Dbus patch from Dan Walsh.
This commit is contained in:
parent
61738f11ec
commit
98ac98623c
@ -88,7 +88,7 @@ template(`dbus_role_template',`
|
|||||||
files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir })
|
files_tmp_filetrans($1_dbusd_t, session_dbusd_tmp_t, { file dir })
|
||||||
|
|
||||||
domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
|
domtrans_pattern($3, dbusd_exec_t, $1_dbusd_t)
|
||||||
allow $3 $1_dbusd_t:process { sigkill signal };
|
allow $3 $1_dbusd_t:process { signull sigkill signal };
|
||||||
|
|
||||||
# cjp: this seems very broken
|
# cjp: this seems very broken
|
||||||
corecmd_bin_domtrans($1_dbusd_t, $3)
|
corecmd_bin_domtrans($1_dbusd_t, $3)
|
||||||
@ -127,6 +127,7 @@ template(`dbus_role_template',`
|
|||||||
fs_getattr_romfs($1_dbusd_t)
|
fs_getattr_romfs($1_dbusd_t)
|
||||||
fs_getattr_xattr_fs($1_dbusd_t)
|
fs_getattr_xattr_fs($1_dbusd_t)
|
||||||
fs_list_inotifyfs($1_dbusd_t)
|
fs_list_inotifyfs($1_dbusd_t)
|
||||||
|
fs_dontaudit_list_nfs($1_dbusd_t)
|
||||||
|
|
||||||
selinux_get_fs_mount($1_dbusd_t)
|
selinux_get_fs_mount($1_dbusd_t)
|
||||||
selinux_validate_context($1_dbusd_t)
|
selinux_validate_context($1_dbusd_t)
|
||||||
@ -146,6 +147,8 @@ template(`dbus_role_template',`
|
|||||||
seutil_read_config($1_dbusd_t)
|
seutil_read_config($1_dbusd_t)
|
||||||
seutil_read_default_contexts($1_dbusd_t)
|
seutil_read_default_contexts($1_dbusd_t)
|
||||||
|
|
||||||
|
term_use_all_terms($1_dbusd_t)
|
||||||
|
|
||||||
userdom_read_user_home_content_files($1_dbusd_t)
|
userdom_read_user_home_content_files($1_dbusd_t)
|
||||||
|
|
||||||
ifdef(`hide_broken_symptoms', `
|
ifdef(`hide_broken_symptoms', `
|
||||||
@ -256,7 +259,46 @@ interface(`dbus_read_config',`
|
|||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Connect to the the session DBUS
|
## Read system dbus lib files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`dbus_read_lib_files',`
|
||||||
|
gen_require(`
|
||||||
|
type system_dbusd_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
files_search_var_lib($1)
|
||||||
|
read_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Create, read, write, and delete
|
||||||
|
## system dbus lib files.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Domain allowed access.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`dbus_manage_lib_files',`
|
||||||
|
gen_require(`
|
||||||
|
type system_dbusd_var_lib_t;
|
||||||
|
')
|
||||||
|
|
||||||
|
files_search_var_lib($1)
|
||||||
|
manage_files_pattern($1, system_dbusd_var_lib_t, system_dbusd_var_lib_t)
|
||||||
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Connect to the system DBUS
|
||||||
## for service (acquire_svc).
|
## for service (acquire_svc).
|
||||||
## </summary>
|
## </summary>
|
||||||
## <param name="domain">
|
## <param name="domain">
|
||||||
@ -274,6 +316,34 @@ interface(`dbus_connect_session_bus',`
|
|||||||
allow $1 session_bus_type:dbus acquire_svc;
|
allow $1 session_bus_type:dbus acquire_svc;
|
||||||
')
|
')
|
||||||
|
|
||||||
|
########################################
|
||||||
|
## <summary>
|
||||||
|
## Allow a application domain to be started
|
||||||
|
## by the session dbus.
|
||||||
|
## </summary>
|
||||||
|
## <param name="domain">
|
||||||
|
## <summary>
|
||||||
|
## Type to be used as a domain.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
## <param name="entry_point">
|
||||||
|
## <summary>
|
||||||
|
## Type of the program to be used as an
|
||||||
|
## entry point to this domain.
|
||||||
|
## </summary>
|
||||||
|
## </param>
|
||||||
|
#
|
||||||
|
interface(`dbus_session_domain',`
|
||||||
|
gen_require(`
|
||||||
|
attribute session_bus_type;
|
||||||
|
')
|
||||||
|
|
||||||
|
domtrans_pattern(session_bus_type, $2, $1)
|
||||||
|
|
||||||
|
dbus_session_bus_client($1)
|
||||||
|
dbus_connect_session_bus($1)
|
||||||
|
')
|
||||||
|
|
||||||
########################################
|
########################################
|
||||||
## <summary>
|
## <summary>
|
||||||
## Connect to the system DBUS
|
## Connect to the system DBUS
|
||||||
@ -364,6 +434,10 @@ interface(`dbus_system_domain',`
|
|||||||
dbus_system_bus_client($1)
|
dbus_system_bus_client($1)
|
||||||
dbus_connect_system_bus($1)
|
dbus_connect_system_bus($1)
|
||||||
|
|
||||||
|
ps_process_pattern(system_dbusd_t, $1)
|
||||||
|
|
||||||
|
userdom_read_all_users_state($1)
|
||||||
|
|
||||||
ifdef(`hide_broken_symptoms', `
|
ifdef(`hide_broken_symptoms', `
|
||||||
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
|
dontaudit $1 system_dbusd_t:netlink_selinux_socket { read write };
|
||||||
')
|
')
|
||||||
|
@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
policy_module(dbus, 1.12.0)
|
policy_module(dbus, 1.12.1)
|
||||||
|
|
||||||
gen_require(`
|
gen_require(`
|
||||||
class dbus all_dbus_perms;
|
class dbus all_dbus_perms;
|
||||||
@ -86,6 +86,7 @@ dev_read_urand(system_dbusd_t)
|
|||||||
dev_read_sysfs(system_dbusd_t)
|
dev_read_sysfs(system_dbusd_t)
|
||||||
|
|
||||||
fs_getattr_all_fs(system_dbusd_t)
|
fs_getattr_all_fs(system_dbusd_t)
|
||||||
|
fs_list_inotifyfs(system_dbusd_t)
|
||||||
fs_search_auto_mountpoints(system_dbusd_t)
|
fs_search_auto_mountpoints(system_dbusd_t)
|
||||||
fs_dontaudit_list_nfs(system_dbusd_t)
|
fs_dontaudit_list_nfs(system_dbusd_t)
|
||||||
|
|
||||||
@ -121,6 +122,7 @@ files_read_usr_files(system_dbusd_t)
|
|||||||
|
|
||||||
init_use_fds(system_dbusd_t)
|
init_use_fds(system_dbusd_t)
|
||||||
init_use_script_ptys(system_dbusd_t)
|
init_use_script_ptys(system_dbusd_t)
|
||||||
|
init_domtrans_script(system_dbusd_t)
|
||||||
|
|
||||||
logging_send_audit_msgs(system_dbusd_t)
|
logging_send_audit_msgs(system_dbusd_t)
|
||||||
logging_send_syslog_msg(system_dbusd_t)
|
logging_send_syslog_msg(system_dbusd_t)
|
||||||
@ -140,6 +142,7 @@ optional_policy(`
|
|||||||
')
|
')
|
||||||
|
|
||||||
optional_policy(`
|
optional_policy(`
|
||||||
|
policykit_dbus_chat(system_dbusd_t)
|
||||||
policykit_domtrans_auth(system_dbusd_t)
|
policykit_domtrans_auth(system_dbusd_t)
|
||||||
policykit_search_lib(system_dbusd_t)
|
policykit_search_lib(system_dbusd_t)
|
||||||
')
|
')
|
||||||
|
Loading…
Reference in New Issue
Block a user