## X Windows Server ####################################### ## ## Template to create types and rules common to ## all X server domains. ## ## ## ## The prefix of the domain (e.g., user ## is the prefix for user_t). ## ## # template(`xserver_common_domain_template',` gen_require(` type xkb_var_lib_t, xserver_exec_t, xserver_log_t; attribute x_server_domain; class x_drawable all_x_drawable_perms; class x_colormap all_x_colormap_perms; class x_screen all_x_screen_perms; ') ############################## # # Declarations # attribute $1_x_domain; attribute $1_input_xevent_type; type $1_rootwindow_t, rootwindow_type; type $1_xserver_t, x_server_domain; domain_type($1_xserver_t) domain_entry_file($1_xserver_t,xserver_exec_t) type $1_xserver_tmp_t; files_tmp_file($1_xserver_tmp_t) type $1_xserver_tmpfs_t; files_tmpfs_file($1_xserver_tmpfs_t) ############################## # # $1_xserver_t local policy # # setuid/setgid for the wrapper program to change UID # sys_rawio is for iopl access - should not be needed for frame-buffer # sys_admin, locking shared mem? chowning IPC message queues or semaphores? # admin of APM bios? # sys_nice is so that the X server can set a negative nice value # execheap needed until the X module loader is fixed. # NVIDIA Needs execstack allow $1_xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service }; dontaudit $1_xserver_t self:capability chown; allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; allow $1_xserver_t self:memprotect mmap_zero; allow $1_xserver_t self:fd use; allow $1_xserver_t self:fifo_file rw_fifo_file_perms; allow $1_xserver_t self:sock_file read_sock_file_perms; allow $1_xserver_t self:shm create_shm_perms; allow $1_xserver_t self:sem create_sem_perms; allow $1_xserver_t self:msgq create_msgq_perms; allow $1_xserver_t self:msg { send receive }; allow $1_xserver_t self:unix_dgram_socket { create_socket_perms sendto }; allow $1_xserver_t self:unix_stream_socket { create_stream_socket_perms connectto }; allow $1_xserver_t self:tcp_socket create_stream_socket_perms; allow $1_xserver_t self:udp_socket create_socket_perms; manage_dirs_pattern($1_xserver_t,$1_xserver_tmp_t,$1_xserver_tmp_t) manage_files_pattern($1_xserver_t,$1_xserver_tmp_t,$1_xserver_tmp_t) manage_sock_files_pattern($1_xserver_t,$1_xserver_tmp_t,$1_xserver_tmp_t) files_tmp_filetrans($1_xserver_t, $1_xserver_tmp_t, { file dir sock_file }) filetrans_pattern($1_xserver_t,xdm_xserver_tmp_t,$1_xserver_tmp_t,sock_file) manage_dirs_pattern($1_xserver_t,$1_xserver_tmpfs_t,$1_xserver_tmpfs_t) manage_files_pattern($1_xserver_t,$1_xserver_tmpfs_t,$1_xserver_tmpfs_t) manage_lnk_files_pattern($1_xserver_t,$1_xserver_tmpfs_t,$1_xserver_tmpfs_t) manage_fifo_files_pattern($1_xserver_t,$1_xserver_tmpfs_t,$1_xserver_tmpfs_t) manage_sock_files_pattern($1_xserver_t,$1_xserver_tmpfs_t,$1_xserver_tmpfs_t) fs_tmpfs_filetrans($1_xserver_t,$1_xserver_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) manage_files_pattern($1_xserver_t,xkb_var_lib_t,xkb_var_lib_t) manage_lnk_files_pattern($1_xserver_t,xkb_var_lib_t,xkb_var_lib_t) files_search_var_lib($1_xserver_t) # Create files in /var/log with the xserver_log_t type. manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t) logging_log_filetrans($1_xserver_t,xserver_log_t,file) # Labeling rules for default windows and colormaps type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t; kernel_read_system_state($1_xserver_t) kernel_read_device_sysctls($1_xserver_t) kernel_read_modprobe_sysctls($1_xserver_t) # Xorg wants to check if kernel is tainted kernel_read_kernel_sysctls($1_xserver_t) kernel_write_proc_files($1_xserver_t) # Run helper programs in $1_xserver_t. corecmd_exec_bin($1_xserver_t) corecmd_exec_shell($1_xserver_t) corenet_all_recvfrom_unlabeled($1_xserver_t) corenet_all_recvfrom_netlabel($1_xserver_t) corenet_tcp_sendrecv_generic_if($1_xserver_t) corenet_udp_sendrecv_generic_if($1_xserver_t) corenet_tcp_sendrecv_all_nodes($1_xserver_t) corenet_udp_sendrecv_all_nodes($1_xserver_t) corenet_tcp_sendrecv_all_ports($1_xserver_t) corenet_udp_sendrecv_all_ports($1_xserver_t) corenet_tcp_bind_all_nodes($1_xserver_t) corenet_tcp_bind_xserver_port($1_xserver_t) corenet_tcp_connect_all_ports($1_xserver_t) corenet_sendrecv_xserver_server_packets($1_xserver_t) corenet_sendrecv_all_client_packets($1_xserver_t) dev_rw_sysfs($1_xserver_t) dev_rw_mouse($1_xserver_t) dev_rw_mtrr($1_xserver_t) dev_rw_apm_bios($1_xserver_t) dev_rw_agp($1_xserver_t) dev_rw_framebuffer($1_xserver_t) dev_manage_dri_dev($1_xserver_t) dev_create_generic_dirs($1_xserver_t) dev_setattr_generic_dirs($1_xserver_t) # raw memory access is needed if not using the frame buffer dev_read_raw_memory($1_xserver_t) dev_wx_raw_memory($1_xserver_t) # for other device nodes such as the NVidia binary-only driver dev_rw_xserver_misc($1_xserver_t) # read events - the synaptics touchpad driver reads raw events dev_rw_input_dev($1_xserver_t) dev_rwx_zero($1_xserver_t) domain_mmap_low($1_xserver_t) files_read_etc_files($1_xserver_t) files_read_etc_runtime_files($1_xserver_t) files_read_usr_files($1_xserver_t) # brought on by rhgb files_search_mnt($1_xserver_t) # for nscd files_dontaudit_search_pids($1_xserver_t) fs_getattr_xattr_fs($1_xserver_t) fs_search_nfs($1_xserver_t) fs_search_auto_mountpoints($1_xserver_t) fs_search_ramfs($1_xserver_t) selinux_validate_context($1_xserver_t) selinux_compute_access_vector($1_xserver_t) selinux_compute_create_context($1_xserver_t) auth_use_nsswitch($1_xserver_t) init_getpgid($1_xserver_t) term_setattr_unallocated_ttys($1_xserver_t) term_use_unallocated_ttys($1_xserver_t) libs_use_ld_so($1_xserver_t) libs_use_shared_libs($1_xserver_t) logging_send_syslog_msg($1_xserver_t) logging_send_audit_msgs($1_xserver_t) miscfiles_read_localization($1_xserver_t) miscfiles_read_fonts($1_xserver_t) modutils_domtrans_insmod($1_xserver_t) # read x_contexts seutil_read_default_contexts($1_xserver_t) ifndef(`distro_redhat',` allow $1_xserver_t self:process { execmem execheap execstack }; ') ifdef(`distro_rhel4',` allow $1_xserver_t self:process { execmem execheap execstack }; ') tunable_policy(`!xserver_object_manager',` # should be xserver_unconfined($1_xserver_t), # but typeattribute doesnt work in conditionals gen_require(` attribute x_server_domain, x_domain; attribute xproperty_type, xselection_type; attribute xextension_type, xevent_type; attribute rootwindow_type; type remote_xclient_t; ') allow $1_xserver_t x_server_domain:x_server *; allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *; allow $1_xserver_t x_server_domain:x_screen *; allow $1_xserver_t x_domain:x_gc *; allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *; allow $1_xserver_t xproperty_type:x_property *; allow $1_xserver_t xselection_type:x_selection *; allow $1_xserver_t x_domain:x_cursor *; allow $1_xserver_t { x_domain remote_xclient_t }:x_client *; allow $1_xserver_t { x_domain x_server_domain }:x_device *; allow $1_xserver_t xextension_type:x_extension *; allow $1_xserver_t { x_domain x_server_domain }:x_resource *; allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *; ') optional_policy(` apm_stream_connect($1_xserver_t) ') optional_policy(` auth_search_pam_console_data($1_xserver_t) ') optional_policy(` rhgb_getpgid($1_xserver_t) rhgb_signal($1_xserver_t) ') optional_policy(` xfs_stream_connect($1_xserver_t) ') ') ####################################### ## ## The per role template for the xserver module. ## ## ##

## Define a derived domain for the X server when executed ## by a user domain (e.g. via startx). See the xdm module ## if using an X Display Manager. ##

##

## This is invoked automatically for each user and ## generally does not need to be invoked directly ## by policy writers. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The type of the user domain. ## ## ## ## ## The role associated with the user domain. ## ## # template(`xserver_per_role_template',` gen_require(` type iceauth_exec_t, xauth_exec_t; attribute fonts_type, fonts_cache_type, fonts_config_type; ') ############################## # # Declarations # xserver_common_domain_template($1) role $3 types $1_xserver_t; type $1_fonts_t, fonts_type; userdom_user_home_content($1,$1_fonts_t) type $1_fonts_cache_t, fonts_cache_type; userdom_user_home_content($1,$1_fonts_cache_t) type $1_fonts_config_t, fonts_config_type; userdom_user_home_content($1,$1_fonts_cache_t) type $1_iceauth_t; domain_type($1_iceauth_t) domain_entry_file($1_iceauth_t,iceauth_exec_t) role $3 types $1_iceauth_t; type $1_iceauth_home_t alias $1_iceauth_rw_t; files_poly_member($1_iceauth_home_t) userdom_user_home_content($1,$1_iceauth_home_t) type $1_xauth_t; domain_type($1_xauth_t) domain_entry_file($1_xauth_t,xauth_exec_t) role $3 types $1_xauth_t; type $1_xauth_home_t alias $1_xauth_rw_t, xauth_home_type; files_poly_member($1_xauth_home_t) userdom_user_home_content($1,$1_xauth_home_t) type $1_xauth_tmp_t; files_tmp_file($1_xauth_tmp_t) ############################## # # $1_xserver_t Local policy # domtrans_pattern($1_xserver_t, xauth_exec_t, $1_xauth_t) allow $1_xserver_t $1_xauth_home_t:file { getattr read }; domtrans_pattern($2, xserver_exec_t, $1_xserver_t) allow $1_xserver_t $2:process signal; allow $1_xserver_t $2:shm rw_shm_perms; manage_dirs_pattern($2,$1_fonts_t,$1_fonts_t) manage_files_pattern($2,$1_fonts_t,$1_fonts_t) relabel_dirs_pattern($2,$1_fonts_t,$1_fonts_t) relabel_files_pattern($2,$1_fonts_t,$1_fonts_t) manage_dirs_pattern($2,$1_fonts_config_t,$1_fonts_config_t) manage_files_pattern($2,$1_fonts_config_t,$1_fonts_config_t) relabel_files_pattern($2,$1_fonts_config_t,$1_fonts_config_t) # For startup relabel allow $2 $1_fonts_cache_t:{ dir file } { relabelto relabelfrom }; stream_connect_pattern($2,$1_xserver_tmp_t,$1_xserver_tmp_t,$1_xserver_t) allow $2 $1_xserver_tmpfs_t:file rw_file_perms; # Communicate via System V shared memory. allow $1_xserver_t $2:shm rw_shm_perms; allow $2 $1_xserver_t:shm rw_shm_perms; getty_use_fds($1_xserver_t) locallogin_use_fds($1_xserver_t) userdom_search_user_home_dirs($1,$1_xserver_t) userdom_use_user_ttys($1,$1_xserver_t) userdom_setattr_user_ttys($1,$1_xserver_t) userdom_rw_user_tmpfs_files($1,$1_xserver_t) xserver_use_user_fonts($1,$1_xserver_t) xserver_rw_xdm_tmp_files($1_xauth_t) optional_policy(` userhelper_search_config($1_xserver_t) ') ifdef(`TODO',` ifdef(`xdm.te', ` allow $1_t xdm_tmp_t:sock_file unlink; allow $1_xserver_t xdm_var_run_t:dir search; ') ') dnl end TODO ############################## # # $1_xauth_t Local policy # allow $1_xauth_t self:process signal; allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms; allow $1_xauth_t $1_xauth_home_t:file manage_file_perms; userdom_user_home_dir_filetrans($1,$1_xauth_t,$1_xauth_home_t,file) manage_dirs_pattern($1_xauth_t,$1_xauth_tmp_t,$1_xauth_tmp_t) manage_files_pattern($1_xauth_t,$1_xauth_tmp_t,$1_xauth_tmp_t) files_tmp_filetrans($1_xauth_t, $1_xauth_tmp_t, { file dir }) domtrans_pattern($2, xauth_exec_t, $1_xauth_t) allow $2 $1_xauth_t:process signal; # allow ps to show xauth ps_process_pattern($2,$1_xauth_t) allow $2 $1_xauth_home_t:file manage_file_perms; allow $2 $1_xauth_home_t:file { relabelfrom relabelto }; allow xdm_t $1_xauth_home_t:file manage_file_perms; userdom_user_home_dir_filetrans($1,xdm_t,$1_xauth_home_t,file) domain_use_interactive_fds($1_xauth_t) files_read_etc_files($1_xauth_t) files_search_pids($1_xauth_t) fs_getattr_xattr_fs($1_xauth_t) fs_search_auto_mountpoints($1_xauth_t) # cjp: why? term_use_ptmx($1_xauth_t) auth_use_nsswitch($1_xauth_t) libs_use_ld_so($1_xauth_t) libs_use_shared_libs($1_xauth_t) userdom_use_user_terminals($1,$1_xauth_t) userdom_read_user_tmp_files($1,$1_xauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files($1_xauth_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files($1_xauth_t) ') optional_policy(` ssh_sigchld($1_xauth_t) ssh_read_pipes($1_xauth_t) ssh_dontaudit_rw_tcp_sockets($1_xauth_t) ') ############################## # # $1_iceauth_t Local policy # domtrans_pattern($2, iceauth_exec_t, $1_iceauth_t) allow $1_iceauth_t $1_iceauth_home_t:file manage_file_perms; userdom_user_home_dir_filetrans($1,$1_iceauth_t,$1_iceauth_home_t,file) # allow ps to show iceauth ps_process_pattern($2,$1_iceauth_t) allow $2 $1_iceauth_home_t:file manage_file_perms; allow $2 $1_iceauth_home_t:file { relabelfrom relabelto }; allow xdm_t $1_iceauth_home_t:file read_file_perms; fs_search_auto_mountpoints($1_iceauth_t) libs_use_ld_so($1_iceauth_t) libs_use_shared_libs($1_iceauth_t) userdom_use_user_terminals($1,$1_iceauth_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_files($1_iceauth_t) ') tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files($1_iceauth_t) ') ############################## # # User X object manager local policy # # Device rules allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell }; allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send; allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send; # manage: xhost X11:ChangeHosts # freeze: metacity X11:GrabKey # force_cursor: metacity X11:GrabPointer allow $2 $1_xserver_t:x_device { manage freeze force_cursor }; # gnome-settings-daemon XKEYBOARD:SetControls allow $2 $1_xserver_t:x_server manage; # gnome-settings-daemon RANDR:SelectInput allow $2 $1_xserver_t:x_resource write; # metacity X11:InstallColormap X11:UninstallColormap allow $2 $1_rootwindow_t:x_colormap { install uninstall }; # read: gnome-settings-daemon RANDR:GetScreenSizeRange # write: gnome-settings-daemon RANDR:SelectInput # setattr: gnome-settings-daemon X11:GrabKey # manage: metacity X11:ChangeWindowAttributes allow $2 $1_rootwindow_t:x_drawable { read write manage setattr }; # setattr: metacity X11:InstallColormap allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr }; # xrdb X11:ChangeProperty prop=RESOURCE_MANAGER allow $2 info_xproperty_t:x_property { create write append }; mls_xwin_read_to_clearance($1_xserver_t) xserver_common_x_domain_template($1,$1,$2) ') ####################################### ## ## Template for creating sessions on a ## prefix X server, with read-only ## access to the X server shared ## memory segments. ## ## ## ## The prefix of the domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the domain SYSV tmpfs files. ## ## # template(`xserver_ro_session_template',` gen_require(` type $1_xserver_t, $1_xserver_tmp_t, $1_xserver_tmpfs_t; ') # Xserver read/write client shm allow $1_xserver_t $2:fd use; allow $1_xserver_t $2:shm rw_shm_perms; allow $1_xserver_t $3:file rw_file_perms; # Connect to xserver allow $2 $1_xserver_t:unix_stream_socket connectto; allow $2 $1_xserver_t:process signal; # Read /tmp/.X0-lock allow $2 $1_xserver_tmp_t:file { getattr read }; # Client read xserver shm allow $2 $1_xserver_t:fd use; allow $2 $1_xserver_t:shm r_shm_perms; allow $2 $1_xserver_tmpfs_t:file read_file_perms; ') ####################################### ## ## Template for creating sessions on a ## prefix X server, with read and write ## access to the X server shared ## memory segments. ## ## ## ## The prefix of the domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the domain SYSV tmpfs files. ## ## # template(`xserver_rw_session_template',` gen_require(` type $1_xserver_t, $1_xserver_tmpfs_t; ') xserver_ro_session_template($1,$2,$3) allow $2 $1_xserver_t:shm rw_shm_perms; allow $2 $1_xserver_tmpfs_t:file rw_file_perms; ') ####################################### ## ## Template for creating full client sessions ## on a user X server. ## ## ## ## The prefix of the domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## ## ## ## The type of the domain SYSV tmpfs files. ## ## # template(`xserver_user_client_template',` # refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.') gen_require(` type xdm_t, xdm_tmp_t; type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t; ') allow $2 self:shm create_shm_perms; allow $2 self:unix_dgram_socket create_socket_perms; allow $2 self:unix_stream_socket { connectto create_stream_socket_perms }; # Read .Xauthority file allow $2 $1_xauth_home_t:file { getattr read }; allow $2 $1_iceauth_home_t:file { getattr read }; # for when /tmp/.X11-unix is created by the system allow $2 xdm_t:fd use; allow $2 xdm_t:fifo_file { getattr read write ioctl }; allow $2 xdm_tmp_t:dir search; allow $2 xdm_tmp_t:sock_file { read write }; dontaudit $2 xdm_t:tcp_socket { read write }; # Allow connections to X server. files_search_tmp($2) miscfiles_read_fonts($2) userdom_search_user_home_dirs($1,$2) # for .xsession-errors userdom_dontaudit_write_user_home_content_files($1,$2) xserver_ro_session_template(xdm,$2,$3) xserver_rw_session_template($1,$2,$3) xserver_use_user_fonts($1,$2) xserver_read_xdm_tmp_files($2) # Client write xserver shm tunable_policy(`allow_write_xshm',` allow $2 $1_xserver_t:shm rw_shm_perms; allow $2 $1_xserver_tmpfs_t:file rw_file_perms; ') ') ####################################### ## ## Interface to provide X object permissions on a given X server to ## an X client domain. Provides the minimal set required by a basic ## X client application. ## ## ## ## The prefix of the X server domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The prefix of the X client domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Client domain allowed access. ## ## # template(`xserver_common_x_domain_template',` gen_require(` type $1_rootwindow_t, std_xext_t, shmem_xext_t; type xproperty_t, info_xproperty_t, clipboard_xproperty_t; type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t; type xevent_t, client_xevent_t; type clipboard_xselection_t, xselection_t; attribute x_server_domain, x_domain; attribute xproperty_type; attribute xevent_type, xextension_type; attribute $1_x_domain, $1_input_xevent_type; class x_drawable all_x_drawable_perms; class x_screen all_x_screen_perms; class x_gc all_x_gc_perms; class x_font all_x_font_perms; class x_colormap all_x_colormap_perms; class x_property all_x_property_perms; class x_selection all_x_selection_perms; class x_cursor all_x_cursor_perms; class x_client all_x_client_perms; class x_device all_x_device_perms; class x_server all_x_server_perms; class x_extension all_x_extension_perms; class x_resource all_x_resource_perms; class x_event all_x_event_perms; class x_synthetic_event all_x_synthetic_event_perms; ') ############################## # # Declarations # # Type attributes typeattribute $3 $1_x_domain, x_domain; # Types for properties type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type; # Types for events type $2_input_xevent_t, $1_input_xevent_type, xevent_type; type $2_property_xevent_t, xevent_type; type $2_focus_xevent_t, xevent_type; type $2_manage_xevent_t, xevent_type; type $2_default_xevent_t, xevent_type; type $2_client_xevent_t, xevent_type; ############################## # # Local Policy # # Hacks # everyone can get the input focus of everyone else # this is a fundamental brokenness in the X protocol allow $3 { x_domain x_server_domain }:x_device getfocus; # everyone can grab the server # everyone does it, it is basically a free DOS attack allow $3 x_server_domain:x_server grab; # everyone can get the font path, etc. # this could leak out sensitive information allow $3 x_server_domain:x_server getattr; # everyone can do override-redirect windows. # this could be used to spoof labels allow $3 self:x_drawable override; # everyone can receive management events on the root window # allows to know when new windows appear, among other things allow $3 manage_xevent_t:x_event receive; # X Server # can read server-owned resources allow $3 x_server_domain:x_resource read; # can mess with own clients allow $3 self:x_client { manage destroy }; # X Protocol Extensions allow $3 std_xext_t:x_extension { query use }; allow $3 shmem_xext_t:x_extension { query use }; dontaudit $3 xextension_type:x_extension { query use }; # X Properties # can read and write client properties allow $3 $2_xproperty_t:x_property { create destroy read write append }; type_transition $3 xproperty_t:x_property $2_xproperty_t; # can read and write cut buffers allow $3 clipboard_xproperty_t:x_property { create read write append }; # can read info properties allow $3 info_xproperty_t:x_property read; # can change properties of root window allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property }; # can change properties of own windows allow $3 self:x_drawable { list_property get_property set_property }; # X Windows # operations allowed on root windows allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive }; # operations allowed on my windows allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; type_transition $3 $1_rootwindow_t:x_drawable $3; # X Colormaps # can use the default colormap allow $3 $1_rootwindow_t:x_colormap { read use add_color }; # X Input # can receive own events allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive; allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive; allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive; allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive; allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive; allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive; type_transition $3 input_xevent_t:x_event $2_input_xevent_t; type_transition $3 property_xevent_t:x_event $2_property_xevent_t; type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t; type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t; type_transition $3 client_xevent_t:x_event $2_client_xevent_t; type_transition $3 xevent_t:x_event $2_default_xevent_t; # can receive certain root window events allow $3 focus_xevent_t:x_event receive; allow $3 property_xevent_t:x_event receive; allow $3 client_xevent_t:x_synthetic_event receive; allow $3 manage_xevent_t:x_synthetic_event receive; # can send ICCCM events to myself allow $3 $2_manage_xevent_t:x_synthetic_event send; # can send ICCCM events to the root window allow $3 manage_xevent_t:x_synthetic_event send; allow $3 client_xevent_t:x_synthetic_event send; # X Selections # can use the clipboard allow $3 clipboard_xselection_t:x_selection { getattr setattr read }; # can query all other selections allow $3 xselection_t:x_selection { getattr read }; # Other X Objects # can create and use cursors allow $3 self:x_cursor *; # can create and use graphics contexts allow $3 self:x_gc *; # can create and use colormaps allow $3 self:x_colormap *; # can read and write own objects allow $3 self:x_resource { read write }; tunable_policy(`! xserver_object_manager',` # should be xserver_unconfined($3), # but typeattribute doesnt work in conditionals gen_require(` attribute x_server_domain, x_domain; attribute xproperty_type, xselection_type; attribute xextension_type, xevent_type; attribute rootwindow_type; type remote_xclient_t; ') allow $3 x_server_domain:x_server *; allow $3 { x_domain rootwindow_type }:x_drawable *; allow $3 x_server_domain:x_screen *; allow $3 x_domain:x_gc *; allow $3 { x_domain rootwindow_type }:x_colormap *; allow $3 xproperty_type:x_property *; allow $3 xselection_type:x_selection *; allow $3 x_domain:x_cursor *; allow $3 { x_domain remote_xclient_t }:x_client *; allow $3 { x_domain x_server_domain }:x_device *; allow $3 xextension_type:x_extension *; allow $3 { x_domain x_server_domain }:x_resource *; allow $3 xevent_type:{ x_event x_synthetic_event } *; ') ') ####################################### ## ## Interface to provide X object permissions on a given X server to ## an X client domain. Provides the minimal set required by a basic ## X client application. ## ## ## ## The prefix of the X server domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The prefix of the X client domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Client domain allowed access. ## ## ## ## ## The type of the domain SYSV tmpfs files. ## ## # template(`xserver_user_x_domain_template',` gen_require(` type xdm_t, xdm_tmp_t; type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t; ') allow $3 self:shm create_shm_perms; allow $3 self:unix_dgram_socket create_socket_perms; allow $3 self:unix_stream_socket { connectto create_stream_socket_perms }; # Read .Xauthority file allow $3 $1_xauth_home_t:file { getattr read }; allow $3 $1_iceauth_home_t:file { getattr read }; # for when /tmp/.X11-unix is created by the system allow $3 xdm_t:fd use; allow $3 xdm_t:fifo_file { getattr read write ioctl }; allow $3 xdm_tmp_t:dir search; allow $3 xdm_tmp_t:sock_file { read write }; dontaudit $3 xdm_t:tcp_socket { read write }; # Allow connections to X server. files_search_tmp($3) miscfiles_read_fonts($3) userdom_search_user_home_dirs($1,$3) # for .xsession-errors userdom_dontaudit_write_user_home_content_files($1,$3) xserver_ro_session_template(xdm,$3,$4) xserver_rw_session_template($1,$3,$4) xserver_use_user_fonts($1,$3) xserver_read_xdm_tmp_files($3) # X object manager xserver_common_x_domain_template($1,$2,$3) # Client write xserver shm tunable_policy(`allow_write_xshm',` allow $3 $1_xserver_t:shm rw_shm_perms; allow $3 $1_xserver_tmpfs_t:file rw_file_perms; ') ') ######################################## ## ## Read user fonts, user font configuration, ## and manage the user font cache. ## ## ##

## Read user fonts, user font configuration, ## and manage the user font cache. ##

##

## This is a templated interface, and should only ## be called from a per-userdomain template. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## # template(`xserver_use_user_fonts',` gen_require(` type $1_fonts_t, $1_fonts_cache_t, $1_fonts_config_t; ') # Read per user fonts allow $2 $1_fonts_t:dir list_dir_perms; allow $2 $1_fonts_t:file read_file_perms; # Manipulate the global font cache manage_dirs_pattern($2,$1_fonts_cache_t,$1_fonts_cache_t) manage_files_pattern($2,$1_fonts_cache_t,$1_fonts_cache_t) # Read per user font config allow $2 $1_fonts_config_t:dir list_dir_perms; allow $2 $1_fonts_config_t:file read_file_perms; userdom_search_user_home_dirs($1,$2) ') ######################################## ## ## Transition to a user Xauthority domain. ## ## ##

## Transition to a user Xauthority domain. ##

##

## This is a templated interface, and should only ## be called from a per-userdomain template. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## # template(`xserver_domtrans_user_xauth',` gen_require(` type $1_xauth_t, xauth_exec_t; ') domtrans_pattern($2, xauth_exec_t, $1_xauth_t) ') ######################################## ## ## Transition to a user Xauthority domain. ## ## ##

## Transition to a user Xauthority domain. ##

##

## This is a templated interface, and should only ## be called from a per-userdomain template. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## Domain allowed access. ## ## # template(`xserver_user_home_dir_filetrans_user_xauth',` gen_require(` type $1_xauth_home_t; ') userdom_user_home_dir_filetrans($1, $2, $1_xauth_home_t, file) ') ######################################## ## ## Read all users fonts, user font configurations, ## and manage all users font caches. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_use_all_users_fonts',` gen_require(` attribute fonts_type, fonts_cache_type, fonts_config_type; ') # Read per user fonts allow $1 fonts_type:dir list_dir_perms; allow $1 fonts_type:file read_file_perms; # Manipulate the global font cache manage_dirs_pattern($1,fonts_cache_type,fonts_cache_type) manage_files_pattern($1,fonts_cache_type,fonts_cache_type) # Read per user font config allow $1 fonts_config_type:dir list_dir_perms; allow $1 fonts_config_type:file read_file_perms; userdom_search_all_users_home_dirs($1) ') ######################################## ## ## Read all users .Xauthority. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_read_all_users_xauth',` gen_require(` attribute xauth_home_type; ') allow $1 xauth_home_type:file read_file_perms; userdom_search_all_users_home_dirs($1) ') ######################################## ## ## Set the attributes of the X windows console named pipes. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_setattr_console_pipes',` gen_require(` type xconsole_device_t; ') allow $1 xconsole_device_t:fifo_file setattr; ') ######################################## ## ## Read and write the X windows console named pipe. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_rw_console',` gen_require(` type xconsole_device_t; ') allow $1 xconsole_device_t:fifo_file rw_fifo_file_perms; ') ######################################## ## ## Use file descriptors for xdm. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_use_xdm_fds',` gen_require(` type xdm_t; ') allow $1 xdm_t:fd use; ') ######################################## ## ## Do not audit attempts to inherit ## XDM file descriptors. ## ## ## ## Domain to not audit. ## ## # interface(`xserver_dontaudit_use_xdm_fds',` gen_require(` type xdm_t; ') dontaudit $1 xdm_t:fd use; ') ######################################## ## ## Read and write XDM unnamed pipes. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_rw_xdm_pipes',` gen_require(` type xdm_t; ') allow $1 xdm_t:fifo_file { getattr read write }; ') ######################################## ## ## Do not audit attempts to read and write ## XDM unnamed pipes. ## ## ## ## Domain to not audit. ## ## # interface(`xserver_dontaudit_rw_xdm_pipes',` gen_require(` type xdm_t; ') dontaudit $1 xdm_t:fifo_file rw_fifo_file_perms; ') ######################################## ## ## Connect to XDM over a unix domain ## stream socket. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_stream_connect_xdm',` gen_require(` type xdm_t, xdm_tmp_t; ') files_search_tmp($1) stream_connect_pattern($1,xdm_tmp_t,xdm_tmp_t,xdm_t) ') ######################################## ## ## Read xdm-writable configuration files. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_read_xdm_rw_config',` gen_require(` type xdm_rw_etc_t; ') files_search_etc($1) allow $1 xdm_rw_etc_t:file { getattr read }; ') ######################################## ## ## Set the attributes of XDM temporary directories. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_setattr_xdm_tmp_dirs',` gen_require(` type xdm_tmp_t; ') allow $1 xdm_tmp_t:dir setattr; ') ######################################## ## ## Create a named socket in a XDM ## temporary directory. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_create_xdm_tmp_sockets',` gen_require(` type xdm_tmp_t; ') files_search_tmp($1) allow $1 xdm_tmp_t:dir list_dir_perms; create_sock_files_pattern($1,xdm_tmp_t,xdm_tmp_t) ') ######################################## ## ## Read XDM pid files. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_read_xdm_pid',` gen_require(` type xdm_var_run_t; ') files_search_pids($1) allow $1 xdm_var_run_t:file read_file_perms; ') ######################################## ## ## Read XDM var lib files. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_read_xdm_lib_files',` gen_require(` type xdm_var_lib_t; ') allow $1 xdm_var_lib_t:file { getattr read }; ') ######################################## ## ## Execute the X server in the XDM X server domain. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_domtrans_xdm_xserver',` gen_require(` type xdm_xserver_t, xserver_exec_t; ') allow $1 xdm_xserver_t:process siginh; domtrans_pattern($1,xserver_exec_t,xdm_xserver_t) ') ######################################## ## ## Make an X session script an entrypoint for the specified domain. ## ## ## ## The domain for which the shell is an entrypoint. ## ## # interface(`xserver_xsession_entry_type',` gen_require(` type xsession_exec_t; ') domain_entry_file($1,xsession_exec_t) ') ######################################## ## ## Execute an X session in the target domain. This ## is an explicit transition, requiring the ## caller to use setexeccon(). ## ## ##

## Execute an Xsession in the target domain. This ## is an explicit transition, requiring the ## caller to use setexeccon(). ##

##

## No interprocess communication (signals, pipes, ## etc.) is provided by this interface since ## the domains are not owned by this module. ##

##
## ## ## Domain allowed access. ## ## ## ## ## The type of the shell process. ## ## # interface(`xserver_xsession_spec_domtrans',` gen_require(` type xsession_exec_t; ') domain_trans($1,xsession_exec_t,$2) ') ######################################## ## ## Get the attributes of X server logs. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_getattr_log',` gen_require(` type xserver_log_t; ') logging_search_logs($1) allow $1 xserver_log_t:file getattr; ') ######################################## ## ## Do not audit attempts to write the X server ## log files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_dontaudit_write_log',` gen_require(` type xserver_log_t; ') dontaudit $1 xserver_log_t:file { append write }; ') ######################################## ## ## Do not audit attempts to write the X server ## log files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_delete_log',` gen_require(` type xserver_log_t; ') logging_search_logs($1) allow $1 xserver_log_t:dir list_dir_perms; delete_files_pattern($1,xserver_log_t,xserver_log_t) delete_fifo_files_pattern($1,xserver_log_t,xserver_log_t) ') ######################################## ## ## Read X keyboard extension libraries. ## ## ## ## Domain to not audit ## ## # interface(`xserver_read_xkb_libs',` gen_require(` type xkb_var_lib_t; ') files_search_var_lib($1) allow $1 xkb_var_lib_t:dir list_dir_perms; read_files_pattern($1,xkb_var_lib_t,xkb_var_lib_t) read_lnk_files_pattern($1,xkb_var_lib_t,xkb_var_lib_t) ') ######################################## ## ## Read xdm temporary files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_read_xdm_xserver_tmp_files',` gen_require(` type xdm_xserver_tmp_t; ') allow $1 xdm_xserver_tmp_t:file { getattr read }; ') ######################################## ## ## Read xdm temporary files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_read_xdm_tmp_files',` gen_require(` type xdm_tmp_t; ') files_search_tmp($1) read_files_pattern($1,xdm_tmp_t,xdm_tmp_t) ') ######################################## ## ## Do not audit attempts to read xdm temporary files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_dontaudit_read_xdm_tmp_files',` gen_require(` type xdm_tmp_t; ') dontaudit $1 xdm_tmp_t:dir search_dir_perms; dontaudit $1 xdm_tmp_t:file read_file_perms; ') ######################################## ## ## Read write xdm temporary files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_rw_xdm_tmp_files',` gen_require(` type xdm_tmp_t; ') allow $1 xdm_tmp_t:dir search_dir_perms; allow $1 xdm_tmp_t:file rw_file_perms; ') ######################################## ## ## Create, read, write, and delete xdm temporary files. ## ## ## ## Domain to not audit ## ## # interface(`xserver_manage_xdm_tmp_files',` gen_require(` type xdm_tmp_t; ') manage_files_pattern($1,xdm_tmp_t,xdm_tmp_t) ') ######################################## ## ## dontaudit getattr xdm temporary named sockets. ## ## ## ## Domain to not audit ## ## # interface(`xserver_dontaudit_getattr_xdm_tmp_sockets',` gen_require(` type xdm_tmp_t; ') dontaudit $1 xdm_tmp_t:sock_file getattr; ') ######################################## ## ## Signal XDM X servers ## ## ## ## Domain to not audit ## ## # interface(`xserver_signal_xdm_xserver',` gen_require(` type xdm_xserver_t; ') allow $1 xdm_xserver_t:process signal; ') ######################################## ## ## Kill XDM X servers ## ## ## ## Domain to not audit ## ## # interface(`xserver_kill_xdm_xserver',` gen_require(` type xdm_xserver_t; ') allow $1 xdm_xserver_t:process sigkill; ') ######################################## ## ## Do not audit attempts to read and write to ## a XDM X server socket. ## ## ## ## Domain to not audit ## ## # interface(`xserver_dontaudit_rw_xdm_xserver_tcp_sockets',` gen_require(` type xdm_xserver_t; ') dontaudit $1 xdm_xserver_t:tcp_socket { read write }; ') ######################################## ## ## Do not audit attempts to read and write xdm_xserver ## unix domain stream sockets. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_dontaudit_rw_xdm_stream_sockets',` gen_require(` type xdm_xserver_t; ') dontaudit $1 xdm_xserver_t:unix_stream_socket { read write }; ') ######################################## ## ## Connect to xdm_xserver over a unix domain ## stream socket. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_stream_connect_xdm_xserver',` gen_require(` type xdm_xserver_t, xdm_xserver_tmp_t; ') files_search_tmp($1) stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t) ') ######################################## ## ## Interface to provide X object permissions on a given X server to ## an X client domain. Gives the domain complete control over the ## display. ## ## ## ## Domain allowed access. ## ## # interface(`xserver_unconfined',` gen_require(` attribute xserver_unconfined_type; ') typeattribute $1 xserver_unconfined_type; ')