623e4f0885
Retry: forgot to include attribute mmap_low_domain_type attribute to domain_mmap_low() : Inspired by similar implementation in Fedora. Wine and vbetool do not always actually need the ability to mmap a low area of the address space. In some cases this can be silently denied. Therefore introduce an interface that facilitates "mmap low" conditionally, and the corresponding boolean. Also implement booleans for wine and vbetool that enables the ability to not audit attempts by wine and vbetool to mmap a low area of the address space. Rename domain_mmap_low interface to domain_mmap_low_uncond. Change call to domain_mmap_low to domain_mmap_low_uncond for xserver_t. Also move this call to distro redhat ifndef block because Redhat does not need this ability. Signed-off-by: Dominick Grift <domg472@gmail.com>
61 lines
1.1 KiB
Plaintext
61 lines
1.1 KiB
Plaintext
policy_module(wine, 1.7.1)
|
|
|
|
########################################
|
|
#
|
|
# Declarations
|
|
#
|
|
|
|
## <desc>
|
|
## <p>
|
|
## Ignore wine mmap_zero errors.
|
|
## </p>
|
|
## </desc>
|
|
gen_tunable(wine_mmap_zero_ignore, false)
|
|
|
|
type wine_t;
|
|
type wine_exec_t;
|
|
application_domain(wine_t, wine_exec_t)
|
|
ubac_constrained(wine_t)
|
|
role system_r types wine_t;
|
|
|
|
type wine_tmp_t;
|
|
files_tmp_file(wine_tmp_t)
|
|
ubac_constrained(wine_tmp_t)
|
|
|
|
########################################
|
|
#
|
|
# Local policy
|
|
#
|
|
|
|
allow wine_t self:process { execstack execmem execheap };
|
|
allow wine_t self:fifo_file manage_fifo_file_perms;
|
|
|
|
can_exec(wine_t, wine_exec_t)
|
|
|
|
manage_dirs_pattern(wine_t, wine_tmp_t, wine_tmp_t)
|
|
manage_files_pattern(wine_t, wine_tmp_t, wine_tmp_t)
|
|
files_tmp_filetrans(wine_t, wine_tmp_t, { file dir })
|
|
|
|
domain_mmap_low(wine_t)
|
|
|
|
files_execmod_all_files(wine_t)
|
|
|
|
userdom_use_user_terminals(wine_t)
|
|
|
|
tunable_policy(`wine_mmap_zero_ignore',`
|
|
dontaudit wine_t self:memprotect mmap_zero;
|
|
')
|
|
|
|
optional_policy(`
|
|
hal_dbus_chat(wine_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
unconfined_domain_noaudit(wine_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
xserver_read_xdm_pid(wine_t)
|
|
xserver_rw_shm(wine_t)
|
|
')
|