[selinux-policy: 1919/3172] trunk: add core xselinux support.
Daniel J Walsh
dwalsh at fedoraproject.org
Thu Oct 7 21:50:53 UTC 2010
commit 2c12b471ad6e71ed17f84016ef0c8e589ea5f931
Author: Chris PeBenito <cpebenito at tresys.com>
Date: Tue Apr 1 20:23:23 2008 +0000
trunk: add core xselinux support.
Changelog | 1 +
Makefile | 2 +-
config/appconfig-mcs/x_contexts | 194 +++++++++++++++++
config/appconfig-mls/x_contexts | 194 +++++++++++++++++
config/appconfig-standard/x_contexts | 194 +++++++++++++++++
policy/flask/access_vectors | 169 ++++++++-------
policy/flask/security_classes | 33 ++--
policy/mls | 167 ++++++++-------
policy/modules/apps/ethereal.if | 2 +-
policy/modules/apps/ethereal.te | 2 +-
policy/modules/apps/evolution.if | 8 +-
policy/modules/apps/evolution.te | 2 +-
policy/modules/apps/games.if | 2 +-
policy/modules/apps/games.te | 2 +-
policy/modules/apps/gift.if | 2 +-
policy/modules/apps/gift.te | 2 +-
policy/modules/apps/java.if | 2 +-
policy/modules/apps/java.te | 2 +-
policy/modules/apps/mozilla.if | 2 +-
policy/modules/apps/mozilla.te | 2 +-
policy/modules/apps/mplayer.if | 2 +-
policy/modules/apps/mplayer.te | 2 +-
policy/modules/apps/thunderbird.if | 2 +-
policy/modules/apps/thunderbird.te | 2 +-
policy/modules/apps/tvtime.if | 2 +-
policy/modules/apps/tvtime.te | 2 +-
policy/modules/apps/vmware.if | 2 +-
policy/modules/apps/vmware.te | 2 +-
policy/modules/kernel/mls.if | 40 ++++
policy/modules/kernel/mls.te | 2 +-
policy/modules/services/bluetooth.if | 2 +-
policy/modules/services/bluetooth.te | 2 +-
policy/modules/services/ssh.if | 2 +-
policy/modules/services/ssh.te | 2 +-
policy/modules/services/xserver.fc | 4 +-
policy/modules/services/xserver.if | 385 ++++++++++++++++++++++++++++++++-
policy/modules/services/xserver.te | 67 ++++++-
policy/modules/system/unconfined.if | 4 +
policy/modules/system/unconfined.te | 2 +-
support/selinux-policy-refpolicy.spec | 3 +
40 files changed, 1312 insertions(+), 203 deletions(-)
---
diff --git a/Changelog b/Changelog
index 9587cd9..432b777 100644
--- a/Changelog
+++ b/Changelog
@@ -1,3 +1,4 @@
+- Add core Security Enhanced X Windows support.
- Fix winbind socket connection interface for default location of the
sock_file.
- Add wireshark module based on ethereal module.
diff --git a/Makefile b/Makefile
index ab508f3..a08c983 100644
--- a/Makefile
+++ b/Makefile
@@ -236,7 +236,7 @@ seusers := $(appconf)/seusers
appdir := $(contextpath)
user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts)
user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts))))
-appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
+appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names)
net_contexts := $(builddir)net_contexts
all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d)
diff --git a/config/appconfig-mcs/x_contexts b/config/appconfig-mcs/x_contexts
new file mode 100644
index 0000000..08da649
--- /dev/null
+++ b/config/appconfig-mcs/x_contexts
@@ -0,0 +1,194 @@
+#
+# Config file for XSELinux extension
+#
+
+
+#
+##
+### Rules for X Clients
+##
+#
+
+#
+# The default client rule defines a context to be used for all clients
+# connecting to the server from a remote host.
+#
+client * system_u:object_r:remote_xclient_t:s0
+
+
+#
+##
+### Rules for X Properties
+##
+#
+
+#
+# Property rules map a property name to a context. A default property
+# rule indicated by an asterisk should follow all other property rules.
+#
+# Properties that normal clients may only read
+property XFree86_VT system_u:object_r:info_xproperty_t:s0
+property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
+property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
+property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
+property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
+property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
+property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
+property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
+property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
+
+# Clipboard and selection properties
+property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
+
+# Default fallback type
+property * system_u:object_r:xproperty_t:s0
+
+
+#
+##
+### Rules for X Extensions
+##
+#
+
+#
+# Extension rules map an extension name to a context. A default extension
+# rule indicated by an asterisk should follow all other extension rules.
+#
+# Standard extensions
+extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
+extension SHAPE system_u:object_r:std_xext_t:s0
+extension SYNC system_u:object_r:std_xext_t:s0
+extension XC-MISC system_u:object_r:std_xext_t:s0
+extension XFIXES system_u:object_r:std_xext_t:s0
+extension XInputExtension system_u:object_r:std_xext_t:s0
+extension XKEYBOARD system_u:object_r:std_xext_t:s0
+extension DAMAGE system_u:object_r:std_xext_t:s0
+extension RENDER system_u:object_r:std_xext_t:s0
+extension XINERAMA system_u:object_r:std_xext_t:s0
+
+# Direct hardware access extensions
+extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
+extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
+
+# Screen management and multihead extensions
+extension RANDR system_u:object_r:output_xext_t:s0
+extension Composite system_u:object_r:output_xext_t:s0
+
+# Screensaver, power management extensions
+extension DPMS system_u:object_r:screensaver_xext_t:s0
+extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
+
+# Shared memory extensions
+extension MIT-SHM system_u:object_r:shmem_xext_t:s0
+extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
+
+# Accelerated graphics, OpenGL, direct rendering extensions
+extension GLX system_u:object_r:accelgraphics_xext_t:s0
+extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
+extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
+extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
+
+# Debugging, testing, and recording extensions
+extension RECORD system_u:object_r:debug_xext_t:s0
+extension X-Resource system_u:object_r:debug_xext_t:s0
+extension XTEST system_u:object_r:debug_xext_t:s0
+
+# Security-related extensions
+extension SECURITY system_u:object_r:security_xext_t:s0
+extension SELinux system_u:object_r:security_xext_t:s0
+extension XAccessControlExtension system_u:object_r:security_xext_t:s0
+extension XC-APPGROUP system_u:object_r:security_xext_t:s0
+
+# Video extensions
+extension XVideo system_u:object_r:video_xext_t:s0
+extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
+
+# Default fallback type
+extension * system_u:object_r:xext_t:s0
+
+
+#
+##
+### Rules for X Selections
+##
+#
+
+# Selection rules map a selection name to a context. A default selection
+# rule indicated by an asterisk should follow all other selection rules.
+#
+# Standard selections
+selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
+selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
+selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
+selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
+
+# Default fallback type
+selection * system_u:object_r:xselection_t:s0
+
+
+#
+##
+### Rules for X Events
+##
+#
+
+#
+# Event rules map an event protocol name to a context. A default event
+# rule indicated by an asterisk should follow all other event rules.
+#
+# Input events
+event X11:KeyPress system_u:object_r:input_xevent_t:s0
+event X11:KeyRelease system_u:object_r:input_xevent_t:s0
+event X11:ButtonPress system_u:object_r:input_xevent_t:s0
+event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
+event X11:MotionNotify system_u:object_r:input_xevent_t:s0
+event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
+event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
+event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
+
+# Focus events
+event X11:FocusIn system_u:object_r:focus_xevent_t:s0
+event X11:FocusOut system_u:object_r:focus_xevent_t:s0
+event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
+event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
+
+# Property events
+event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
+
+# Client message events
+event X11:ClientMessage system_u:object_r:client_xevent_t:s0
+
+# Manager events
+event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
+event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
+event X11:MapRequest system_u:object_r:manage_xevent_t:s0
+event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
+event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
+event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
+event X11:MapNotify system_u:object_r:manage_xevent_t:s0
+event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
+event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
+event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
+event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
+event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
+event X11:Expose system_u:object_r:manage_xevent_t:s0
+event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
+
+# Unknown events (that are not registered in the X server's name database)
+event <unknown> system_u:object_r:unknown_xevent_t:s0
+
+# Default fallback type
+event * system_u:object_r:xevent_t:s0
diff --git a/config/appconfig-mls/x_contexts b/config/appconfig-mls/x_contexts
new file mode 100644
index 0000000..08da649
--- /dev/null
+++ b/config/appconfig-mls/x_contexts
@@ -0,0 +1,194 @@
+#
+# Config file for XSELinux extension
+#
+
+
+#
+##
+### Rules for X Clients
+##
+#
+
+#
+# The default client rule defines a context to be used for all clients
+# connecting to the server from a remote host.
+#
+client * system_u:object_r:remote_xclient_t:s0
+
+
+#
+##
+### Rules for X Properties
+##
+#
+
+#
+# Property rules map a property name to a context. A default property
+# rule indicated by an asterisk should follow all other property rules.
+#
+# Properties that normal clients may only read
+property XFree86_VT system_u:object_r:info_xproperty_t:s0
+property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0
+property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0
+property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0
+property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0
+property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0
+property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0
+property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0
+property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0
+
+# Clipboard and selection properties
+property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0
+property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0
+
+# Default fallback type
+property * system_u:object_r:xproperty_t:s0
+
+
+#
+##
+### Rules for X Extensions
+##
+#
+
+#
+# Extension rules map an extension name to a context. A default extension
+# rule indicated by an asterisk should follow all other extension rules.
+#
+# Standard extensions
+extension BIG-REQUESTS system_u:object_r:std_xext_t:s0
+extension SHAPE system_u:object_r:std_xext_t:s0
+extension SYNC system_u:object_r:std_xext_t:s0
+extension XC-MISC system_u:object_r:std_xext_t:s0
+extension XFIXES system_u:object_r:std_xext_t:s0
+extension XInputExtension system_u:object_r:std_xext_t:s0
+extension XKEYBOARD system_u:object_r:std_xext_t:s0
+extension DAMAGE system_u:object_r:std_xext_t:s0
+extension RENDER system_u:object_r:std_xext_t:s0
+extension XINERAMA system_u:object_r:std_xext_t:s0
+
+# Direct hardware access extensions
+extension XFree86-DGA system_u:object_r:directhw_xext_t:s0
+extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0
+
+# Screen management and multihead extensions
+extension RANDR system_u:object_r:output_xext_t:s0
+extension Composite system_u:object_r:output_xext_t:s0
+
+# Screensaver, power management extensions
+extension DPMS system_u:object_r:screensaver_xext_t:s0
+extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0
+
+# Shared memory extensions
+extension MIT-SHM system_u:object_r:shmem_xext_t:s0
+extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0
+
+# Accelerated graphics, OpenGL, direct rendering extensions
+extension GLX system_u:object_r:accelgraphics_xext_t:s0
+extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0
+extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0
+extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0
+
+# Debugging, testing, and recording extensions
+extension RECORD system_u:object_r:debug_xext_t:s0
+extension X-Resource system_u:object_r:debug_xext_t:s0
+extension XTEST system_u:object_r:debug_xext_t:s0
+
+# Security-related extensions
+extension SECURITY system_u:object_r:security_xext_t:s0
+extension SELinux system_u:object_r:security_xext_t:s0
+extension XAccessControlExtension system_u:object_r:security_xext_t:s0
+extension XC-APPGROUP system_u:object_r:security_xext_t:s0
+
+# Video extensions
+extension XVideo system_u:object_r:video_xext_t:s0
+extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0
+
+# Default fallback type
+extension * system_u:object_r:xext_t:s0
+
+
+#
+##
+### Rules for X Selections
+##
+#
+
+# Selection rules map a selection name to a context. A default selection
+# rule indicated by an asterisk should follow all other selection rules.
+#
+# Standard selections
+selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0
+selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0
+selection PRIMARY system_u:object_r:clipboard_xselection_t:s0
+selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0
+
+# Default fallback type
+selection * system_u:object_r:xselection_t:s0
+
+
+#
+##
+### Rules for X Events
+##
+#
+
+#
+# Event rules map an event protocol name to a context. A default event
+# rule indicated by an asterisk should follow all other event rules.
+#
+# Input events
+event X11:KeyPress system_u:object_r:input_xevent_t:s0
+event X11:KeyRelease system_u:object_r:input_xevent_t:s0
+event X11:ButtonPress system_u:object_r:input_xevent_t:s0
+event X11:ButtonRelease system_u:object_r:input_xevent_t:s0
+event X11:MotionNotify system_u:object_r:input_xevent_t:s0
+event X11:SelectionNotify system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0
+event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0
+event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0
+event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0
+
+# Focus events
+event X11:FocusIn system_u:object_r:focus_xevent_t:s0
+event X11:FocusOut system_u:object_r:focus_xevent_t:s0
+event X11:EnterNotify system_u:object_r:focus_xevent_t:s0
+event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0
+
+# Property events
+event X11:PropertyNotify system_u:object_r:property_xevent_t:s0
+
+# Client message events
+event X11:ClientMessage system_u:object_r:client_xevent_t:s0
+
+# Manager events
+event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0
+event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0
+event X11:MapRequest system_u:object_r:manage_xevent_t:s0
+event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0
+event X11:CreateNotify system_u:object_r:manage_xevent_t:s0
+event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0
+event X11:MapNotify system_u:object_r:manage_xevent_t:s0
+event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0
+event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0
+event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0
+event X11:GravityNotify system_u:object_r:manage_xevent_t:s0
+event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0
+event X11:Expose system_u:object_r:manage_xevent_t:s0
+event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0
+
+# Unknown events (that are not registered in the X server's name database)
+event <unknown> system_u:object_r:unknown_xevent_t:s0
+
+# Default fallback type
+event * system_u:object_r:xevent_t:s0
diff --git a/config/appconfig-standard/x_contexts b/config/appconfig-standard/x_contexts
new file mode 100644
index 0000000..f9cefb9
--- /dev/null
+++ b/config/appconfig-standard/x_contexts
@@ -0,0 +1,194 @@
+#
+# Config file for XSELinux extension
+#
+
+
+#
+##
+### Rules for X Clients
+##
+#
+
+#
+# The default client rule defines a context to be used for all clients
+# connecting to the server from a remote host.
+#
+client * system_u:object_r:remote_xclient_t
+
+
+#
+##
+### Rules for X Properties
+##
+#
+
+#
+# Property rules map a property name to a context. A default property
+# rule indicated by an asterisk should follow all other property rules.
+#
+# Properties that normal clients may only read
+property XFree86_VT system_u:object_r:info_xproperty_t
+property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t
+property RESOURCE_MANAGER system_u:object_r:info_xproperty_t
+property SCREEN_RESOURCES system_u:object_r:info_xproperty_t
+property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t
+property AT_SPI_IOR system_u:object_r:info_xproperty_t
+property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t
+property _NET_WORKAREA system_u:object_r:info_xproperty_t
+property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t
+
+# Clipboard and selection properties
+property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t
+property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t
+
+# Default fallback type
+property * system_u:object_r:xproperty_t
+
+
+#
+##
+### Rules for X Extensions
+##
+#
+
+#
+# Extension rules map an extension name to a context. A default extension
+# rule indicated by an asterisk should follow all other extension rules.
+#
+# Standard extensions
+extension BIG-REQUESTS system_u:object_r:std_xext_t
+extension SHAPE system_u:object_r:std_xext_t
+extension SYNC system_u:object_r:std_xext_t
+extension XC-MISC system_u:object_r:std_xext_t
+extension XFIXES system_u:object_r:std_xext_t
+extension XInputExtension system_u:object_r:std_xext_t
+extension XKEYBOARD system_u:object_r:std_xext_t
+extension DAMAGE system_u:object_r:std_xext_t
+extension RENDER system_u:object_r:std_xext_t
+extension XINERAMA system_u:object_r:std_xext_t
+
+# Direct hardware access extensions
+extension XFree86-DGA system_u:object_r:directhw_xext_t
+extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t
+
+# Screen management and multihead extensions
+extension RANDR system_u:object_r:output_xext_t
+extension Composite system_u:object_r:output_xext_t
+
+# Screensaver, power management extensions
+extension DPMS system_u:object_r:screensaver_xext_t
+extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t
+
+# Shared memory extensions
+extension MIT-SHM system_u:object_r:shmem_xext_t
+extension XFree86-Bigfont system_u:object_r:shmem_xext_t
+
+# Accelerated graphics, OpenGL, direct rendering extensions
+extension GLX system_u:object_r:accelgraphics_xext_t
+extension NV-CONTROL system_u:object_r:accelgraphics_xext_t
+extension NV-GLX system_u:object_r:accelgraphics_xext_t
+extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t
+
+# Debugging, testing, and recording extensions
+extension RECORD system_u:object_r:debug_xext_t
+extension X-Resource system_u:object_r:debug_xext_t
+extension XTEST system_u:object_r:debug_xext_t
+
+# Security-related extensions
+extension SECURITY system_u:object_r:security_xext_t
+extension SELinux system_u:object_r:security_xext_t
+extension XAccessControlExtension system_u:object_r:security_xext_t
+extension XC-APPGROUP system_u:object_r:security_xext_t
+
+# Video extensions
+extension XVideo system_u:object_r:video_xext_t
+extension XVideo-MotionCompensation system_u:object_r:video_xext_t
+
+# Default fallback type
+extension * system_u:object_r:xext_t
+
+
+#
+##
+### Rules for X Selections
+##
+#
+
+# Selection rules map a selection name to a context. A default selection
+# rule indicated by an asterisk should follow all other selection rules.
+#
+# Standard selections
+selection XA_PRIMARY system_u:object_r:clipboard_xselection_t
+selection XA_SECONDARY system_u:object_r:clipboard_xselection_t
+selection PRIMARY system_u:object_r:clipboard_xselection_t
+selection CLIPBOARD system_u:object_r:clipboard_xselection_t
+
+# Default fallback type
+selection * system_u:object_r:xselection_t
+
+
+#
+##
+### Rules for X Events
+##
+#
+
+#
+# Event rules map an event protocol name to a context. A default event
+# rule indicated by an asterisk should follow all other event rules.
+#
+# Input events
+event X11:KeyPress system_u:object_r:input_xevent_t
+event X11:KeyRelease system_u:object_r:input_xevent_t
+event X11:ButtonPress system_u:object_r:input_xevent_t
+event X11:ButtonRelease system_u:object_r:input_xevent_t
+event X11:MotionNotify system_u:object_r:input_xevent_t
+event X11:SelectionNotify system_u:object_r:input_xevent_t
+event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t
+event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t
+event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t
+event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t
+event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t
+event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t
+event XInputExtension:ProximityIn system_u:object_r:input_xevent_t
+event XInputExtension:ProximityOut system_u:object_r:input_xevent_t
+
+# Focus events
+event X11:FocusIn system_u:object_r:focus_xevent_t
+event X11:FocusOut system_u:object_r:focus_xevent_t
+event X11:EnterNotify system_u:object_r:focus_xevent_t
+event X11:LeaveNotify system_u:object_r:focus_xevent_t
+
+# Property events
+event X11:PropertyNotify system_u:object_r:property_xevent_t
+
+# Client message events
+event X11:ClientMessage system_u:object_r:client_xevent_t
+
+# Manager events
+event X11:ConfigureRequest system_u:object_r:manage_xevent_t
+event X11:ResizeRequest system_u:object_r:manage_xevent_t
+event X11:MapRequest system_u:object_r:manage_xevent_t
+event X11:CirculateRequest system_u:object_r:manage_xevent_t
+event X11:CreateNotify system_u:object_r:manage_xevent_t
+event X11:DestroyNotify system_u:object_r:manage_xevent_t
+event X11:MapNotify system_u:object_r:manage_xevent_t
+event X11:UnmapNotify system_u:object_r:manage_xevent_t
+event X11:ReparentNotify system_u:object_r:manage_xevent_t
+event X11:ConfigureNotify system_u:object_r:manage_xevent_t
+event X11:GravityNotify system_u:object_r:manage_xevent_t
+event X11:CirculateNotify system_u:object_r:manage_xevent_t
+event X11:Expose system_u:object_r:manage_xevent_t
+event X11:VisibilityNotify system_u:object_r:manage_xevent_t
+
+# Unknown events (that are not registered in the X server's name database)
+event <unknown> system_u:object_r:unknown_xevent_t
+
+# Default fallback type
+event * system_u:object_r:xevent_t
diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors
index f7f181c..b5631e9 100644
--- a/policy/flask/access_vectors
+++ b/policy/flask/access_vectors
@@ -416,141 +416,160 @@ class passwd
#
# SE-X Windows stuff
#
-class drawable
+class x_drawable
{
create
destroy
- draw
- copy
+ read
+ write
+ blend
getattr
+ setattr
+ list_child
+ add_child
+ remove_child
+ list_property
+ get_property
+ set_property
+ manage
+ override
+ show
+ hide
+ send
+ receive
}
-class gc
+class x_screen
{
- create
- free
getattr
setattr
+ hide_cursor
+ show_cursor
+ saver_getattr
+ saver_setattr
+ saver_hide
+ saver_show
}
-class window
+class x_gc
{
- addchild
create
destroy
- map
- unmap
- chstack
- chproplist
- chprop
- listprop
getattr
setattr
- setfocus
- move
- chselection
- chparent
- ctrllife
- enumerate
- transparent
- mousemotion
- clientcomevent
- inputevent
- drawevent
- windowchangeevent
- windowchangerequest
- serverchangeevent
- extensionevent
-}
-
-class font
-{
- load
- free
+ use
+}
+
+class x_font
+{
+ create
+ destroy
getattr
+ add_glyph
+ remove_glyph
use
}
-class colormap
+class x_colormap
{
create
- free
+ destroy
+ read
+ write
+ getattr
+ add_color
+ remove_color
install
uninstall
- list
+ use
+}
+
+class x_property
+{
+ create
+ destroy
read
- store
+ write
+ append
getattr
setattr
}
-class property
+class x_selection
{
- create
- free
read
write
+ getattr
+ setattr
}
-class cursor
+class x_cursor
{
create
- createglyph
- free
- assign
+ destroy
+ read
+ write
+ getattr
setattr
+ use
}
-class xclient
+class x_client
{
- kill
+ destroy
+ getattr
+ setattr
+ manage
}
-class xinput
+class x_device
{
- lookup
getattr
setattr
+ use
+ read
+ write
+ getfocus
setfocus
- warppointer
- activegrab
- passivegrab
- ungrab
bell
- mousemotion
- relabelinput
+ force_cursor
+ freeze
+ grab
+ manage
}
-class xserver
+class x_server
{
- screensaver
- gethostlist
- sethostlist
- getfontpath
- setfontpath
getattr
+ setattr
+ record
+ debug
grab
- ungrab
+ manage
}
-class xextension
+class x_extension
{
query
use
}
-#
-# Define the access vector interpretation for controlling
-# PaX flags
-#
-class pax
+class x_resource
+{
+ read
+ write
+}
+
+class x_event
{
- pageexec # Paging based non-executable pages
- emutramp # Emulate trampolines
- mprotect # Restrict mprotect()
- randmmap # Randomize mmap() base
- randexec # Randomize ET_EXEC base
- segmexec # Segmentation based non-executable pages
+ send
+ receive
+}
+
+class x_synthetic_event
+{
+ send
+ receive
}
#
diff --git a/policy/flask/security_classes b/policy/flask/security_classes
index 68c4374..5b758d9 100644
--- a/policy/flask/security_classes
+++ b/policy/flask/security_classes
@@ -50,21 +50,19 @@ class ipc
# passwd/chfn/chsh
class passwd # userspace
-# SE-X Windows stuff
-class drawable # userspace
-class window # userspace
-class gc # userspace
-class font # userspace
-class colormap # userspace
-class property # userspace
-class cursor # userspace
-class xclient # userspace
-class xinput # userspace
-class xserver # userspace
-class xextension # userspace
-
-# pax flags; deprecated--can be reclaimed
-class pax # userspace
+# SE-X Windows stuff (more classes below)
+class x_drawable # userspace
+class x_screen # userspace
+class x_gc # userspace
+class x_font # userspace
+class x_colormap # userspace
+class x_property # userspace
+class x_selection # userspace
+class x_cursor # userspace
+class x_client # userspace
+class x_device # userspace
+class x_server # userspace
+class x_extension # userspace
# extended netlink sockets
class netlink_route_socket
@@ -112,4 +110,9 @@ class peer
# Capabilities >= 32
class capability2
+# More SE-X Windows stuff
+class x_resource # userspace
+class x_event # userspace
+class x_synthetic_event # userspace
+
# FLASK
diff --git a/policy/mls b/policy/mls
index 5105b17..beed2f8 100644
--- a/policy/mls
+++ b/policy/mls
@@ -371,78 +371,53 @@ mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec se
#
-# MLS policy for the drawable class
+# MLS policy for the x_drawable class
#
-# the drawable "read" ops (implicit single level)
-mlsconstrain drawable { getattr copy }
+# the x_drawable "read" ops (implicit single level)
+mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
-# the drawable "write" ops (implicit single level)
-mlsconstrain drawable { create destroy draw copy }
+# the x_drawable "write" ops (implicit single level)
+mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
-
+# No MLS restrictions: x_drawable { show hide override }
#
-# MLS policy for the gc class
+# MLS policy for the x_gc class
#
-# the gc "read" ops (implicit single level)
-mlsconstrain gc getattr
+# the x_gc "read" ops (implicit single level)
+mlsconstrain x_gc { getattr use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
-# the gc "write" ops (implicit single level)
-mlsconstrain gc { create free setattr }
+# the x_gc "write" ops (implicit single level)
+mlsconstrain x_gc { create destroy setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
-
-
#
-# MLS policy for the window class
+# MLS policy for the x_font class
#
-# the window "read" ops (implicit single level)
-mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent }
+# the x_font "read" ops (implicit single level)
+mlsconstrain x_font { use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinread ));
-# the window "write" ops (implicit single level)
-mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent }
- (( l1 eq l2 ) or
- (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
- ( t1 == mlsxwinwrite ) or
- ( t2 == mlstrustedobject ));
-
-# these access vectors have no MLS restrictions
-# window { map unmap }
-
-
-
-
-#
-# MLS policy for the font class
-#
-
-# the font "read" ops (implicit single level)
-mlsconstrain font { load getattr }
- (( l1 dom l2 ) or
- (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
- ( t1 == mlsxwinread ));
-
-# the font "write" ops (implicit single level)
-mlsconstrain font free
+# the x_font "write" ops (implicit single level)
+mlsconstrain x_font { create destroy add_glyph remove_glyph }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
@@ -451,109 +426,147 @@ mlsconstrain font free
# font use
-
-
#
-# MLS policy for the colormap class
+# MLS policy for the x_colormap class
#
-# the colormap "read" ops (implicit single level)
-mlsconstrain colormap { list read getattr }
+# the x_colormap "read" ops (implicit single level)
+mlsconstrain x_colormap { read getattr use }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadcolormap ) or
( t1 == mlsxwinread ));
-# the colormap "write" ops (implicit single level)
-mlsconstrain colormap { create free install uninstall store setattr }
+# the x_colormap "write" ops (implicit single level)
+mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritecolormap ) or
( t1 == mlsxwinwrite ));
-
-
#
-# MLS policy for the property class
+# MLS policy for the x_property class
#
-# the property "read" ops (implicit single level)
-mlsconstrain property { read }
+# the x_property "read" ops (implicit single level)
+mlsconstrain x_property { read getattr }
(( l1 dom l2 ) or
(( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
( t1 == mlsxwinreadproperty ) or
( t1 == mlsxwinread ));
-# the property "write" ops (implicit single level)
-mlsconstrain property { create free write }
+# the x_property "write" ops (implicit single level)
+mlsconstrain x_property { create destroy write append setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwriteproperty ) or
( t1 == mlsxwinwrite ));
-
-
#
-# MLS policy for the cursor class
+# MLS policy for the x_cursor class
#
-# the cursor "write" ops (implicit single level)
-mlsconstrain cursor { create createglyph free assign setattr }
+# the x_cursor "read" ops (implicit single level)
+mlsconstrain x_cursor { read getattr use }
+ (( l1 dom l2 ) or
+ (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsxwinread ));
+
+# the x_cursor "write" ops (implicit single level)
+mlsconstrain x_cursor { create destroy write setattr }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
-
-
#
-# MLS policy for the xclient class
+# MLS policy for the x_client class
#
-# the xclient "write" ops (implicit single level)
-mlsconstrain xclient kill
+# the x_client "read" ops (implicit single level)
+mlsconstrain x_client { getattr }
+ (( l1 dom l2 ) or
+ (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsxwinread ));
+
+# the x_client "write" ops (implicit single level)
+mlsconstrain x_client { destroy setattr manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwrite ));
-
-
#
-# MLS policy for the xinput class
+# MLS policy for the x_device class
#
-# these access vectors have no MLS restrictions
-# xinput ~{ relabelinput setattr }
+# the x_device "read" ops (implicit single level)
+mlsconstrain x_device { getattr use read getfocus grab }
+ (( l1 dom l2 ) or
+ (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsxwinread ));
-# the xinput "write" ops (implicit single level)
-mlsconstrain xinput { setattr relabelinput }
+# the x_device "write" ops (implicit single level)
+mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage }
(( l1 eq l2 ) or
(( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
( t1 == mlsxwinwritexinput ) or
( t1 == mlsxwinwrite ));
+#
+# MLS policy for the x_server class
+#
+
+# these access vectors have no MLS restrictions
+# x_server *
#
-# MLS policy for the xserver class
+# MLS policy for the x_extension class
#
# these access vectors have no MLS restrictions
-# xserver *
+# x_extension { query use }
+
+#
+# MLS policy for the x_resource class
+#
+
+# the x_resource "read" ops (implicit single level)
+mlsconstrain x_resource { read }
+ (( l1 dom l2 ) or
+ (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsxwinread ));
+# the x_resource "write" ops (implicit single level)
+mlsconstrain x_resource { write }
+ (( l1 eq l2 ) or
+ (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+ ( t1 == mlsxwinwritexinput ) or
+ ( t1 == mlsxwinwrite ));
#
-# MLS policy for the xextension class
+# MLS policy for the x_event class
#
-# these access vectors have no MLS restrictions
-# xextension { query use }
+# the x_event "read" ops (implicit single level)
+mlsconstrain x_event { receive }
+ (( l1 dom l2 ) or
+ (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or
+ ( t1 == mlsxwinread ));
+
+# the x_event "write" ops (implicit single level)
+mlsconstrain x_event { send }
+ (( l1 eq l2 ) or
+ (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or
+ ( t1 == mlsxwinwritexinput ) or
+ ( t1 == mlsxwinwrite ));
+
#
diff --git a/policy/modules/apps/ethereal.if b/policy/modules/apps/ethereal.if
index c9dd4f3..b9b8c36 100644
--- a/policy/modules/apps/ethereal.if
+++ b/policy/modules/apps/ethereal.if
@@ -159,7 +159,7 @@ template(`ethereal_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_ethereal_t,$1_ethereal_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t)
xserver_create_xdm_tmp_sockets($1_ethereal_t)
')
diff --git a/policy/modules/apps/ethereal.te b/policy/modules/apps/ethereal.te
index 48dc20e..eca8fbb 100644
--- a/policy/modules/apps/ethereal.te
+++ b/policy/modules/apps/ethereal.te
@@ -1,5 +1,5 @@
-policy_module(ethereal,1.4.0)
+policy_module(ethereal,1.4.1)
########################################
#
diff --git a/policy/modules/apps/evolution.if b/policy/modules/apps/evolution.if
index 3480e41..8a7abdb 100644
--- a/policy/modules/apps/evolution.if
+++ b/policy/modules/apps/evolution.if
@@ -247,7 +247,7 @@ template(`evolution_per_role_template',`
mta_read_config($1_evolution_t)
- xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t)
xserver_read_xdm_tmp_files($1_evolution_t)
tunable_policy(`use_nfs_home_dirs',`
@@ -513,7 +513,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t)
- xserver_user_client_template($1,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t)
# Access evolution home
tunable_policy(`use_nfs_home_dirs',`
@@ -615,7 +615,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t)
- xserver_user_client_template($1,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t)
# Access evolution home
tunable_policy(`use_nfs_home_dirs',`
@@ -776,7 +776,7 @@ template(`evolution_per_role_template',`
# until properly implemented
userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t)
- xserver_user_client_template($1,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t)
optional_policy(`
nscd_socket_use($1_evolution_webcal_t)
diff --git a/policy/modules/apps/evolution.te b/policy/modules/apps/evolution.te
index 448ff89..5189a7e 100644
--- a/policy/modules/apps/evolution.te
+++ b/policy/modules/apps/evolution.te
@@ -1,5 +1,5 @@
-policy_module(evolution,1.5.0)
+policy_module(evolution,1.5.1)
########################################
#
diff --git a/policy/modules/apps/games.if b/policy/modules/apps/games.if
index 629af63..9447457 100644
--- a/policy/modules/apps/games.if
+++ b/policy/modules/apps/games.if
@@ -146,7 +146,7 @@ template(`games_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_games_t,$1_games_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t)
xserver_create_xdm_tmp_sockets($1_games_t)
xserver_read_xdm_lib_files($1_games_t)
')
diff --git a/policy/modules/apps/games.te b/policy/modules/apps/games.te
index 2575b2a..bc9c387 100644
--- a/policy/modules/apps/games.te
+++ b/policy/modules/apps/games.te
@@ -1,5 +1,5 @@
-policy_module(games,1.5.0)
+policy_module(games,1.5.1)
########################################
#
diff --git a/policy/modules/apps/gift.if b/policy/modules/apps/gift.if
index 8d034ae..786fe55 100644
--- a/policy/modules/apps/gift.if
+++ b/policy/modules/apps/gift.if
@@ -130,7 +130,7 @@ template(`gift_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_gift_t,$1_gift_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t)
')
##############################
diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te
index 47db334..0f31d5e 100644
--- a/policy/modules/apps/gift.te
+++ b/policy/modules/apps/gift.te
@@ -1,5 +1,5 @@
-policy_module(gift,1.3.0)
+policy_module(gift,1.3.1)
########################################
#
diff --git a/policy/modules/apps/java.if b/policy/modules/apps/java.if
index cb557b0..47c801b 100644
--- a/policy/modules/apps/java.if
+++ b/policy/modules/apps/java.if
@@ -164,7 +164,7 @@ template(`java_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t)
')
')
diff --git a/policy/modules/apps/java.te b/policy/modules/apps/java.te
index bbba38e..a6462f7 100644
--- a/policy/modules/apps/java.te
+++ b/policy/modules/apps/java.te
@@ -1,5 +1,5 @@
-policy_module(java,1.7.0)
+policy_module(java,1.7.1)
########################################
#
diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index e1eb340..fe1ff3a 100644
--- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if
@@ -191,7 +191,7 @@ template(`mozilla_per_role_template',`
userdom_manage_user_tmp_files($1,$1_mozilla_t)
userdom_manage_user_tmp_sockets($1,$1_mozilla_t)
- xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t)
xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t)
diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index fa6a5cb..e92a173 100644
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -1,5 +1,5 @@
-policy_module(mozilla,1.5.0)
+policy_module(mozilla,1.5.1)
########################################
#
diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if
index 39b1bf4..fa5597e 100644
--- a/policy/modules/apps/mplayer.if
+++ b/policy/modules/apps/mplayer.if
@@ -342,7 +342,7 @@ template(`mplayer_per_role_template',`
userdom_read_user_home_content_files($1,$1_mplayer_t)
userdom_read_user_home_content_symlinks($1,$1_mplayer_t)
- xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t)
# Read songs
ifdef(`enable_mls',`',`
diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te
index 0ecb614..a2e31e6 100644
--- a/policy/modules/apps/mplayer.te
+++ b/policy/modules/apps/mplayer.te
@@ -1,5 +1,5 @@
-policy_module(mplayer,1.4.0)
+policy_module(mplayer,1.4.1)
########################################
#
diff --git a/policy/modules/apps/thunderbird.if b/policy/modules/apps/thunderbird.if
index ee4d4b2..0d95bfd 100644
--- a/policy/modules/apps/thunderbird.if
+++ b/policy/modules/apps/thunderbird.if
@@ -160,7 +160,7 @@ template(`thunderbird_per_role_template',`
# .kde/....gtkrc
userdom_read_user_home_content_files($1,$1_thunderbird_t)
- xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_thunderbird,$1_thunderbird_t,$1_thunderbird_tmpfs_t)
xserver_read_xdm_tmp_files($1_thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t)
diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te
index b588be0..746d3e3 100644
--- a/policy/modules/apps/thunderbird.te
+++ b/policy/modules/apps/thunderbird.te
@@ -1,5 +1,5 @@
-policy_module(thunderbird,1.5.0)
+policy_module(thunderbird,1.5.1)
########################################
#
diff --git a/policy/modules/apps/tvtime.if b/policy/modules/apps/tvtime.if
index 2c65aad..48c9004 100644
--- a/policy/modules/apps/tvtime.if
+++ b/policy/modules/apps/tvtime.if
@@ -134,6 +134,6 @@ template(`tvtime_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_tvtime_t,$1_tvtime_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_tvtime,$1_tvtime_t,$1_tvtime_tmpfs_t)
')
')
diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te
index 7382549..ecafab3 100644
--- a/policy/modules/apps/tvtime.te
+++ b/policy/modules/apps/tvtime.te
@@ -1,5 +1,5 @@
-policy_module(tvtime,1.3.0)
+policy_module(tvtime,1.3.1)
########################################
#
diff --git a/policy/modules/apps/vmware.if b/policy/modules/apps/vmware.if
index 6bb0915..47069cf 100644
--- a/policy/modules/apps/vmware.if
+++ b/policy/modules/apps/vmware.if
@@ -164,7 +164,7 @@ template(`vmware_per_role_template',`
sysnet_dns_name_resolve($1_vmware_t)
sysnet_read_config($1_vmware_t)
- xserver_user_client_template($1,$1_vmware_t,$1_vmware_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_vmware,$1_vmware_t,$1_vmware_tmpfs_t)
')
########################################
diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te
index 42c65d7..857b7a3 100644
--- a/policy/modules/apps/vmware.te
+++ b/policy/modules/apps/vmware.te
@@ -1,5 +1,5 @@
-policy_module(vmware,1.4.0)
+policy_module(vmware,1.4.1)
########################################
#
diff --git a/policy/modules/kernel/mls.if b/policy/modules/kernel/mls.if
index a24f121..38d10af 100644
--- a/policy/modules/kernel/mls.if
+++ b/policy/modules/kernel/mls.if
@@ -612,6 +612,26 @@ interface(`mls_process_set_level',`
########################################
## <summary>
## Make specified domain MLS trusted
+## for reading from X objects up to its clearance.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_xwin_read_to_clearance',`
+ gen_require(`
+ attribute mlsxwinreadtoclr;
+ ')
+
+ typeattribute $1 mlsxwinreadtoclr;
+')
+
+########################################
+## <summary>
+## Make specified domain MLS trusted
## for reading from X objects at any level.
## </summary>
## <param name="domain">
@@ -632,6 +652,26 @@ interface(`mls_xwin_read_all_levels',`
########################################
## <summary>
## Make specified domain MLS trusted
+## for write to X objects up to its clearance.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+## <rolecap/>
+#
+interface(`mls_xwin_write_to_clearance',`
+ gen_require(`
+ attribute mlsxwinwritetoclr;
+ ')
+
+ typeattribute $1 mlsxwinwritetoclr;
+')
+
+########################################
+## <summary>
+## Make specified domain MLS trusted
## for writing to X objects at any level.
## </summary>
## <param name="domain">
diff --git a/policy/modules/kernel/mls.te b/policy/modules/kernel/mls.te
index b03867c..ad80ba3 100644
--- a/policy/modules/kernel/mls.te
+++ b/policy/modules/kernel/mls.te
@@ -1,5 +1,5 @@
-policy_module(mls,1.6.1)
+policy_module(mls,1.6.2)
########################################
#
diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if
index 4a5c03d..6d971f0 100644
--- a/policy/modules/services/bluetooth.if
+++ b/policy/modules/services/bluetooth.if
@@ -107,7 +107,7 @@ template(`bluetooth_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
+ xserver_user_x_domain_template($1, $1_bluetooth, $1_bluetooth_t, $1_bluetooth_tmpfs_t)
')
')
diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index 062c11f..2552087 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -1,5 +1,5 @@
-policy_module(bluetooth,2.0.0)
+policy_module(bluetooth,2.0.1)
########################################
#
diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if
index e1a478c..f4eb2c8 100644
--- a/policy/modules/services/ssh.if
+++ b/policy/modules/services/ssh.if
@@ -282,7 +282,7 @@ template(`ssh_per_role_template',`
')
optional_policy(`
- xserver_user_client_template($1,$1_ssh_t,$1_ssh_tmpfs_t)
+ xserver_user_x_domain_template($1,$1_ssh,$1_ssh_t,$1_ssh_tmpfs_t)
xserver_domtrans_user_xauth($1,$1_ssh_t)
')
diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te
index 8a76ce7..4dd6e69 100644
--- a/policy/modules/services/ssh.te
+++ b/policy/modules/services/ssh.te
@@ -1,5 +1,5 @@
-policy_module(ssh,1.9.0)
+policy_module(ssh,1.9.1)
########################################
#
diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc
index ca40ef8..1c4a31d 100644
--- a/policy/modules/services/xserver.fc
+++ b/policy/modules/services/xserver.fc
@@ -60,7 +60,7 @@ ifdef(`distro_redhat',`
/usr/(s)?bin/gdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/(s)?bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
-/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
+/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
/usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
/usr/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
@@ -74,7 +74,7 @@ ifdef(`distro_debian', `
/usr/X11R6/bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/X11R6/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
-/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0)
+/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
/usr/X11R6/bin/XFree86 -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/bin/Xipaq -- gen_context(system_u:object_r:xserver_exec_t,s0)
diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if
index ccf2176..6037a2f 100644
--- a/policy/modules/services/xserver.if
+++ b/policy/modules/services/xserver.if
@@ -15,6 +15,11 @@
template(`xserver_common_domain_template',`
gen_require(`
type xkb_var_lib_t, xserver_exec_t, xserver_log_t;
+
+ attribute x_server_domain;
+ class x_drawable all_x_drawable_perms;
+ class x_colormap all_x_colormap_perms;
+ class x_screen all_x_screen_perms;
')
##############################
@@ -22,7 +27,12 @@ template(`xserver_common_domain_template',`
# Declarations
#
- type $1_xserver_t;
+ attribute $1_x_domain;
+ attribute $1_input_xevent_type;
+
+ type $1_rootwindow_t, rootwindow_type;
+
+ type $1_xserver_t, x_server_domain;
domain_type($1_xserver_t)
domain_entry_file($1_xserver_t,xserver_exec_t)
@@ -83,6 +93,9 @@ template(`xserver_common_domain_template',`
manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t)
logging_log_filetrans($1_xserver_t,xserver_log_t,file)
+ # Labeling rules for default windows and colormaps
+ type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t;
+
kernel_read_system_state($1_xserver_t)
kernel_read_device_sysctls($1_xserver_t)
kernel_read_modprobe_sysctls($1_xserver_t)
@@ -142,6 +155,10 @@ template(`xserver_common_domain_template',`
fs_search_auto_mountpoints($1_xserver_t)
fs_search_ramfs($1_xserver_t)
+ selinux_validate_context($1_xserver_t)
+ selinux_compute_access_vector($1_xserver_t)
+ selinux_compute_create_context($1_xserver_t)
+
auth_use_nsswitch($1_xserver_t)
init_getpgid($1_xserver_t)
@@ -153,13 +170,15 @@ template(`xserver_common_domain_template',`
libs_use_shared_libs($1_xserver_t)
logging_send_syslog_msg($1_xserver_t)
+ logging_send_audit_msgs($1_xserver_t)
miscfiles_read_localization($1_xserver_t)
miscfiles_read_fonts($1_xserver_t)
modutils_domtrans_insmod($1_xserver_t)
- seutil_dontaudit_search_config($1_xserver_t)
+ # read x_contexts
+ seutil_read_default_contexts($1_xserver_t)
ifndef(`distro_redhat',`
allow $1_xserver_t self:process { execmem execheap execstack };
@@ -169,6 +188,32 @@ template(`xserver_common_domain_template',`
allow $1_xserver_t self:process { execmem execheap execstack };
')
+ tunable_policy(`!xserver_object_manager',`
+ # should be xserver_unconfined($1_xserver_t),
+ # but typeattribute doesnt work in conditionals
+ gen_require(`
+ attribute x_server_domain, x_domain;
+ attribute xproperty_type, xselection_type;
+ attribute xextension_type, xevent_type;
+ attribute rootwindow_type;
+
+ type remote_xclient_t;
+ ')
+ allow $1_xserver_t x_server_domain:x_server *;
+ allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *;
+ allow $1_xserver_t x_server_domain:x_screen *;
+ allow $1_xserver_t x_domain:x_gc *;
+ allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *;
+ allow $1_xserver_t xproperty_type:x_property *;
+ allow $1_xserver_t xselection_type:x_selection *;
+ allow $1_xserver_t x_domain:x_cursor *;
+ allow $1_xserver_t { x_domain remote_xclient_t }:x_client *;
+ allow $1_xserver_t { x_domain x_server_domain }:x_device *;
+ allow $1_xserver_t xextension_type:x_extension *;
+ allow $1_xserver_t { x_domain x_server_domain }:x_resource *;
+ allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *;
+ ')
+
optional_policy(`
apm_stream_connect($1_xserver_t)
')
@@ -415,6 +460,47 @@ template(`xserver_per_role_template',`
tunable_policy(`use_samba_home_dirs',`
fs_manage_cifs_files($1_iceauth_t)
')
+
+ ##############################
+ #
+ # User X object manager local policy
+ #
+
+ # Device rules
+ allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell };
+
+ allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send;
+ allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send;
+
+ # manage: xhost X11:ChangeHosts
+ # freeze: metacity X11:GrabKey
+ # force_cursor: metacity X11:GrabPointer
+ allow $2 $1_xserver_t:x_device { manage freeze force_cursor };
+
+ # gnome-settings-daemon XKEYBOARD:SetControls
+ allow $2 $1_xserver_t:x_server manage;
+
+ # gnome-settings-daemon RANDR:SelectInput
+ allow $2 $1_xserver_t:x_resource write;
+
+ # metacity X11:InstallColormap X11:UninstallColormap
+ allow $2 $1_rootwindow_t:x_colormap { install uninstall };
+
+ # read: gnome-settings-daemon RANDR:GetScreenSizeRange
+ # write: gnome-settings-daemon RANDR:SelectInput
+ # setattr: gnome-settings-daemon X11:GrabKey
+ # manage: metacity X11:ChangeWindowAttributes
+ allow $2 $1_rootwindow_t:x_drawable { read write manage setattr };
+
+ # setattr: metacity X11:InstallColormap
+ allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr };
+
+ # xrdb X11:ChangeProperty prop=RESOURCE_MANAGER
+ allow $2 info_xproperty_t:x_property { create write append };
+
+ mls_xwin_read_to_clearance($1_xserver_t)
+
+ xserver_common_x_domain_template($1,$1,$2)
')
#######################################
@@ -521,7 +607,7 @@ template(`xserver_rw_session_template',`
## </param>
#
template(`xserver_user_client_template',`
-
+# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.')
gen_require(`
type xdm_t, xdm_tmp_t;
type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
@@ -564,6 +650,279 @@ template(`xserver_user_client_template',`
')
')
+#######################################
+## <summary>
+## Interface to provide X object permissions on a given X server to
+## an X client domain. Provides the minimal set required by a basic
+## X client application.
+## </summary>
+## <param name="user">
+## <summary>
+## The prefix of the X server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the X client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+#
+template(`xserver_common_x_domain_template',`
+ gen_require(`
+ type $1_rootwindow_t, std_xext_t, shmem_xext_t;
+ type xproperty_t, info_xproperty_t, clipboard_xproperty_t;
+ type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t;
+ type xevent_t, client_xevent_t;
+ type clipboard_xselection_t, xselection_t;
+
+ attribute x_server_domain, x_domain;
+ attribute xproperty_type;
+ attribute xevent_type, xextension_type;
+ attribute $1_x_domain, $1_input_xevent_type;
+
+ class x_drawable all_x_drawable_perms;
+ class x_screen all_x_screen_perms;
+ class x_gc all_x_gc_perms;
+ class x_font all_x_font_perms;
+ class x_colormap all_x_colormap_perms;
+ class x_property all_x_property_perms;
+ class x_selection all_x_selection_perms;
+ class x_cursor all_x_cursor_perms;
+ class x_client all_x_client_perms;
+ class x_device all_x_device_perms;
+ class x_server all_x_server_perms;
+ class x_extension all_x_extension_perms;
+ class x_resource all_x_resource_perms;
+ class x_event all_x_event_perms;
+ class x_synthetic_event all_x_synthetic_event_perms;
+ ')
+
+ ##############################
+ #
+ # Declarations
+ #
+
+ # Type attributes
+ typeattribute $3 $1_x_domain, x_domain;
+
+ # Types for properties
+ type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type;
+
+ # Types for events
+ type $2_input_xevent_t, $1_input_xevent_type, xevent_type;
+ type $2_property_xevent_t, xevent_type;
+ type $2_focus_xevent_t, xevent_type;
+ type $2_manage_xevent_t, xevent_type;
+ type $2_default_xevent_t, xevent_type;
+ type $2_client_xevent_t, xevent_type;
+
+ ##############################
+ #
+ # Local Policy
+ #
+
+ # Hacks
+ # everyone can get the input focus of everyone else
+ # this is a fundamental brokenness in the X protocol
+ allow $3 { x_domain x_server_domain }:x_device getfocus;
+ # everyone can grab the server
+ # everyone does it, it is basically a free DOS attack
+ allow $3 x_server_domain:x_server grab;
+ # everyone can get the font path, etc.
+ # this could leak out sensitive information
+ allow $3 x_server_domain:x_server getattr;
+ # everyone can do override-redirect windows.
+ # this could be used to spoof labels
+ allow $3 self:x_drawable override;
+ # everyone can receive management events on the root window
+ # allows to know when new windows appear, among other things
+ allow $3 manage_xevent_t:x_event receive;
+
+ # X Server
+ # can read server-owned resources
+ allow $3 x_server_domain:x_resource read;
+ # can mess with own clients
+ allow $3 self:x_client { manage destroy };
+
+ # X Protocol Extensions
+ allow $3 std_xext_t:x_extension { query use };
+ allow $3 shmem_xext_t:x_extension { query use };
+ dontaudit $3 xextension_type:x_extension { query use };
+
+ # X Properties
+ # can read and write client properties
+ allow $3 $2_xproperty_t:x_property { create destroy read write append };
+ type_transition $3 xproperty_t:x_property $2_xproperty_t;
+ # can read and write cut buffers
+ allow $3 clipboard_xproperty_t:x_property { create read write append };
+ # can read info properties
+ allow $3 info_xproperty_t:x_property read;
+ # can change properties of root window
+ allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property };
+ # can change properties of own windows
+ allow $3 self:x_drawable { list_property get_property set_property };
+
+ # X Windows
+ # operations allowed on root windows
+ allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive };
+ # operations allowed on my windows
+ allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive };
+ type_transition $3 $1_rootwindow_t:x_drawable $3;
+
+ # X Colormaps
+ # can use the default colormap
+ allow $3 $1_rootwindow_t:x_colormap { read use add_color };
+
+ # X Input
+ # can receive own events
+ allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive;
+ allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive;
+ allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive;
+ allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive;
+ allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive;
+ allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive;
+ type_transition $3 input_xevent_t:x_event $2_input_xevent_t;
+ type_transition $3 property_xevent_t:x_event $2_property_xevent_t;
+ type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t;
+ type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t;
+ type_transition $3 client_xevent_t:x_event $2_client_xevent_t;
+ type_transition $3 xevent_t:x_event $2_default_xevent_t;
+ # can receive certain root window events
+ allow $3 focus_xevent_t:x_event receive;
+ allow $3 property_xevent_t:x_event receive;
+ allow $3 client_xevent_t:x_synthetic_event receive;
+ allow $3 manage_xevent_t:x_synthetic_event receive;
+ # can send ICCCM events to myself
+ allow $3 $2_manage_xevent_t:x_synthetic_event send;
+ # can send ICCCM events to the root window
+ allow $3 manage_xevent_t:x_synthetic_event send;
+ allow $3 client_xevent_t:x_synthetic_event send;
+
+ # X Selections
+ # can use the clipboard
+ allow $3 clipboard_xselection_t:x_selection { getattr setattr read };
+ # can query all other selections
+ allow $3 xselection_t:x_selection { getattr read };
+
+ # Other X Objects
+ # can create and use cursors
+ allow $3 self:x_cursor *;
+ # can create and use graphics contexts
+ allow $3 self:x_gc *;
+ # can create and use colormaps
+ allow $3 self:x_colormap *;
+ # can read and write own objects
+ allow $3 self:x_resource { read write };
+
+ tunable_policy(`! xserver_object_manager',`
+ # should be xserver_unconfined($3),
+ # but typeattribute doesnt work in conditionals
+ gen_require(`
+ attribute x_server_domain, x_domain;
+ attribute xproperty_type, xselection_type;
+ attribute xextension_type, xevent_type;
+ attribute rootwindow_type;
+
+ type remote_xclient_t;
+ ')
+ allow $3 x_server_domain:x_server *;
+ allow $3 { x_domain rootwindow_type }:x_drawable *;
+ allow $3 x_server_domain:x_screen *;
+ allow $3 x_domain:x_gc *;
+ allow $3 { x_domain rootwindow_type }:x_colormap *;
+ allow $3 xproperty_type:x_property *;
+ allow $3 xselection_type:x_selection *;
+ allow $3 x_domain:x_cursor *;
+ allow $3 { x_domain remote_xclient_t }:x_client *;
+ allow $3 { x_domain x_server_domain }:x_device *;
+ allow $3 xextension_type:x_extension *;
+ allow $3 { x_domain x_server_domain }:x_resource *;
+ allow $3 xevent_type:{ x_event x_synthetic_event } *;
+ ')
+')
+
+#######################################
+## <summary>
+## Interface to provide X object permissions on a given X server to
+## an X client domain. Provides the minimal set required by a basic
+## X client application.
+## </summary>
+## <param name="user">
+## <summary>
+## The prefix of the X server domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="prefix">
+## <summary>
+## The prefix of the X client domain (e.g., user
+## is the prefix for user_t).
+## </summary>
+## </param>
+## <param name="domain">
+## <summary>
+## Client domain allowed access.
+## </summary>
+## </param>
+## <param name="tmpfs_type">
+## <summary>
+## The type of the domain SYSV tmpfs files.
+## </summary>
+## </param>
+#
+template(`xserver_user_x_domain_template',`
+ gen_require(`
+ type xdm_t, xdm_tmp_t;
+ type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
+ ')
+
+ allow $3 self:shm create_shm_perms;
+ allow $3 self:unix_dgram_socket create_socket_perms;
+ allow $3 self:unix_stream_socket { connectto create_stream_socket_perms };
+
+ # Read .Xauthority file
+ allow $3 $1_xauth_home_t:file { getattr read };
+ allow $3 $1_iceauth_home_t:file { getattr read };
+
+ # for when /tmp/.X11-unix is created by the system
+ allow $3 xdm_t:fd use;
+ allow $3 xdm_t:fifo_file { getattr read write ioctl };
+ allow $3 xdm_tmp_t:dir search;
+ allow $3 xdm_tmp_t:sock_file { read write };
+ dontaudit $3 xdm_t:tcp_socket { read write };
+
+ # Allow connections to X server.
+ files_search_tmp($3)
+
+ miscfiles_read_fonts($3)
+
+ userdom_search_user_home_dirs($1,$3)
+ # for .xsession-errors
+ userdom_dontaudit_write_user_home_content_files($1,$3)
+
+ xserver_ro_session_template(xdm,$3,$4)
+ xserver_rw_session_template($1,$3,$4)
+ xserver_use_user_fonts($1,$3)
+
+ xserver_read_xdm_tmp_files($3)
+
+ # X object manager
+ xserver_common_x_domain_template($1,$2,$3)
+
+ # Client write xserver shm
+ tunable_policy(`allow_write_xshm',`
+ allow $3 $1_xserver_t:shm rw_shm_perms;
+ allow $3 $1_xserver_tmpfs_t:file rw_file_perms;
+ ')
+')
+
########################################
## <summary>
## Read user fonts, user font configuration,
@@ -1312,3 +1671,23 @@ interface(`xserver_stream_connect_xdm_xserver',`
files_search_tmp($1)
stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t)
')
+
+########################################
+## <summary>
+## Interface to provide X object permissions on a given X server to
+## an X client domain. Gives the domain complete control over the
+## display.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`xserver_unconfined',`
+ gen_require(`
+ attribute xserver_unconfined_type;
+ ')
+
+ typeattribute $1 xserver_unconfined_type;
+')
diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index 6fda6b2..dcafdcf 100644
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -1,5 +1,5 @@
-policy_module(xserver,1.7.0)
+policy_module(xserver,2.0.0)
########################################
#
@@ -21,14 +21,58 @@ gen_tunable(allow_write_xshm,false)
## </desc>
gen_tunable(xdm_sysadm_login,false)
+## <desc>
+## <p>
+## Support X userspace object manager
+## </p>
+## </desc>
+gen_tunable(xserver_object_manager,false)
+
attribute fonts_type;
attribute fonts_cache_type;
attribute fonts_config_type;
attribute xauth_home_type;
+# Domains
+attribute xserver_unconfined_type;
+attribute x_server_domain;
+
+# Per-object attributes
+attribute rootwindow_type;
+attribute x_domain;
+attribute xproperty_type;
+attribute xselection_type;
+attribute xextension_type;
+attribute xevent_type;
+
+type accelgraphics_xext_t, xextension_type;
+type client_xevent_t, xevent_type;
+type clipboard_xproperty_t, xproperty_type;
+type clipboard_xselection_t, xselection_type;
+type debug_xext_t, xextension_type;
+type directhw_xext_t alias disallowed_xext_t, xextension_type;
+type focus_xevent_t, xevent_type;
+
type iceauth_exec_t;
application_executable_file(iceauth_exec_t)
+type info_xproperty_t, xproperty_type;
+type input_xevent_t, xevent_type;
+type manage_xevent_t, xevent_type;
+type output_xext_t, xextension_type;
+type property_xevent_t, xevent_type;
+type remote_xclient_t;
+type screensaver_xext_t, xextension_type;
+type security_xext_t, xextension_type;
+type shmem_xext_t, xextension_type;
+type std_xext_t, xextension_type;
+type video_xext_t, xextension_type;
+type unknown_xevent_t, xevent_type;
+type xevent_t alias default_xevent_t, xevent_type;
+type xext_t alias unknown_xext_t, xextension_type;
+type xproperty_t alias default_xproperty_t, xproperty_type;
+type xselection_t alias default_xselection_t, xselection_type;
+
type xauth_exec_t;
application_executable_file(xauth_exec_t)
@@ -79,6 +123,7 @@ type xserver_log_t;
logging_log_file(xserver_log_t)
xserver_common_domain_template(xdm)
+xserver_common_x_domain_template(xdm,xdm,xdm_t)
init_system_domain(xdm_xserver_t,xserver_exec_t)
ifdef(`enable_mcs',`
@@ -272,6 +317,7 @@ userdom_read_all_users_state(xdm_t)
userdom_signal_all_users(xdm_t)
xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t)
+xserver_unconfined(xdm_t)
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(xdm_t)
@@ -441,6 +487,25 @@ optional_policy(`
')
')
+########################################
+#
+# Rules for unconfined access to this module
+#
+
+allow xserver_unconfined_type x_server_domain:x_server *;
+allow xserver_unconfined_type { x_domain rootwindow_type }:x_drawable *;
+allow xserver_unconfined_type x_server_domain:x_screen *;
+allow xserver_unconfined_type x_domain:x_gc *;
+allow xserver_unconfined_type { x_domain rootwindow_type }:x_colormap *;
+allow xserver_unconfined_type xproperty_type:x_property *;
+allow xserver_unconfined_type xselection_type:x_selection *;
+allow xserver_unconfined_type x_domain:x_cursor *;
+allow xserver_unconfined_type { x_domain remote_xclient_t }:x_client *;
+allow xserver_unconfined_type { x_domain x_server_domain }:x_device *;
+allow xserver_unconfined_type xextension_type:x_extension *;
+allow xserver_unconfined_type { x_domain x_server_domain }:x_resource *;
+allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *;
+
ifdef(`TODO',`
# Need to further investigate these permissions and
# perhaps define derived types.
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
index 69a720d..14b419c 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -95,6 +95,10 @@ interface(`unconfined_domain_noaudit',`
optional_policy(`
storage_unconfined($1)
')
+
+ optional_policy(`
+ xserver_unconfined($1)
+ ')
')
########################################
diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te
index 972d92a..0ca49cd 100644
--- a/policy/modules/system/unconfined.te
+++ b/policy/modules/system/unconfined.te
@@ -1,5 +1,5 @@
-policy_module(unconfined,2.1.0)
+policy_module(unconfined,2.1.1)
########################################
#
diff --git a/support/selinux-policy-refpolicy.spec b/support/selinux-policy-refpolicy.spec
index 4ceaf73..b5c5d61 100644
--- a/support/selinux-policy-refpolicy.spec
+++ b/support/selinux-policy-refpolicy.spec
@@ -74,6 +74,7 @@ make NAME=%{polname2} TYPE=%{type2} DISTRO=%{distro} DIRECT_INITRC=%{direct_init
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context
+%config(noreplace) %{_sysconfdir}/selinux/*/contexts/x_contexts
%dir %{_sysconfdir}/selinux/*/contexts/files
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template
@@ -117,6 +118,7 @@ SELinux Reference policy targeted base module.
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context
+%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/x_contexts
%dir %{_sysconfdir}/selinux/%{polname1}/contexts/files
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template
@@ -162,6 +164,7 @@ SELinux Reference policy strict base module.
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context
%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context
+%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/x_contexts
%dir %{_sysconfdir}/selinux/%{polname2}/contexts/files
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts
#%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template
More information about the scm-commits
mailing list