rpms
/
selinux-policy
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory. 

- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
- Allow confined users to read xdm_etc_t files
- Allow xdm_t to transition to xauth_t for lxdm program
This commit is contained in:
Dan Walsh 2010-09-27 10:31:36 -04:00
parent ab8faf7dcf
commit 7c487e9739
2 changed files with 175 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

254
policy-F14.patch
View File

@ -2144,10 +2144,10 @@ index 0000000..7fe26f3
+') +')
diff --git a/policy/modules/apps/firewallgui.te b/policy/modules/apps/firewallgui.te diff --git a/policy/modules/apps/firewallgui.te b/policy/modules/apps/firewallgui.te
new file mode 100644 new file mode 100644
index 0000000..910a3f4 index 0000000..0bbd523
--- /dev/null --- /dev/null
+++ b/policy/modules/apps/firewallgui.te +++ b/policy/modules/apps/firewallgui.te
@@ -0,0 +1,65 @@ @@ -0,0 +1,66 @@
+policy_module(firewallgui,1.0.0) +policy_module(firewallgui,1.0.0)
+ +
+######################################## +########################################
@ -2174,36 +2174,37 @@ index 0000000..910a3f4
+manage_dirs_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t) +manage_dirs_pattern(firewallgui_t,firewallgui_tmp_t,firewallgui_tmp_t)
+files_tmp_filetrans(firewallgui_t,firewallgui_tmp_t, { file dir }) +files_tmp_filetrans(firewallgui_t,firewallgui_tmp_t, { file dir })
+ +
+files_manage_system_conf_files(firewallgui_t)
+files_etc_filetrans_system_conf(firewallgui_t)
+
+corecmd_exec_shell(firewallgui_t)
+corecmd_exec_bin(firewallgui_t)
+consoletype_exec(firewallgui_t)
+
+kernel_read_system_state(firewallgui_t) +kernel_read_system_state(firewallgui_t)
+kernel_read_network_state(firewallgui_t) +kernel_read_network_state(firewallgui_t)
+kernel_rw_net_sysctls(firewallgui_t) +kernel_rw_net_sysctls(firewallgui_t)
+kernel_rw_kernel_sysctl(firewallgui_t) +kernel_rw_kernel_sysctl(firewallgui_t)
+kernel_rw_vm_sysctls(firewallgui_t) +kernel_rw_vm_sysctls(firewallgui_t)
+ +
+corecmd_exec_shell(firewallgui_t)
+corecmd_exec_bin(firewallgui_t)
+consoletype_exec(firewallgui_t)
+
+dev_read_urand(firewallgui_t)
+dev_read_sysfs(firewallgui_t)
+
+files_manage_system_conf_files(firewallgui_t)
+files_etc_filetrans_system_conf(firewallgui_t)
+files_read_etc_files(firewallgui_t) +files_read_etc_files(firewallgui_t)
+files_read_usr_files(firewallgui_t) +files_read_usr_files(firewallgui_t)
+files_search_kernel_modules(firewallgui_t) +files_search_kernel_modules(firewallgui_t)
+files_list_kernel_modules(firewallgui_t) +files_list_kernel_modules(firewallgui_t)
+ +
+iptables_domtrans(firewallgui_t)
+iptables_initrc_domtrans(firewallgui_t)
+
+modutils_getattr_module_deps(firewallgui_t) +modutils_getattr_module_deps(firewallgui_t)
+ +
+dev_read_urand(firewallgui_t)
+dev_read_sysfs(firewallgui_t)
+
+nscd_dontaudit_search_pid(firewallgui_t)
+nscd_socket_use(firewallgui_t)
+
+miscfiles_read_localization(firewallgui_t) +miscfiles_read_localization(firewallgui_t)
+ +
+iptables_domtrans(firewallgui_t) +userdom_dontaudit_search_user_home_dirs(firewallgui_t)
+iptables_initrc_domtrans(firewallgui_t) +
+nscd_dontaudit_search_pid(firewallgui_t)
+nscd_socket_use(firewallgui_t)
+ +
+optional_policy(` +optional_policy(`
+ gnome_read_gconf_home_files(firewallgui_t) + gnome_read_gconf_home_files(firewallgui_t)
@ -3700,7 +3701,7 @@ index 9a6d67d..47aa143 100644
## mozilla over dbus. ## mozilla over dbus.
## </summary> ## </summary>
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index cbf4bec..7243acc 100644 index cbf4bec..001dc99 100644
--- a/policy/modules/apps/mozilla.te --- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te +++ b/policy/modules/apps/mozilla.te
@@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t) @@ -25,6 +25,7 @@ files_config_file(mozilla_conf_t)
@ -3773,7 +3774,7 @@ index cbf4bec..7243acc 100644
pulseaudio_exec(mozilla_t) pulseaudio_exec(mozilla_t)
pulseaudio_stream_connect(mozilla_t) pulseaudio_stream_connect(mozilla_t)
pulseaudio_manage_home_files(mozilla_t) pulseaudio_manage_home_files(mozilla_t)
@@ -266,3 +291,91 @@ optional_policy(` @@ -266,3 +291,105 @@ optional_policy(`
optional_policy(` optional_policy(`
thunderbird_domtrans(mozilla_t) thunderbird_domtrans(mozilla_t)
') ')
@ -3783,14 +3784,17 @@ index cbf4bec..7243acc 100644
+# mozilla_plugin local policy +# mozilla_plugin local policy
+# +#
+allow mozilla_plugin_t self:process { setsched signal_perms execmem }; +allow mozilla_plugin_t self:process { setsched signal_perms execmem };
+allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
+allow mozilla_plugin_t self:tcp_socket create_socket_perms;
+allow mozilla_plugin_t self:udp_socket create_socket_perms;
+ +
+allow mozilla_plugin_t self:sem create_sem_perms; +allow mozilla_plugin_t self:sem create_sem_perms;
+allow mozilla_plugin_t self:shm create_shm_perms; +allow mozilla_plugin_t self:shm create_shm_perms;
+allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms; +allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
+allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms }; +allow mozilla_plugin_t self:unix_stream_socket { connectto create_stream_socket_perms };
+ +
+read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+can_exec(mozilla_plugin_t, mozilla_home_t) +can_exec(mozilla_plugin_t, mozilla_home_t)
+read_files_pattern(mozilla_plugin_t, mozilla_home_t, mozilla_home_t)
+ +
+manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) +manage_dirs_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
+manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t) +manage_files_pattern(mozilla_plugin_t, mozilla_plugin_tmp_t, mozilla_plugin_tmp_t)
@ -3816,6 +3820,7 @@ index cbf4bec..7243acc 100644
+dev_read_sysfs(mozilla_plugin_t) +dev_read_sysfs(mozilla_plugin_t)
+dev_read_sound(mozilla_plugin_t) +dev_read_sound(mozilla_plugin_t)
+dev_write_sound(mozilla_plugin_t) +dev_write_sound(mozilla_plugin_t)
+dev_dontaudit_rw_dri(mozilla_plugin_t)
+ +
+domain_use_interactive_fds(mozilla_plugin_t) +domain_use_interactive_fds(mozilla_plugin_t)
+domain_dontaudit_read_all_domains_state(mozilla_plugin_t) +domain_dontaudit_read_all_domains_state(mozilla_plugin_t)
@ -3832,14 +3837,23 @@ index cbf4bec..7243acc 100644
+term_getattr_all_ptys(mozilla_plugin_t) +term_getattr_all_ptys(mozilla_plugin_t)
+ +
+userdom_rw_user_tmpfs_files(mozilla_plugin_t) +userdom_rw_user_tmpfs_files(mozilla_plugin_t)
+userdom_delete_user_tmpfs_files(mozilla_plugin_t)
+userdom_stream_connect(mozilla_plugin_t) +userdom_stream_connect(mozilla_plugin_t)
+userdom_dontaudit_use_user_ptys(mozilla_plugin_t) +userdom_dontaudit_use_user_ptys(mozilla_plugin_t)
+ +
+userdom_list_user_tmp(mozilla_plugin_t)
+userdom_read_user_tmp_files(mozilla_plugin_t)
+userdom_read_user_tmp_symlinks(mozilla_plugin_t)
+userdom_read_user_home_content_files(mozilla_plugin_t)
+userdom_read_user_home_content_files(mozilla_plugin_t)
+userdom_read_user_home_content_symlinks(mozilla_plugin_t)
+
+optional_policy(` +optional_policy(`
+ alsa_read_rw_config(mozilla_plugin_t) + alsa_read_rw_config(mozilla_plugin_t)
+') +')
+ +
+optional_policy(` +optional_policy(`
+ dbus_session_bus_client(mozilla_plugin_t)
+ dbus_read_lib_files(mozilla_plugin_t) + dbus_read_lib_files(mozilla_plugin_t)
+') +')
+ +
@ -3853,6 +3867,7 @@ index cbf4bec..7243acc 100644
+ nsplugin_rw_exec(mozilla_plugin_t) + nsplugin_rw_exec(mozilla_plugin_t)
+ nsplugin_manage_home_dirs(mozilla_plugin_t) + nsplugin_manage_home_dirs(mozilla_plugin_t)
+ nsplugin_manage_home_files(mozilla_plugin_t) + nsplugin_manage_home_files(mozilla_plugin_t)
+ nsplugin_user_home_dir_filetrans(mozilla_plugin_t, dir)
+ nsplugin_signal(mozilla_plugin_t) + nsplugin_signal(mozilla_plugin_t)
+') +')
+ +
@ -3967,10 +3982,10 @@ index 0000000..63abc5c
+/usr/lib(64)?/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:nsplugin_rw_t,s0) +/usr/lib(64)?/mozilla/plugins-wrapped(/.*)? gen_context(system_u:object_r:nsplugin_rw_t,s0)
diff --git a/policy/modules/apps/nsplugin.if b/policy/modules/apps/nsplugin.if diff --git a/policy/modules/apps/nsplugin.if b/policy/modules/apps/nsplugin.if
new file mode 100644 new file mode 100644
index 0000000..9439746 index 0000000..4dbb161
--- /dev/null --- /dev/null
+++ b/policy/modules/apps/nsplugin.if +++ b/policy/modules/apps/nsplugin.if
@@ -0,0 +1,411 @@ @@ -0,0 +1,436 @@
+ +
+## <summary>policy for nsplugin</summary> +## <summary>policy for nsplugin</summary>
+ +
@ -4382,6 +4397,31 @@ index 0000000..9439746
+ +
+ allow $1 nsplugin_t:process signal; + allow $1 nsplugin_t:process signal;
+') +')
+
+########################################
+## <summary>
+## Create objects in a user home directory
+## with an automatic type transition to
+## the nsplugin home file type.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <param name="object_class">
+## <summary>
+## The class of the object to be created.
+## </summary>
+## </param>
+#
+interface(`nsplugin_user_home_dir_filetrans',`
+ gen_require(`
+ type nsplugin_home_t;
+ ')
+
+ userdom_user_home_content_filetrans($1, nsplugin_home_t, $2)
+')
diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te diff --git a/policy/modules/apps/nsplugin.te b/policy/modules/apps/nsplugin.te
new file mode 100644 new file mode 100644
index 0000000..7bc0dcf index 0000000..7bc0dcf
@ -6261,10 +6301,10 @@ index 0000000..3d12484
+') +')
diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te diff --git a/policy/modules/apps/telepathy.te b/policy/modules/apps/telepathy.te
new file mode 100644 new file mode 100644
index 0000000..aa34be4 index 0000000..c4fe796
--- /dev/null --- /dev/null
+++ b/policy/modules/apps/telepathy.te +++ b/policy/modules/apps/telepathy.te
@@ -0,0 +1,318 @@ @@ -0,0 +1,320 @@
+ +
+policy_module(telepathy, 1.0.0) +policy_module(telepathy, 1.0.0)
+ +
@ -6323,8 +6363,10 @@ index 0000000..aa34be4
+can_exec(telepathy_msn_t, telepathy_msn_tmp_t) +can_exec(telepathy_msn_t, telepathy_msn_tmp_t)
+ +
+corenet_sendrecv_http_client_packets(telepathy_msn_t) +corenet_sendrecv_http_client_packets(telepathy_msn_t)
+corenet_sendrecv_mmcc_client_packets(telepathy_msn_t)
+corenet_sendrecv_msnp_client_packets(telepathy_msn_t) +corenet_sendrecv_msnp_client_packets(telepathy_msn_t)
+corenet_tcp_connect_http_port(telepathy_msn_t) +corenet_tcp_connect_http_port(telepathy_msn_t)
+corenet_tcp_connect_mmcc_port(telepathy_msn_t)
+corenet_tcp_connect_msnp_port(telepathy_msn_t) +corenet_tcp_connect_msnp_port(telepathy_msn_t)
+corenet_tcp_connect_sametime_port(telepathy_msn_t) +corenet_tcp_connect_sametime_port(telepathy_msn_t)
+ +
@ -9628,10 +9670,17 @@ index 1875064..e9c9277 100644
+ sudo_role_template(dbadm, dbadm_r, dbadm_t) + sudo_role_template(dbadm, dbadm_r, dbadm_t)
+') +')
diff --git a/policy/modules/roles/guest.te b/policy/modules/roles/guest.te diff --git a/policy/modules/roles/guest.te b/policy/modules/roles/guest.te
index 531c616..321e5a7 100644 index 531c616..f332441 100644
--- a/policy/modules/roles/guest.te --- a/policy/modules/roles/guest.te
+++ b/policy/modules/roles/guest.te +++ b/policy/modules/roles/guest.te
@@ -14,4 +14,8 @@ userdom_restricted_user_template(guest) @@ -9,9 +9,15 @@ role guest_r;
userdom_restricted_user_template(guest)
+kernel_read_system_state(guest_t)
+
########################################
#
# Local policy # Local policy
# #
@ -15545,7 +15594,7 @@ index 1f11572..01b02f3 100644
') ')
diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te diff --git a/policy/modules/services/clamav.te b/policy/modules/services/clamav.te
index 8c36027..f9af97c 100644 index 8c36027..532fa91 100644
--- a/policy/modules/services/clamav.te --- a/policy/modules/services/clamav.te
+++ b/policy/modules/services/clamav.te +++ b/policy/modules/services/clamav.te
@@ -1,9 +1,9 @@ @@ -1,9 +1,9 @@
@ -15561,7 +15610,16 @@ index 8c36027..f9af97c 100644
## </desc> ## </desc>
gen_tunable(clamd_use_jit, false) gen_tunable(clamd_use_jit, false)
@@ -80,6 +80,7 @@ manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t) @@ -64,6 +64,8 @@ logging_log_file(freshclam_var_log_t)
allow clamd_t self:capability { kill setgid setuid dac_override };
dontaudit clamd_t self:capability sys_tty_config;
+allow clamd_t self:process signal;
+
allow clamd_t self:fifo_file rw_fifo_file_perms;
allow clamd_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow clamd_t self:unix_dgram_socket create_socket_perms;
@@ -80,6 +82,7 @@ manage_files_pattern(clamd_t, clamd_tmp_t, clamd_tmp_t)
files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir }) files_tmp_filetrans(clamd_t, clamd_tmp_t, { file dir })
# var/lib files for clamd # var/lib files for clamd
@ -15569,7 +15627,7 @@ index 8c36027..f9af97c 100644
manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t) manage_dirs_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t) manage_files_pattern(clamd_t, clamd_var_lib_t, clamd_var_lib_t)
@@ -89,9 +90,10 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t) @@ -89,9 +92,10 @@ manage_files_pattern(clamd_t, clamd_var_log_t, clamd_var_log_t)
logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file }) logging_log_filetrans(clamd_t, clamd_var_log_t, { dir file })
# pid file # pid file
@ -15581,7 +15639,7 @@ index 8c36027..f9af97c 100644
kernel_dontaudit_list_proc(clamd_t) kernel_dontaudit_list_proc(clamd_t)
kernel_read_sysctl(clamd_t) kernel_read_sysctl(clamd_t)
@@ -147,8 +149,10 @@ optional_policy(` @@ -147,8 +151,10 @@ optional_policy(`
tunable_policy(`clamd_use_jit',` tunable_policy(`clamd_use_jit',`
allow clamd_t self:process execmem; allow clamd_t self:process execmem;
@ -15593,7 +15651,7 @@ index 8c36027..f9af97c 100644
') ')
######################################## ########################################
@@ -178,10 +182,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file) @@ -178,10 +184,16 @@ files_pid_filetrans(freshclam_t, clamd_var_run_t, file)
# log files (own logfiles only) # log files (own logfiles only)
manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t) manage_files_pattern(freshclam_t, freshclam_var_log_t, freshclam_var_log_t)
@ -15612,7 +15670,7 @@ index 8c36027..f9af97c 100644
corenet_all_recvfrom_unlabeled(freshclam_t) corenet_all_recvfrom_unlabeled(freshclam_t)
corenet_all_recvfrom_netlabel(freshclam_t) corenet_all_recvfrom_netlabel(freshclam_t)
corenet_tcp_sendrecv_generic_if(freshclam_t) corenet_tcp_sendrecv_generic_if(freshclam_t)
@@ -189,6 +199,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t) @@ -189,6 +201,7 @@ corenet_tcp_sendrecv_generic_node(freshclam_t)
corenet_tcp_sendrecv_all_ports(freshclam_t) corenet_tcp_sendrecv_all_ports(freshclam_t)
corenet_tcp_sendrecv_clamd_port(freshclam_t) corenet_tcp_sendrecv_clamd_port(freshclam_t)
corenet_tcp_connect_http_port(freshclam_t) corenet_tcp_connect_http_port(freshclam_t)
@ -15620,7 +15678,7 @@ index 8c36027..f9af97c 100644
corenet_sendrecv_http_client_packets(freshclam_t) corenet_sendrecv_http_client_packets(freshclam_t)
dev_read_rand(freshclam_t) dev_read_rand(freshclam_t)
@@ -207,16 +218,18 @@ miscfiles_read_localization(freshclam_t) @@ -207,16 +220,18 @@ miscfiles_read_localization(freshclam_t)
clamav_stream_connect(freshclam_t) clamav_stream_connect(freshclam_t)
@ -15643,7 +15701,7 @@ index 8c36027..f9af97c 100644
######################################## ########################################
# #
# clamscam local policy # clamscam local policy
@@ -251,6 +264,7 @@ corenet_tcp_sendrecv_clamd_port(clamscan_t) @@ -251,6 +266,7 @@ corenet_tcp_sendrecv_clamd_port(clamscan_t)
corenet_tcp_connect_clamd_port(clamscan_t) corenet_tcp_connect_clamd_port(clamscan_t)
kernel_read_kernel_sysctls(clamscan_t) kernel_read_kernel_sysctls(clamscan_t)
@ -34842,7 +34900,7 @@ index 6f1e3c7..6a160b2 100644
+/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0) +/var/lib/pqsql/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
+ +
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index da2601a..ef2a773 100644 index da2601a..f963642 100644
--- a/policy/modules/services/xserver.if --- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if
@@ -19,9 +19,10 @@ @@ -19,9 +19,10 @@
@ -34924,14 +34982,16 @@ index da2601a..ef2a773 100644
xserver_xsession_entry_type($2) xserver_xsession_entry_type($2)
xserver_dontaudit_write_log($2) xserver_dontaudit_write_log($2)
xserver_stream_connect_xdm($2) xserver_stream_connect_xdm($2)
@@ -107,11 +115,23 @@ interface(`xserver_restricted_role',` @@ -106,12 +114,25 @@ interface(`xserver_restricted_role',`
xserver_create_xdm_tmp_sockets($2)
# Needed for escd, remove if we get escd policy # Needed for escd, remove if we get escd policy
xserver_manage_xdm_tmp_files($2) xserver_manage_xdm_tmp_files($2)
+ xserver_read_xdm_etc_files($2)
+
+ ifdef(`hide_broken_symptoms',` + ifdef(`hide_broken_symptoms',`
+ dontaudit iceauth_t $2:socket_class_set { read write }; + dontaudit iceauth_t $2:socket_class_set { read write };
+ ') + ')
+
# Client write xserver shm # Client write xserver shm
tunable_policy(`allow_write_xshm',` tunable_policy(`allow_write_xshm',`
allow $2 xserver_t:shm rw_shm_perms; allow $2 xserver_t:shm rw_shm_perms;
@ -34948,7 +35008,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -143,13 +163,15 @@ interface(`xserver_role',` @@ -143,13 +164,15 @@ interface(`xserver_role',`
allow $2 xserver_tmpfs_t:file rw_file_perms; allow $2 xserver_tmpfs_t:file rw_file_perms;
allow $2 iceauth_home_t:file manage_file_perms; allow $2 iceauth_home_t:file manage_file_perms;
@ -34966,7 +35026,7 @@ index da2601a..ef2a773 100644
relabel_dirs_pattern($2, user_fonts_t, user_fonts_t) relabel_dirs_pattern($2, user_fonts_t, user_fonts_t)
relabel_files_pattern($2, user_fonts_t, user_fonts_t) relabel_files_pattern($2, user_fonts_t, user_fonts_t)
@@ -162,7 +184,6 @@ interface(`xserver_role',` @@ -162,7 +185,6 @@ interface(`xserver_role',`
manage_files_pattern($2, user_fonts_config_t, user_fonts_config_t) manage_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
relabel_dirs_pattern($2, user_fonts_config_t, user_fonts_config_t) relabel_dirs_pattern($2, user_fonts_config_t, user_fonts_config_t)
relabel_files_pattern($2, user_fonts_config_t, user_fonts_config_t) relabel_files_pattern($2, user_fonts_config_t, user_fonts_config_t)
@ -34974,7 +35034,7 @@ index da2601a..ef2a773 100644
') ')
####################################### #######################################
@@ -197,7 +218,7 @@ interface(`xserver_ro_session',` @@ -197,7 +219,7 @@ interface(`xserver_ro_session',`
allow $1 xserver_t:process signal; allow $1 xserver_t:process signal;
# Read /tmp/.X0-lock # Read /tmp/.X0-lock
@ -34983,7 +35043,7 @@ index da2601a..ef2a773 100644
# Client read xserver shm # Client read xserver shm
allow $1 xserver_t:fd use; allow $1 xserver_t:fd use;
@@ -227,7 +248,7 @@ interface(`xserver_rw_session',` @@ -227,7 +249,7 @@ interface(`xserver_rw_session',`
type xserver_t, xserver_tmpfs_t; type xserver_t, xserver_tmpfs_t;
') ')
@ -34992,7 +35052,7 @@ index da2601a..ef2a773 100644
allow $1 xserver_t:shm rw_shm_perms; allow $1 xserver_t:shm rw_shm_perms;
allow $1 xserver_tmpfs_t:file rw_file_perms; allow $1 xserver_tmpfs_t:file rw_file_perms;
') ')
@@ -255,7 +276,7 @@ interface(`xserver_non_drawing_client',` @@ -255,7 +277,7 @@ interface(`xserver_non_drawing_client',`
allow $1 self:x_gc { create setattr }; allow $1 self:x_gc { create setattr };
@ -35001,7 +35061,7 @@ index da2601a..ef2a773 100644
allow $1 xserver_t:unix_stream_socket connectto; allow $1 xserver_t:unix_stream_socket connectto;
allow $1 xextension_t:x_extension { query use }; allow $1 xextension_t:x_extension { query use };
@@ -291,13 +312,13 @@ interface(`xserver_user_client',` @@ -291,13 +313,13 @@ interface(`xserver_user_client',`
allow $1 self:unix_stream_socket { connectto create_stream_socket_perms }; allow $1 self:unix_stream_socket { connectto create_stream_socket_perms };
# Read .Xauthority file # Read .Xauthority file
@ -35019,7 +35079,7 @@ index da2601a..ef2a773 100644
allow $1 xdm_tmp_t:sock_file { read write }; allow $1 xdm_tmp_t:sock_file { read write };
dontaudit $1 xdm_t:tcp_socket { read write }; dontaudit $1 xdm_t:tcp_socket { read write };
@@ -342,19 +363,23 @@ interface(`xserver_user_client',` @@ -342,19 +364,23 @@ interface(`xserver_user_client',`
# #
template(`xserver_common_x_domain_template',` template(`xserver_common_x_domain_template',`
gen_require(` gen_require(`
@ -35046,7 +35106,7 @@ index da2601a..ef2a773 100644
') ')
############################## ##############################
@@ -386,6 +411,15 @@ template(`xserver_common_x_domain_template',` @@ -386,6 +412,15 @@ template(`xserver_common_x_domain_template',`
allow $2 xevent_t:{ x_event x_synthetic_event } receive; allow $2 xevent_t:{ x_event x_synthetic_event } receive;
# dont audit send failures # dont audit send failures
dontaudit $2 input_xevent_type:x_event send; dontaudit $2 input_xevent_type:x_event send;
@ -35062,7 +35122,7 @@ index da2601a..ef2a773 100644
') ')
####################################### #######################################
@@ -444,8 +478,8 @@ template(`xserver_object_types_template',` @@ -444,8 +479,8 @@ template(`xserver_object_types_template',`
# #
template(`xserver_user_x_domain_template',` template(`xserver_user_x_domain_template',`
gen_require(` gen_require(`
@ -35073,7 +35133,7 @@ index da2601a..ef2a773 100644
') ')
allow $2 self:shm create_shm_perms; allow $2 self:shm create_shm_perms;
@@ -458,9 +492,9 @@ template(`xserver_user_x_domain_template',` @@ -458,9 +493,9 @@ template(`xserver_user_x_domain_template',`
# for when /tmp/.X11-unix is created by the system # for when /tmp/.X11-unix is created by the system
allow $2 xdm_t:fd use; allow $2 xdm_t:fd use;
@ -35085,7 +35145,7 @@ index da2601a..ef2a773 100644
dontaudit $2 xdm_t:tcp_socket { read write }; dontaudit $2 xdm_t:tcp_socket { read write };
# Allow connections to X server. # Allow connections to X server.
@@ -472,20 +506,25 @@ template(`xserver_user_x_domain_template',` @@ -472,20 +507,25 @@ template(`xserver_user_x_domain_template',`
# for .xsession-errors # for .xsession-errors
userdom_dontaudit_write_user_home_content_files($2) userdom_dontaudit_write_user_home_content_files($2)
@ -35113,7 +35173,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -517,6 +556,7 @@ interface(`xserver_use_user_fonts',` @@ -517,6 +557,7 @@ interface(`xserver_use_user_fonts',`
# Read per user fonts # Read per user fonts
allow $1 user_fonts_t:dir list_dir_perms; allow $1 user_fonts_t:dir list_dir_perms;
allow $1 user_fonts_t:file read_file_perms; allow $1 user_fonts_t:file read_file_perms;
@ -35121,7 +35181,7 @@ index da2601a..ef2a773 100644
# Manipulate the global font cache # Manipulate the global font cache
manage_dirs_pattern($1, user_fonts_cache_t, user_fonts_cache_t) manage_dirs_pattern($1, user_fonts_cache_t, user_fonts_cache_t)
@@ -545,6 +585,28 @@ interface(`xserver_domtrans_xauth',` @@ -545,6 +586,28 @@ interface(`xserver_domtrans_xauth',`
') ')
domtrans_pattern($1, xauth_exec_t, xauth_t) domtrans_pattern($1, xauth_exec_t, xauth_t)
@ -35150,7 +35210,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -598,6 +660,7 @@ interface(`xserver_read_user_xauth',` @@ -598,6 +661,7 @@ interface(`xserver_read_user_xauth',`
allow $1 xauth_home_t:file read_file_perms; allow $1 xauth_home_t:file read_file_perms;
userdom_search_user_home_dirs($1) userdom_search_user_home_dirs($1)
@ -35158,7 +35218,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -615,7 +678,7 @@ interface(`xserver_setattr_console_pipes',` @@ -615,7 +679,7 @@ interface(`xserver_setattr_console_pipes',`
type xconsole_device_t; type xconsole_device_t;
') ')
@ -35167,7 +35227,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -651,7 +714,7 @@ interface(`xserver_use_xdm_fds',` @@ -651,7 +715,7 @@ interface(`xserver_use_xdm_fds',`
type xdm_t; type xdm_t;
') ')
@ -35176,7 +35236,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -670,7 +733,7 @@ interface(`xserver_dontaudit_use_xdm_fds',` @@ -670,7 +734,7 @@ interface(`xserver_dontaudit_use_xdm_fds',`
type xdm_t; type xdm_t;
') ')
@ -35185,7 +35245,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -688,7 +751,7 @@ interface(`xserver_rw_xdm_pipes',` @@ -688,7 +752,7 @@ interface(`xserver_rw_xdm_pipes',`
type xdm_t; type xdm_t;
') ')
@ -35194,7 +35254,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -703,12 +766,11 @@ interface(`xserver_rw_xdm_pipes',` @@ -703,12 +767,11 @@ interface(`xserver_rw_xdm_pipes',`
## </param> ## </param>
# #
interface(`xserver_dontaudit_rw_xdm_pipes',` interface(`xserver_dontaudit_rw_xdm_pipes',`
@ -35208,7 +35268,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -724,11 +786,12 @@ interface(`xserver_dontaudit_rw_xdm_pipes',` @@ -724,11 +787,12 @@ interface(`xserver_dontaudit_rw_xdm_pipes',`
# #
interface(`xserver_stream_connect_xdm',` interface(`xserver_stream_connect_xdm',`
gen_require(` gen_require(`
@ -35223,7 +35283,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -765,7 +828,7 @@ interface(`xserver_setattr_xdm_tmp_dirs',` @@ -765,7 +829,7 @@ interface(`xserver_setattr_xdm_tmp_dirs',`
type xdm_tmp_t; type xdm_tmp_t;
') ')
@ -35232,7 +35292,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -805,7 +868,7 @@ interface(`xserver_read_xdm_pid',` @@ -805,7 +869,7 @@ interface(`xserver_read_xdm_pid',`
') ')
files_search_pids($1) files_search_pids($1)
@ -35241,7 +35301,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -897,7 +960,7 @@ interface(`xserver_getattr_log',` @@ -897,7 +961,7 @@ interface(`xserver_getattr_log',`
') ')
logging_search_logs($1) logging_search_logs($1)
@ -35250,7 +35310,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -916,7 +979,7 @@ interface(`xserver_dontaudit_write_log',` @@ -916,7 +980,7 @@ interface(`xserver_dontaudit_write_log',`
type xserver_log_t; type xserver_log_t;
') ')
@ -35259,7 +35319,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -963,6 +1026,45 @@ interface(`xserver_read_xkb_libs',` @@ -963,6 +1027,45 @@ interface(`xserver_read_xkb_libs',`
######################################## ########################################
## <summary> ## <summary>
@ -35305,7 +35365,7 @@ index da2601a..ef2a773 100644
## Read xdm temporary files. ## Read xdm temporary files.
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
@@ -976,7 +1078,7 @@ interface(`xserver_read_xdm_tmp_files',` @@ -976,7 +1079,7 @@ interface(`xserver_read_xdm_tmp_files',`
type xdm_tmp_t; type xdm_tmp_t;
') ')
@ -35314,7 +35374,7 @@ index da2601a..ef2a773 100644
read_files_pattern($1, xdm_tmp_t, xdm_tmp_t) read_files_pattern($1, xdm_tmp_t, xdm_tmp_t)
') ')
@@ -1052,7 +1154,7 @@ interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',` @@ -1052,7 +1155,7 @@ interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',`
type xdm_tmp_t; type xdm_tmp_t;
') ')
@ -35323,7 +35383,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -1070,8 +1172,10 @@ interface(`xserver_domtrans',` @@ -1070,8 +1173,10 @@ interface(`xserver_domtrans',`
type xserver_t, xserver_exec_t; type xserver_t, xserver_exec_t;
') ')
@ -35335,7 +35395,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -1185,6 +1289,7 @@ interface(`xserver_stream_connect',` @@ -1185,6 +1290,7 @@ interface(`xserver_stream_connect',`
files_search_tmp($1) files_search_tmp($1)
stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t) stream_connect_pattern($1, xserver_tmp_t, xserver_tmp_t, xserver_t)
@ -35343,7 +35403,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -1210,7 +1315,7 @@ interface(`xserver_read_tmp_files',` @@ -1210,7 +1316,7 @@ interface(`xserver_read_tmp_files',`
## <summary> ## <summary>
## Interface to provide X object permissions on a given X server to ## Interface to provide X object permissions on a given X server to
## an X client domain. Gives the domain permission to read the ## an X client domain. Gives the domain permission to read the
@ -35352,7 +35412,7 @@ index da2601a..ef2a773 100644
## </summary> ## </summary>
## <param name="domain"> ## <param name="domain">
## <summary> ## <summary>
@@ -1220,13 +1325,23 @@ interface(`xserver_read_tmp_files',` @@ -1220,13 +1326,23 @@ interface(`xserver_read_tmp_files',`
# #
interface(`xserver_manage_core_devices',` interface(`xserver_manage_core_devices',`
gen_require(` gen_require(`
@ -35377,7 +35437,7 @@ index da2601a..ef2a773 100644
') ')
######################################## ########################################
@@ -1243,10 +1358,355 @@ interface(`xserver_manage_core_devices',` @@ -1243,10 +1359,355 @@ interface(`xserver_manage_core_devices',`
# #
interface(`xserver_unconfined',` interface(`xserver_unconfined',`
gen_require(` gen_require(`
@ -35736,7 +35796,7 @@ index da2601a..ef2a773 100644
+ manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t) + manage_files_pattern($1, user_fonts_config_t, user_fonts_config_t)
+') +')
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index e226da4..c80794b 100644 index e226da4..6c6f684 100644
--- a/policy/modules/services/xserver.te --- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te
@@ -26,27 +26,43 @@ gen_require(` @@ -26,27 +26,43 @@ gen_require(`
@ -36294,7 +36354,7 @@ index e226da4..c80794b 100644
userdom_dontaudit_use_unpriv_user_fds(xdm_t) userdom_dontaudit_use_unpriv_user_fds(xdm_t)
userdom_create_all_users_keys(xdm_t) userdom_create_all_users_keys(xdm_t)
@@ -473,10 +640,25 @@ userdom_read_user_home_content_files(xdm_t) @@ -473,9 +640,25 @@ userdom_read_user_home_content_files(xdm_t)
# Search /proc for any user domain processes. # Search /proc for any user domain processes.
userdom_read_all_users_state(xdm_t) userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t) userdom_signal_all_users(xdm_t)
@ -36308,7 +36368,8 @@ index e226da4..c80794b 100644
xserver_rw_session(xdm_t, xdm_tmpfs_t) xserver_rw_session(xdm_t, xdm_tmpfs_t)
xserver_unconfined(xdm_t) xserver_unconfined(xdm_t)
+xserver_domtrans_xauth(xdm_t)
+
+ifndef(`distro_redhat',` +ifndef(`distro_redhat',`
+ allow xdm_t self:process { execheap execmem }; + allow xdm_t self:process { execheap execmem };
+') +')
@ -36316,11 +36377,10 @@ index e226da4..c80794b 100644
+ifdef(`distro_rhel4',` +ifdef(`distro_rhel4',`
+ allow xdm_t self:process { execheap execmem }; + allow xdm_t self:process { execheap execmem };
+') +')
+
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xdm_t) fs_manage_nfs_dirs(xdm_t)
fs_manage_nfs_files(xdm_t) @@ -504,11 +687,17 @@ tunable_policy(`xdm_sysadm_login',`
@@ -504,11 +686,17 @@ tunable_policy(`xdm_sysadm_login',`
') ')
optional_policy(` optional_policy(`
@ -36338,7 +36398,7 @@ index e226da4..c80794b 100644
') ')
optional_policy(` optional_policy(`
@@ -516,12 +704,49 @@ optional_policy(` @@ -516,12 +705,49 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -36388,7 +36448,7 @@ index e226da4..c80794b 100644
hostname_exec(xdm_t) hostname_exec(xdm_t)
') ')
@@ -539,28 +764,63 @@ optional_policy(` @@ -539,28 +765,63 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -36461,7 +36521,7 @@ index e226da4..c80794b 100644
') ')
optional_policy(` optional_policy(`
@@ -572,6 +832,10 @@ optional_policy(` @@ -572,6 +833,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -36472,7 +36532,7 @@ index e226da4..c80794b 100644
xfs_stream_connect(xdm_t) xfs_stream_connect(xdm_t)
') ')
@@ -596,7 +860,7 @@ allow xserver_t input_xevent_t:x_event send; @@ -596,7 +861,7 @@ allow xserver_t input_xevent_t:x_event send;
# execheap needed until the X module loader is fixed. # execheap needed until the X module loader is fixed.
# NVIDIA Needs execstack # NVIDIA Needs execstack
@ -36481,7 +36541,7 @@ index e226da4..c80794b 100644
dontaudit xserver_t self:capability chown; dontaudit xserver_t self:capability chown;
allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
allow xserver_t self:fd use; allow xserver_t self:fd use;
@@ -610,6 +874,14 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto }; @@ -610,6 +875,14 @@ allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };
allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
allow xserver_t self:tcp_socket create_stream_socket_perms; allow xserver_t self:tcp_socket create_stream_socket_perms;
allow xserver_t self:udp_socket create_socket_perms; allow xserver_t self:udp_socket create_socket_perms;
@ -36496,7 +36556,7 @@ index e226da4..c80794b 100644
manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t) manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)
@@ -629,12 +901,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) @@ -629,12 +902,19 @@ manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t) manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)
files_search_var_lib(xserver_t) files_search_var_lib(xserver_t)
@ -36518,7 +36578,7 @@ index e226da4..c80794b 100644
kernel_read_system_state(xserver_t) kernel_read_system_state(xserver_t)
kernel_read_device_sysctls(xserver_t) kernel_read_device_sysctls(xserver_t)
@@ -642,6 +921,7 @@ kernel_read_modprobe_sysctls(xserver_t) @@ -642,6 +922,7 @@ kernel_read_modprobe_sysctls(xserver_t)
# Xorg wants to check if kernel is tainted # Xorg wants to check if kernel is tainted
kernel_read_kernel_sysctls(xserver_t) kernel_read_kernel_sysctls(xserver_t)
kernel_write_proc_files(xserver_t) kernel_write_proc_files(xserver_t)
@ -36526,7 +36586,7 @@ index e226da4..c80794b 100644
# Run helper programs in xserver_t. # Run helper programs in xserver_t.
corecmd_exec_bin(xserver_t) corecmd_exec_bin(xserver_t)
@@ -668,7 +948,6 @@ dev_rw_apm_bios(xserver_t) @@ -668,7 +949,6 @@ dev_rw_apm_bios(xserver_t)
dev_rw_agp(xserver_t) dev_rw_agp(xserver_t)
dev_rw_framebuffer(xserver_t) dev_rw_framebuffer(xserver_t)
dev_manage_dri_dev(xserver_t) dev_manage_dri_dev(xserver_t)
@ -36534,7 +36594,7 @@ index e226da4..c80794b 100644
dev_create_generic_dirs(xserver_t) dev_create_generic_dirs(xserver_t)
dev_setattr_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t)
# raw memory access is needed if not using the frame buffer # raw memory access is needed if not using the frame buffer
@@ -678,8 +957,13 @@ dev_wx_raw_memory(xserver_t) @@ -678,8 +958,13 @@ dev_wx_raw_memory(xserver_t)
dev_rw_xserver_misc(xserver_t) dev_rw_xserver_misc(xserver_t)
# read events - the synaptics touchpad driver reads raw events # read events - the synaptics touchpad driver reads raw events
dev_rw_input_dev(xserver_t) dev_rw_input_dev(xserver_t)
@ -36548,7 +36608,7 @@ index e226da4..c80794b 100644
files_read_etc_files(xserver_t) files_read_etc_files(xserver_t)
files_read_etc_runtime_files(xserver_t) files_read_etc_runtime_files(xserver_t)
files_read_usr_files(xserver_t) files_read_usr_files(xserver_t)
@@ -693,8 +977,13 @@ fs_getattr_xattr_fs(xserver_t) @@ -693,8 +978,13 @@ fs_getattr_xattr_fs(xserver_t)
fs_search_nfs(xserver_t) fs_search_nfs(xserver_t)
fs_search_auto_mountpoints(xserver_t) fs_search_auto_mountpoints(xserver_t)
fs_search_ramfs(xserver_t) fs_search_ramfs(xserver_t)
@ -36562,7 +36622,7 @@ index e226da4..c80794b 100644
selinux_validate_context(xserver_t) selinux_validate_context(xserver_t)
selinux_compute_access_vector(xserver_t) selinux_compute_access_vector(xserver_t)
@@ -716,11 +1005,14 @@ logging_send_audit_msgs(xserver_t) @@ -716,11 +1006,14 @@ logging_send_audit_msgs(xserver_t)
miscfiles_read_localization(xserver_t) miscfiles_read_localization(xserver_t)
miscfiles_read_fonts(xserver_t) miscfiles_read_fonts(xserver_t)
@ -36577,7 +36637,7 @@ index e226da4..c80794b 100644
userdom_search_user_home_dirs(xserver_t) userdom_search_user_home_dirs(xserver_t)
userdom_use_user_ttys(xserver_t) userdom_use_user_ttys(xserver_t)
@@ -773,12 +1065,28 @@ optional_policy(` @@ -773,12 +1066,28 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -36607,7 +36667,7 @@ index e226da4..c80794b 100644
unconfined_domtrans(xserver_t) unconfined_domtrans(xserver_t)
') ')
@@ -787,6 +1095,10 @@ optional_policy(` @@ -787,6 +1096,10 @@ optional_policy(`
') ')
optional_policy(` optional_policy(`
@ -36618,7 +36678,7 @@ index e226da4..c80794b 100644
xfs_stream_connect(xserver_t) xfs_stream_connect(xserver_t)
') ')
@@ -802,10 +1114,10 @@ allow xserver_t xdm_t:shm rw_shm_perms; @@ -802,10 +1115,10 @@ allow xserver_t xdm_t:shm rw_shm_perms;
# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open # NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open
# handle of a file inside the dir!!! # handle of a file inside the dir!!!
@ -36632,7 +36692,7 @@ index e226da4..c80794b 100644
# Label pid and temporary files with derived types. # Label pid and temporary files with derived types.
manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
@@ -813,7 +1125,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) @@ -813,7 +1126,7 @@ manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t) manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)
# Run xkbcomp. # Run xkbcomp.
@ -36641,7 +36701,7 @@ index e226da4..c80794b 100644
can_exec(xserver_t, xkb_var_lib_t) can_exec(xserver_t, xkb_var_lib_t)
# VNC v4 module in X server # VNC v4 module in X server
@@ -826,6 +1138,9 @@ init_use_fds(xserver_t) @@ -826,6 +1139,9 @@ init_use_fds(xserver_t)
# to read ROLE_home_t - examine this in more detail # to read ROLE_home_t - examine this in more detail
# (xauth?) # (xauth?)
userdom_read_user_home_content_files(xserver_t) userdom_read_user_home_content_files(xserver_t)
@ -36651,7 +36711,7 @@ index e226da4..c80794b 100644
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xserver_t) fs_manage_nfs_dirs(xserver_t)
@@ -841,11 +1156,14 @@ tunable_policy(`use_samba_home_dirs',` @@ -841,11 +1157,14 @@ tunable_policy(`use_samba_home_dirs',`
optional_policy(` optional_policy(`
dbus_system_bus_client(xserver_t) dbus_system_bus_client(xserver_t)
@ -36668,7 +36728,7 @@ index e226da4..c80794b 100644
') ')
optional_policy(` optional_policy(`
@@ -853,6 +1171,10 @@ optional_policy(` @@ -853,6 +1172,10 @@ optional_policy(`
rhgb_rw_tmpfs_files(xserver_t) rhgb_rw_tmpfs_files(xserver_t)
') ')
@ -36679,7 +36739,7 @@ index e226da4..c80794b 100644
######################################## ########################################
# #
# Rules common to all X window domains # Rules common to all X window domains
@@ -896,7 +1218,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy @@ -896,7 +1219,7 @@ allow x_domain xproperty_t:x_property { getattr create read write append destroy
allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show }; allow x_domain root_xdrawable_t:x_drawable { getattr setattr list_child add_child remove_child send receive hide show };
# operations allowed on my windows # operations allowed on my windows
allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; allow x_domain self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
@ -36688,7 +36748,7 @@ index e226da4..c80794b 100644
# operations allowed on all windows # operations allowed on all windows
allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child }; allow x_domain x_domain:x_drawable { getattr get_property set_property remove_child };
@@ -950,11 +1272,31 @@ allow x_domain self:x_resource { read write }; @@ -950,11 +1273,31 @@ allow x_domain self:x_resource { read write };
# can mess with the screensaver # can mess with the screensaver
allow x_domain xserver_t:x_screen { getattr saver_getattr }; allow x_domain xserver_t:x_screen { getattr saver_getattr };
@ -36720,7 +36780,7 @@ index e226da4..c80794b 100644
tunable_policy(`! xserver_object_manager',` tunable_policy(`! xserver_object_manager',`
# should be xserver_unconfined(x_domain), # should be xserver_unconfined(x_domain),
# but typeattribute doesnt work in conditionals # but typeattribute doesnt work in conditionals
@@ -976,18 +1318,32 @@ tunable_policy(`! xserver_object_manager',` @@ -976,18 +1319,32 @@ tunable_policy(`! xserver_object_manager',`
allow x_domain xevent_type:{ x_event x_synthetic_event } *; allow x_domain xevent_type:{ x_event x_synthetic_event } *;
') ')

19
selinux-policy.spec
View File

@ -20,7 +20,7 @@
Summary: SELinux policy configuration Summary: SELinux policy configuration
Name: selinux-policy Name: selinux-policy
Version: 3.9.5 Version: 3.9.5
Release: 5%{?dist} Release: 7%{?dist}
License: GPLv2+ License: GPLv2+
Group: System Environment/Base Group: System Environment/Base
Source: serefpolicy-%{version}.tgz Source: serefpolicy-%{version}.tgz
@ -469,6 +469,23 @@ exit 0
%endif %endif
%changelog %changelog
* Mon Sep 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-7
- Fixes to allow mozilla_plugin_t to create nsplugin_home_t directory.
- Allow mozilla_plugin_t to create tcp/udp/netlink_route sockets
- Allow confined users to read xdm_etc_t files
- Allow xdm_t to transition to xauth_t for lxdm program
* Sun Sep 26 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-6
- Rearrange firewallgui policy to be more easily updated to upstream, dontaudit search of /home
- Allow clamd to send signals to itself
- Allow mozilla_plugin_t to read user home content. And unlink pulseaudio shm.
- Allow haze to connect to yahoo chat and messenger port tcp:5050.
Bz #637339
- Allow guest to run ps command on its processes by allowing it to read /proc
- Allow firewallgui to sys_rawio which seems to be required to setup masqerading
- Allow all domains to search through default_t directories, in order to find differnet labels. For example people serring up /foo/bar to be share via samba.
- Add label for /var/log/slim.log
* Fri Sep 24 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-5 * Fri Sep 24 2010 Dan Walsh <dwalsh@redhat.com> 3.9.5-5
- Pull in cleanups from dgrift - Pull in cleanups from dgrift
- Allow mozilla_plugin_t to execute mozilla_home_t - Allow mozilla_plugin_t to execute mozilla_home_t