add pulseaudio from dan.
This commit is contained in:
Chris PeBenito
parent
7395f80119
commit
9b1907b217
@ -29,6 +29,7 @@
|
||||
pads (Dan Walsh)
|
||||
pingd (Dan Walsh)
|
||||
policykit (Dan Walsh)
|
||||
pulseaudio (Dan Walsh)
|
||||
psad (Dan Walsh)
|
||||
portreserve (Dan Walsh)
|
||||
sssd (Dan Walsh)
|
||||
|
||||
1
policy/modules/apps/pulseaudio.fc
Normal file
1
policy/modules/apps/pulseaudio.fc
Normal file
@ -0,0 +1 @@
|
||||
/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0)
|
||||
145
policy/modules/apps/pulseaudio.if
Normal file
145
policy/modules/apps/pulseaudio.if
Normal file
@ -0,0 +1,145 @@
|
||||
## <summary>Pulseaudio network sound server.</summary>
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Role access for pulseaudio
|
||||
## </summary>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## Role allowed access
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## User domain for the role
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_role',`
|
||||
gen_require(`
|
||||
type pulseaudio_t, pulseaudio_exec_t, print_spool_t;
|
||||
class dbus { send_msg };
|
||||
')
|
||||
|
||||
role $1 types pulseaudio_t;
|
||||
|
||||
# Transition from the user domain to the derived domain.
|
||||
domtrans_pattern($2, pulseaudio_exec_t, pulseaudio_t)
|
||||
|
||||
ps_process_pattern($2, pulseaudio_t)
|
||||
|
||||
allow pulseaudio_t $2:process { signal signull };
|
||||
allow $2 pulseaudio_t:process { signal signull };
|
||||
ps_process_pattern(pulseaudio_t, $2)
|
||||
|
||||
allow pulseaudio_t $2:unix_stream_socket connectto;
|
||||
allow $2 pulseaudio_t:unix_stream_socket connectto;
|
||||
|
||||
userdom_manage_home_role($1, pulseaudio_t)
|
||||
userdom_manage_tmp_role($1, pulseaudio_t)
|
||||
userdom_manage_tmpfs_role($1, pulseaudio_t)
|
||||
|
||||
allow $2 pulseaudio_t:dbus send_msg;
|
||||
allow pulseaudio_t $2:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a domain transition to run pulseaudio.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_domtrans',`
|
||||
gen_require(`
|
||||
type pulseaudio_t, pulseaudio_exec_t;
|
||||
')
|
||||
|
||||
domtrans_pattern($1,pulseaudio_exec_t,pulseaudio_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute pulseaudio in the pulseaudio domain, and
|
||||
## allow the specified role the pulseaudio domain.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
## <param name="role">
|
||||
## <summary>
|
||||
## The role to be allowed the pulseaudio domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_run',`
|
||||
gen_require(`
|
||||
type pulseaudio_t;
|
||||
')
|
||||
|
||||
pulseaudio_domtrans($1)
|
||||
role $2 types pulseaudio_t;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Execute a pulseaudio in the current domain
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed to transition.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_exec',`
|
||||
gen_require(`
|
||||
type pulseaudio_exec_t;
|
||||
')
|
||||
|
||||
can_exec($1,pulseaudio_exec_t)
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## Send and receive messages from
|
||||
## pulseaudio over dbus.
|
||||
## </summary>
|
||||
## <param name="domain">
|
||||
## <summary>
|
||||
## Domain allowed access.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_dbus_chat',`
|
||||
gen_require(`
|
||||
type pulseaudio_t;
|
||||
class dbus send_msg;
|
||||
')
|
||||
|
||||
allow $1 pulseaudio_t:dbus send_msg;
|
||||
allow pulseaudio_t $1:dbus send_msg;
|
||||
')
|
||||
|
||||
########################################
|
||||
## <summary>
|
||||
## pulsaudio connection template.
|
||||
## </summary>
|
||||
## <param name="user_domain">
|
||||
## <summary>
|
||||
## The type of the user domain.
|
||||
## </summary>
|
||||
## </param>
|
||||
#
|
||||
interface(`pulseaudio_stream_connect',`
|
||||
gen_require(`
|
||||
type pulseaudio_t;
|
||||
')
|
||||
|
||||
allow $1 pulseaudio_t:process signull;
|
||||
allow $1 pulseaudio_t:unix_stream_socket connectto;
|
||||
')
|
||||
92
policy/modules/apps/pulseaudio.te
Normal file
92
policy/modules/apps/pulseaudio.te
Normal file
@ -0,0 +1,92 @@
|
||||
|
||||
policy_module(pulseaudio,1.0.0)
|
||||
|
||||
########################################
|
||||
#
|
||||
# Declarations
|
||||
#
|
||||
|
||||
type pulseaudio_t;
|
||||
type pulseaudio_exec_t;
|
||||
application_domain(pulseaudio_t, pulseaudio_exec_t)
|
||||
role system_r types pulseaudio_t;
|
||||
|
||||
########################################
|
||||
#
|
||||
# pulseaudio local policy
|
||||
#
|
||||
|
||||
allow pulseaudio_t self:process { getcap setcap setrlimit setsched getsched signal signull };
|
||||
allow pulseaudio_t self:fifo_file rw_file_perms;
|
||||
allow pulseaudio_t self:unix_stream_socket create_stream_socket_perms;
|
||||
allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms };
|
||||
allow pulseaudio_t self:tcp_socket create_stream_socket_perms;
|
||||
allow pulseaudio_t self:udp_socket create_socket_perms;
|
||||
|
||||
kernel_read_kernel_sysctls(pulseaudio_t)
|
||||
|
||||
corecmd_exec_bin(pulseaudio_t)
|
||||
|
||||
corenet_all_recvfrom_unlabeled(pulseaudio_t)
|
||||
corenet_all_recvfrom_netlabel(pulseaudio_t)
|
||||
corenet_tcp_bind_pulseaudio_port(pulseaudio_t)
|
||||
corenet_tcp_bind_soundd_port(pulseaudio_t)
|
||||
corenet_tcp_sendrecv_generic_if(pulseaudio_t)
|
||||
corenet_tcp_sendrecv_generic_node(pulseaudio_t)
|
||||
corenet_udp_bind_sap_port(pulseaudio_t)
|
||||
corenet_udp_sendrecv_generic_if(pulseaudio_t)
|
||||
corenet_udp_sendrecv_generic_node(pulseaudio_t)
|
||||
|
||||
dev_read_sound(pulseaudio_t)
|
||||
dev_write_sound(pulseaudio_t)
|
||||
dev_read_sysfs(pulseaudio_t)
|
||||
dev_read_urand(pulseaudio_t)
|
||||
|
||||
files_read_etc_files(pulseaudio_t)
|
||||
files_read_usr_files(pulseaudio_t)
|
||||
|
||||
fs_rw_anon_inodefs_files(pulseaudio_t)
|
||||
fs_getattr_tmpfs(pulseaudio_t)
|
||||
|
||||
term_use_all_user_ttys(pulseaudio_t)
|
||||
term_use_all_user_ptys(pulseaudio_t)
|
||||
|
||||
auth_use_nsswitch(pulseaudio_t)
|
||||
|
||||
logging_send_syslog_msg(pulseaudio_t)
|
||||
|
||||
miscfiles_read_localization(pulseaudio_t)
|
||||
|
||||
optional_policy(`
|
||||
gnome_manage_config(pulseaudio_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
dbus_system_bus_client(pulseaudio_t)
|
||||
dbus_session_bus_client(pulseaudio_t)
|
||||
|
||||
optional_policy(`
|
||||
consolekit_dbus_chat(pulseaudio_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
hal_dbus_chat(pulseaudio_t)
|
||||
')
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
policykit_domtrans_auth(pulseaudio_t)
|
||||
policykit_read_lib(pulseaudio_t)
|
||||
policykit_read_reload(pulseaudio_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
udev_read_db(pulseaudio_t)
|
||||
')
|
||||
|
||||
optional_policy(`
|
||||
xserver_read_xdm_pid(pulseaudio_t)
|
||||
xserver_manage_xdm_tmp_files(pulseaudio_t)
|
||||
xserver_read_xdm_lib_files(pulseaudio_t)
|
||||
')
|
||||
|
||||
@ -168,6 +168,7 @@ network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0)
|
||||
network_port(rsh, tcp,514,s0)
|
||||
network_port(rsync, tcp,873,s0, udp,873,s0)
|
||||
network_port(rwho, udp,513,s0)
|
||||
network_port(sap, tcp,9875,s0, udp,9875,s0)
|
||||
network_port(smbd, tcp,137-139,s0, tcp,445,s0)
|
||||
network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0)
|
||||
network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user