From e5e55ace89604239054b20c7d7b33969f1a195b9 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Thu, 28 Jun 2007 12:34:08 +0000 Subject: [PATCH] trunk, strict-targeted-merge: add mmap_zero to xserver domains. --- policy/modules/services/xserver.if | 3 +++ policy/modules/services/xserver.te | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index 47faddf6..0a32465c 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -48,6 +48,7 @@ template(`xserver_common_domain_template',` allow $1_xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service }; dontaudit $1_xserver_t self:capability chown; allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow $1_xserver_t self:memprotect mmap_zero; allow $1_xserver_t self:fd use; allow $1_xserver_t self:fifo_file rw_fifo_file_perms; allow $1_xserver_t self:sock_file read_sock_file_perms; @@ -126,6 +127,8 @@ template(`xserver_common_domain_template',` dev_rw_input_dev($1_xserver_t) dev_rwx_zero($1_xserver_t) + domain_mmap_low($1_xserver_t) + files_read_etc_files($1_xserver_t) files_read_etc_runtime_files($1_xserver_t) files_read_usr_files($1_xserver_t) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index bd0eea84..d3bef117 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,1.4.2) +policy_module(xserver,1.4.3) ######################################## #