[selinux-policy: 1136/3172] last bits of xserver
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 20:43:14 UTC 2010
commit 3b311307cdbde8fb8c0a5ebdfd791f67c082858f
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Fri Jan 20 20:10:35 2006 +0000
last bits of xserver
refpolicy/policy/modules/services/ssh.if | 60 +++++++++++++++-
refpolicy/policy/modules/services/xdm.te | 2 +
refpolicy/policy/modules/services/xserver.if | 97 ++++++++++++++++++++------
refpolicy/policy/modules/services/xserver.te | 2 +
4 files changed, 137 insertions(+), 24 deletions(-)
---
diff --git a/refpolicy/policy/modules/services/ssh.if b/refpolicy/policy/modules/services/ssh.if
index fccc997..6e2d2fe 100644
--- a/refpolicy/policy/modules/services/ssh.if
+++ b/refpolicy/policy/modules/services/ssh.if
@@ -202,6 +202,10 @@ template(`ssh_per_userdomain_template',`
nscd_use_socket($1_ssh_t)
')
+ optional_policy(`xserver',`
+ xserver_domtrans_user_xauth($1,$1_ssh_t)
+ ')
+
ifdef(`TODO',`
# Read /var/run, /var/log.
@@ -550,15 +554,65 @@ template(`ssh_server_template', `
')
########################################
-## <summary>Read ssh server keys</summary>
+## <summary>
+## Send a SIGCHLD signal to the ssh server.
+## </summary>
+## <param name="domain">
+## Domain allowed access.
+## </param>
+#
+interface(`ssh_sigchld',`
+ gen_require(`
+ type sshd_t;
+ ')
+
+ allow $1 sshd_t:process sigchld;
+')
+
+########################################
+## <summary>
+## Read a ssh server unnamed pipe.
+## </summary>
+## <param name="domain">
+## Domain allowed access.
+## </param>
+#
+interface(`ssh_read_pipe',`
+ gen_require(`
+ type sshd_t;
+ ')
+
+ allow $1 sshd_t:fifo_file { getattr read };
+')
+
+########################################
+## <summary>
+## Do not audit attempts to read and write
+## ssh server TCP sockets.
+## </summary>
+## <param name="domain">
+## Domain to not audit.
+## </param>
+#
+interface(`ssh_dontaudit_rw_tcp_socket',`
+ gen_require(`
+ type sshd_t;
+ ')
+
+ dontaudit $1 sshd_t:tcp_socket { read write };
+')
+
+########################################
+## <summary>
+## Read ssh server keys
+## </summary>
## <param name="domain">
-## The type of the process performing this action.
+## Domain allowed access.
## </param>
#
interface(`ssh_dontaudit_read_server_keys',`
gen_require(`
type sshd_key_t;
- class file { getattr read };
')
dontaudit $1 sshd_key_t:file { getattr read };
diff --git a/refpolicy/policy/modules/services/xdm.te b/refpolicy/policy/modules/services/xdm.te
index 1226f45..80006cf 100644
--- a/refpolicy/policy/modules/services/xdm.te
+++ b/refpolicy/policy/modules/services/xdm.te
@@ -121,6 +121,8 @@ ifdef(`strict_policy',`
allow xdm_t xdm_var_run_t:dir manage_dir_perms;
allow xdm_t xdm_var_run_t:fifo_file manage_file_perms;
files_filetrans_pid(xdm_t,xdm_var_run_t,{ dir fifo_file })
+
+ xserver_dontaudit_read_all_users_iceauth(xdm_t)
')
ifdef(`targeted_policy',`
diff --git a/refpolicy/policy/modules/services/xserver.if b/refpolicy/policy/modules/services/xserver.if
index d2a3793..f783f67 100644
--- a/refpolicy/policy/modules/services/xserver.if
+++ b/refpolicy/policy/modules/services/xserver.if
@@ -305,6 +305,16 @@ template(`xserver_per_userdomain_template',`
allow $2 $1_xauth_t:process signal;
+ # allow ps to show xauth
+ allow $2 $1_xauth_t:dir { search getattr read };
+ allow $2 $1_xauth_t:{ file lnk_file } { read getattr };
+ allow $2 $1_xauth_t:process getattr;
+ # We need to suppress this denial because procps tries to access
+ # /proc/pid/environ and this now triggers a ptrace check in recent kernels
+ # (2.4 and 2.6). Might want to change procps to not do this, or only if
+ # running in a privileged domain.
+ dontaudit $2 $1_xauth_t:process ptrace;
+
allow $2 $1_xauth_home_t:file manage_file_perms;
allow $2 $1_xauth_home_t:file { relabelfrom relabelto };
@@ -325,6 +335,7 @@ template(`xserver_per_userdomain_template',`
sysnet_dns_name_resolve($1_xauth_t)
userdom_use_user_terminals($1,$1_xauth_t)
+ userdom_read_user_tmp_files($1,$1_xauth_t)
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_files($1_xauth_t)
@@ -338,20 +349,11 @@ template(`xserver_per_userdomain_template',`
nis_use_ypbind($1_xauth_t)
')
- ifdef(`TODO',`
- ifdef(`ssh.te', `
- domain_auto_trans($1_ssh_t, xauth_exec_t, $1_xauth_t)
- dontaudit $1_xauth_t $1_ssh_t:tcp_socket { read write };
-
- allow $1_xauth_t sshd_t:fifo_file { getattr read };
- allow $1_xauth_t sshd_t:process sigchld;
- ')dnl end if ssh
-
- # allow ps to show xauth
- can_ps($1_t, $1_xauth_t)
-
- allow $1_xauth_t $1_tmp_t:file { getattr ioctl read };
- ') dnl end TODO
+ optional_policy(`ssh',`
+ ssh_sigchld($1_xauth_t)
+ ssh_read_pipe($1_xauth_t)
+ ssh_dontaudit_rw_tcp_socket($1_xauth_t)
+ ')
##############################
#
@@ -367,6 +369,16 @@ template(`xserver_per_userdomain_template',`
allow $1_iceauth_t $1_iceauth_home_t:file manage_file_perms;
userdom_filetrans_user_home_dir($1,$1_iceauth_t,$1_iceauth_home_t,file)
+ # allow ps to show iceauth
+ allow $2 $1_iceauth_t:dir { search getattr read };
+ allow $2 $1_iceauth_t:{ file lnk_file } { read getattr };
+ allow $2 $1_iceauth_t:process getattr;
+ # We need to suppress this denial because procps tries to access
+ # /proc/pid/environ and this now triggers a ptrace check in recent kernels
+ # (2.4 and 2.6). Might want to change procps to not do this, or only if
+ # running in a privileged domain.
+ dontaudit $2 $1_iceauth_t:process ptrace;
+
allow $2 $1_iceauth_home_t:file manage_file_perms;
allow $2 $1_iceauth_home_t:file { relabelfrom relabelto };
@@ -384,13 +396,6 @@ template(`xserver_per_userdomain_template',`
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_iceauth_t)
')
-
- ifdef(`TODO',`
- # Supress xdm trying to restore .ICEauthority permissions
- ifdef(`xdm.te', `
- dontaudit xdm_t $1_iceauth_home_t:file r_file_perms;
- ')
- ') dnl end TODO
')
#######################################
@@ -449,3 +454,53 @@ template(`xserver_displaymgr_domain_template',`
allow $1_xserver_t xdm_tmpfs_t:file rw_file_perms;
') dnl end TODO
')
+
+########################################
+## <summary>
+## Transition to a user Xauthority domain.
+## </summary>
+## <desc>
+## <p>
+## Transition to a user Xauthority domain.
+## </p>
+## <p>
+## This is a templated interface, and should only
+## be called from a per-userdomain template.
+## </p>
+## </desc>
+## <param name="userdomain_prefix">
+## The prefix of the user domain (e.g., user
+## is the prefix for user_t).
+## </param>
+## <param name="domain">
+## Domain allowed access.
+## </param>
+#
+template(`xserver_domtrans_user_xauth',`
+ gen_require(`
+ type $1_xauth_t, xauth_exec_t;
+ ')
+
+ domain_auto_trans($2, xauth_exec_t, $1_xauth_t)
+ allow $2 $1_xauth_t:fd use;
+ allow $1_xauth_t $2:fd use;
+ allow $1_xauth_t $2:fifo_file rw_file_perms;
+ allow $1_xauth_t $2:process sigchld;
+')
+
+########################################
+## <summary>
+## Do not audit attempts to read all user
+## .ICEauthority files.
+## </summary>
+## <param name="domain">
+## Domain do not audit.
+## </param>
+#
+interface(`xserver_dontaudit_read_all_users_iceauth',`
+ gen_require(`
+ attribute iceauth_home_type;
+ ')
+
+ dontaudit $1 iceauth_home_type:file r_file_perms;
+')
diff --git a/refpolicy/policy/modules/services/xserver.te b/refpolicy/policy/modules/services/xserver.te
index 1f4dcc1..c545ddb 100644
--- a/refpolicy/policy/modules/services/xserver.te
+++ b/refpolicy/policy/modules/services/xserver.te
@@ -6,6 +6,8 @@ policy_module(xserver,1.0.0)
# Declarations
#
+attribute iceauth_home_type;
+
type ice_tmp_t;
files_tmp_file(ice_tmp_t)
More information about the scm-commits
mailing list