(`
@ -16841,7 +16942,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
oddjob_domtrans_mkhomedir(unconfined_t) oddjob_domtrans_mkhomedir(unconfined_t)
') ')
@@ -154,33 +166,20 @@ @@ -154,38 +165,27 @@
') ')
optional_policy(` optional_policy(`
@ -16864,6 +16965,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
rpm_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t }) rpm_run(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
+ # Allow SELinux aware applications to request rpm_script execution + # Allow SELinux aware applications to request rpm_script execution
+ rpm_transition_script(unconfined_t) + rpm_transition_script(unconfined_t)
+ rpm_role_transition(unconfined_r)
') ')
optional_policy(` optional_policy(`
@ -16879,7 +16981,13 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
optional_policy(` optional_policy(`
@@ -205,11 +204,30 @@ sysnet_run_dhcpc(unconfined_t, unconfined_r, { unconfined_devpts_t unconfined_tty_device_t })
sysnet_dbus_chat_dhcpc(unconfined_t)
+ sysnet_role_transition_dhcpc(unconfined_r)
')
optional_policy(`
@@ -205,11 +205,30 @@
') ')
optional_policy(` optional_policy(`
@ -16912,7 +17020,7 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/system/unconf
') ')
######################################## ########################################
@@ -219,14 +237,32 @@ @@ -219,14 +238,32 @@
allow unconfined_execmem_t self:process { execstack execmem }; allow unconfined_execmem_t self:process { execstack execmem };
unconfined_domain_noaudit(unconfined_execmem_t) unconfined_domain_noaudit(unconfined_execmem_t)
@ -20121,8 +20229,8 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.
+## <summary>Policy for xguest user</summary> +## <summary>Policy for xguest user</summary>
diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.5/policy/modules/users/xguest.te diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.te serefpolicy-3.2.5/policy/modules/users/xguest.te
--- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500 --- nsaserefpolicy/policy/modules/users/xguest.te 1969-12-31 19:00:00.000000000 -0500
+++ serefpolicy-3.2.5/policy/modules/users/xguest.te 2007-12-19 16:36:37.000000000 -0500 +++ serefpolicy-3.2.5/policy/modules/users/xguest.te 2008-01-13 08:07:34.000000000 -0500
@@ -0,0 +1,66 @@ @@ -0,0 +1,71 @@
+policy_module(xguest,1.0.1) +policy_module(xguest,1.0.1)
+ +
+## <desc> +## <desc>
@ -20149,7 +20257,12 @@ diff --exclude-from=exclude -N -u -r nsaserefpolicy/policy/modules/users/xguest.
+userdom_restricted_xwindows_user_template(xguest) +userdom_restricted_xwindows_user_template(xguest)
+ +
+optional_policy(` +optional_policy(`
+ gen_require(`
+ type xguest_mozilla_t;
+ ')
+ mozilla_per_role_template(xguest, xguest_t, xguest_r) + mozilla_per_role_template(xguest, xguest_t, xguest_r)
+ dbus_user_bus_client_template(xguest,xguest_mozilla,xguest_mozilla_t)
+ dbus_connectto_user_bus(xguest,xguest_mozilla_t)
+') +')
+ +
+optional_policy(` +optional_policy(`