## X Window Managers ####################################### ## ## The role template for the wm module. ## ## ##

## This template creates a derived domains which are used ## for window manager applications. ##

##
## ## ## The prefix of the user domain (e.g., user ## is the prefix for user_t). ## ## ## ## ## The role associated with the user domain. ## ## ## ## ## The type of the user domain. ## ## # template(`wm_role_template',` gen_require(` type wm_exec_t; class dbus send_msg; ') type $1_wm_t; domain_type($1_wm_t) domain_entry_file($1_wm_t, wm_exec_t) role $2 types $1_wm_t; allow $1_wm_t self:fifo_file rw_fifo_file_perms; allow $1_wm_t self:process getsched; allow $1_wm_t self:shm create_shm_perms; allow $1_wm_t $3:unix_stream_socket connectto; allow $3 $1_wm_t:unix_stream_socket connectto; allow $3 $1_wm_t:process { signal sigchld }; allow $1_wm_t $3:process { signull sigkill }; allow $1_wm_t $3:dbus send_msg; allow $3 $1_wm_t:dbus send_msg; domtrans_pattern($3, wm_exec_t, $1_wm_t) kernel_read_system_state($1_wm_t) corecmd_bin_domtrans($1_wm_t, $3) corecmd_shell_domtrans($1_wm_t, $3) dev_read_urand($1_wm_t) files_read_etc_files($1_wm_t) files_read_usr_files($1_wm_t) fs_getattr_tmpfs($1_wm_t) mls_file_read_all_levels($1_wm_t) mls_file_write_all_levels($1_wm_t) mls_xwin_read_all_levels($1_wm_t) mls_xwin_write_all_levels($1_wm_t) mls_fd_use_all_levels($1_wm_t) auth_use_nsswitch($1_wm_t) miscfiles_read_fonts($1_wm_t) miscfiles_read_localization($1_wm_t) userdom_manage_home_role($2, $1_wm_t) userdom_manage_tmpfs_role($2, $1_wm_t) userdom_manage_tmp_role($2, $1_wm_t) optional_policy(` dbus_system_bus_client($1_wm_t) dbus_session_bus_client($1_wm_t) ') optional_policy(` pulseaudio_stream_connect($1_wm_t) ') optional_policy(` xserver_role($2, $1_wm_t) xserver_manage_core_devices($1_wm_t) ') ') ######################################## ## ## Execute the wm program in the wm domain. ## ## ## ## Domain allowed access. ## ## # interface(`wm_exec',` gen_require(` type wm_exec_t; ') can_exec($1, wm_exec_t) ')