policy_module(xserver, 3.0.0)

gen_require(`

	class x_drawable all_x_drawable_perms;

	class x_screen all_x_screen_perms;

	class x_gc all_x_gc_perms;

	class x_font all_x_font_perms;

	class x_colormap all_x_colormap_perms;

	class x_property all_x_property_perms;

	class x_selection all_x_selection_perms;

	class x_cursor all_x_cursor_perms;

	class x_client all_x_client_perms;

	class x_device all_x_device_perms;

	class x_server all_x_server_perms;

	class x_extension all_x_extension_perms;

	class x_resource all_x_resource_perms;

	class x_event all_x_event_perms;

	class x_synthetic_event all_x_synthetic_event_perms;

')

########################################

#

# Declarations

#

## <desc>

## 

## Allows clients to write to the X server shared

## memory segments.

## 

## </desc>

gen_tunable(allow_write_xshm, false)

## <desc>

## 

## Allow xdm logins as sysadm

## 

## </desc>

gen_tunable(xdm_sysadm_login, false)

## <desc>

## 

## Support X userspace object manager

## 

## </desc>

gen_tunable(xserver_object_manager, false)

attribute input_xevent_type;

attribute xserver_unconfined_type;

attribute x_domain;

attribute x_userdomain;

attribute xproperty_type;

attribute xselection_type;

attribute xextension_type;

attribute xevent_type;

type accelgraphics_xext_t, xextension_type;

type client_xevent_t, xevent_type;

type clipboard_xproperty_t, xproperty_type;

type clipboard_xselection_t, xselection_type;

type debug_xext_t, xextension_type;

type directhw_xext_t alias disallowed_xext_t, xextension_type;

type focus_xevent_t, xevent_type;

type iceauth_t;

type iceauth_exec_t;

typealias iceauth_t alias { user_iceauth_t staff_iceauth_t sysadm_iceauth_t };

typealias iceauth_t alias { auditadm_iceauth_t secadm_iceauth_t };

application_domain(iceauth_t, iceauth_exec_t)

ubac_constrained(iceauth_t)

type iceauth_home_t;

typealias iceauth_home_t alias { user_iceauth_home_t staff_iceauth_home_t sysadm_iceauth_home_t };

typealias iceauth_home_t alias { auditadm_iceauth_home_t secadm_iceauth_home_t };

files_poly_member(iceauth_home_t)

userdom_user_home_content(iceauth_home_t)

type info_xproperty_t, xproperty_type;

type input_xevent_t, xevent_type;

type manage_xevent_t, xevent_type;

type output_xext_t, xextension_type;

type property_xevent_t, xevent_type;

type remote_xclient_t;

type rootwindow_t;

typealias rootwindow_t alias { user_rootwindow_t staff_rootwindow_t sysadm_rootwindow_t };

typealias rootwindow_t alias { auditadm_rootwindow_t secadm_rootwindow_t };

ubac_constrained(rootwindow_t)

type screensaver_xext_t, xextension_type;

type security_xext_t, xextension_type;

type shmem_xext_t, xextension_type;

type std_xext_t, xextension_type;

type video_xext_t, xextension_type;

type unknown_xevent_t, xevent_type;

xserver_object_types_template(user)

typealias user_xproperty_t alias { staff_xproperty_t sysadm_xproperty_t };

typealias user_xproperty_t alias { auditadm_xproperty_t secadm_xproperty_t };

typealias user_input_xevent_t alias { staff_input_xevent_t sysadm_input_xevent_t };

typealias user_input_xevent_t alias { auditadm_input_xevent_t secadm_input_xevent_t };

typealias user_property_xevent_t alias { staff_property_xevent_t sysadm_property_xevent_t };

typealias user_property_xevent_t alias { auditadm_property_xevent_t secadm_property_xevent_t };

typealias user_focus_xevent_t alias { staff_focus_xevent_t sysadm_focus_xevent_t };

typealias user_focus_xevent_t alias { auditadm_focus_xevent_t secadm_focus_xevent_t };

typealias user_manage_xevent_t alias { staff_manage_xevent_t sysadm_manage_xevent_t };

typealias user_manage_xevent_t alias { auditadm_manage_xevent_t secadm_manage_xevent_t };

typealias user_default_xevent_t alias { staff_default_xevent_t sysadm_default_xevent_t };

typealias user_default_xevent_t alias { auditadm_default_xevent_t secadm_default_xevent_t };

typealias user_client_xevent_t alias { staff_client_xevent_t sysadm_client_xevent_t };

typealias user_client_xevent_t alias { auditadm_client_xevent_t secadm_client_xevent_t };

type user_fonts_t;

typealias user_fonts_t alias { staff_fonts_t sysadm_fonts_t };

typealias user_fonts_t alias { auditadm_fonts_t secadm_fonts_t };

userdom_user_home_content(user_fonts_t)

type user_fonts_cache_t;

typealias user_fonts_cache_t alias { staff_fonts_cache_t sysadm_fonts_cache_t };

typealias user_fonts_cache_t alias { auditadm_fonts_cache_t secadm_fonts_cache_t };

userdom_user_home_content(user_fonts_cache_t)

type user_fonts_config_t;

typealias user_fonts_config_t alias { staff_fonts_config_t sysadm_fonts_config_t };

typealias user_fonts_config_t alias { auditadm_fonts_config_t secadm_fonts_config_t };

userdom_user_home_content(user_fonts_cache_t)

type xevent_t alias default_xevent_t, xevent_type;

type xext_t alias unknown_xext_t, xextension_type;

type xproperty_t alias default_xproperty_t, xproperty_type;

type xselection_t alias default_xselection_t, xselection_type;

type xauth_t;

type xauth_exec_t;

typealias xauth_t alias { user_xauth_t staff_xauth_t sysadm_xauth_t };

typealias xauth_t alias { auditadm_xauth_t secadm_xauth_t };

application_domain(xauth_t, xauth_exec_t)

ubac_constrained(xauth_t)

type xauth_home_t;

typealias xauth_home_t alias { user_xauth_home_t staff_xauth_home_t sysadm_xauth_home_t };

typealias xauth_home_t alias { auditadm_xauth_home_t secadm_xauth_home_t };

files_poly_member(xauth_home_t)

userdom_user_home_content(xauth_home_t)

type xauth_tmp_t;

typealias xauth_tmp_t alias { user_xauth_tmp_t staff_xauth_tmp_t sysadm_xauth_tmp_t };

typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t };

files_tmp_file(xauth_tmp_t)

ubac_constrained(xauth_tmp_t)

# this is not actually a device, its a pipe

type xconsole_device_t;

files_type(xconsole_device_t)

fs_associate_tmpfs(xconsole_device_t)

files_associate_tmp(xconsole_device_t)

type xdm_t;

type xdm_exec_t;

auth_login_pgm_domain(xdm_t)

init_domain(xdm_t, xdm_exec_t)

init_daemon_domain(xdm_t, xdm_exec_t)

type xdm_lock_t;

files_lock_file(xdm_lock_t)

type xdm_rw_etc_t;

files_type(xdm_rw_etc_t)

type xdm_var_lib_t;

files_type(xdm_var_lib_t)

type xdm_var_run_t;

files_pid_file(xdm_var_run_t)

type xdm_tmp_t;

files_tmp_file(xdm_tmp_t)

typealias xdm_tmp_t alias ice_tmp_t;

type xdm_tmpfs_t;

files_tmpfs_file(xdm_tmpfs_t)

# type for /var/lib/xkb

type xkb_var_lib_t;

files_type(xkb_var_lib_t)

# Type for the executable used to start the X server, e.g. Xwrapper.

type xserver_t;

type xserver_exec_t;

typealias xserver_t alias { user_xserver_t staff_xserver_t sysadm_xserver_t };

typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t };

xserver_object_types_template(xdm)

xserver_common_x_domain_template(xdm,xdm_t)

init_system_domain(xserver_t, xserver_exec_t)

ubac_constrained(xserver_t)

type xserver_tmp_t;

typealias xserver_tmp_t alias { user_xserver_tmp_t staff_xserver_tmp_t sysadm_xserver_tmp_t };

typealias xserver_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t };

files_tmp_file(xserver_tmp_t)

ubac_constrained(xserver_tmp_t)

type xserver_tmpfs_t;

typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t };

typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t };

files_tmpfs_file(xserver_tmpfs_t)

ubac_constrained(xserver_tmpfs_t)

type xsession_exec_t;

corecmd_executable_file(xsession_exec_t)

# Type for the X server log file.

type xserver_log_t;

logging_log_file(xserver_log_t)

ifdef(`enable_mcs',`

	init_ranged_domain(xdm_t,xdm_exec_t,s0 - mcs_systemhigh)

	init_ranged_daemon_domain(xdm_t,xdm_exec_t,s0 - mcs_systemhigh)

')

optional_policy(`

	prelink_object_file(xkb_var_lib_t)

')

########################################

#

# Iceauth local policy

#

allow iceauth_t iceauth_home_t:file manage_file_perms;

userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file)

allow xdm_t iceauth_home_t:file read_file_perms;

fs_search_auto_mountpoints(iceauth_t)

userdom_use_user_terminals(iceauth_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_files(iceauth_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_files(iceauth_t)

')

########################################

#

# Xauth local policy

#

allow xauth_t self:process signal;

allow xauth_t self:unix_stream_socket create_stream_socket_perms;

allow xauth_t xauth_home_t:file manage_file_perms;

userdom_user_home_dir_filetrans(xauth_t, xauth_home_t, file)

manage_dirs_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)

manage_files_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)

files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })

allow xdm_t xauth_home_t:file manage_file_perms;

userdom_user_home_dir_filetrans(xdm_t, xauth_home_t, file)

domain_use_interactive_fds(xauth_t)

files_read_etc_files(xauth_t)

files_search_pids(xauth_t)

fs_getattr_xattr_fs(xauth_t)

fs_search_auto_mountpoints(xauth_t)

# cjp: why?

term_use_ptmx(xauth_t)

auth_use_nsswitch(xauth_t)

userdom_use_user_terminals(xauth_t)

userdom_read_user_tmp_files(xauth_t)

xserver_rw_xdm_tmp_files(xauth_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_files(xauth_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_files(xauth_t)

')

optional_policy(`

	ssh_sigchld(xauth_t)

	ssh_read_pipes(xauth_t)

	ssh_dontaudit_rw_tcp_sockets(xauth_t)

')

########################################

#

# XDM Local policy

#

allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service };

allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate };

allow xdm_t self:fifo_file rw_fifo_file_perms;

allow xdm_t self:shm create_shm_perms;

allow xdm_t self:sem create_sem_perms;

allow xdm_t self:unix_stream_socket { connectto create_stream_socket_perms };

allow xdm_t self:unix_dgram_socket create_socket_perms;

allow xdm_t self:tcp_socket create_stream_socket_perms;

allow xdm_t self:udp_socket create_socket_perms;

allow xdm_t self:socket create_socket_perms;

allow xdm_t self:appletalk_socket create_socket_perms;

allow xdm_t self:key { search link write };

allow xdm_t xconsole_device_t:fifo_file { getattr setattr };

# Allow gdm to run gdm-binary

can_exec(xdm_t, xdm_exec_t)

allow xdm_t xdm_lock_t:file manage_file_perms;

files_lock_filetrans(xdm_t, xdm_lock_t, file)

# wdm has its own config dir /etc/X11/wdm

# this is ugly, daemons should not create files under /etc!

manage_files_pattern(xdm_t, xdm_rw_etc_t, xdm_rw_etc_t)

manage_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file })

manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

fs_tmpfs_filetrans(xdm_t, xdm_tmpfs_t,{ dir file lnk_file sock_file fifo_file })

manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)	

manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)

files_var_lib_filetrans(xdm_t, xdm_var_lib_t, file)

manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file })

allow xdm_t xserver_t:process signal;

allow xdm_t xserver_t:unix_stream_socket connectto;

allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms;

allow xdm_t xserver_tmp_t:dir { setattr list_dir_perms };

# transition to the xdm xserver

domtrans_pattern(xdm_t, xserver_exec_t, xserver_t)

allow xserver_t xdm_t:process signal;

allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };

allow xdm_t xserver_t:shm rw_shm_perms;

# connect to xdm xserver over stream socket

stream_connect_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t,xserver_t)

# Remove /tmp/.X11-unix/X0.

delete_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)

delete_sock_files_pattern(xdm_t,xserver_tmp_t,xserver_tmp_t)

manage_dirs_pattern(xdm_t, xserver_log_t, xserver_log_t)

manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)

manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)

logging_log_filetrans(xdm_t, xserver_log_t, file)

kernel_read_system_state(xdm_t)

kernel_read_kernel_sysctls(xdm_t)

kernel_read_net_sysctls(xdm_t)

kernel_read_network_state(xdm_t)

corecmd_exec_shell(xdm_t)

corecmd_exec_bin(xdm_t)

corenet_all_recvfrom_unlabeled(xdm_t)

corenet_all_recvfrom_netlabel(xdm_t)

corenet_tcp_sendrecv_generic_if(xdm_t)

corenet_udp_sendrecv_generic_if(xdm_t)

corenet_tcp_sendrecv_all_nodes(xdm_t)

corenet_udp_sendrecv_all_nodes(xdm_t)

corenet_tcp_sendrecv_all_ports(xdm_t)

corenet_udp_sendrecv_all_ports(xdm_t)

corenet_tcp_bind_all_nodes(xdm_t)

corenet_udp_bind_all_nodes(xdm_t)

corenet_tcp_connect_all_ports(xdm_t)

corenet_sendrecv_all_client_packets(xdm_t)

# xdm tries to bind to biff_port_t

corenet_dontaudit_tcp_bind_all_ports(xdm_t)

dev_read_rand(xdm_t)

dev_read_sysfs(xdm_t)

dev_getattr_framebuffer_dev(xdm_t)

dev_setattr_framebuffer_dev(xdm_t)

dev_getattr_mouse_dev(xdm_t)

dev_setattr_mouse_dev(xdm_t)

dev_rw_apm_bios(xdm_t)

dev_setattr_apm_bios_dev(xdm_t)

dev_rw_dri(xdm_t)

dev_rw_agp(xdm_t)

dev_getattr_xserver_misc_dev(xdm_t)

dev_setattr_xserver_misc_dev(xdm_t)

dev_getattr_misc_dev(xdm_t)

dev_setattr_misc_dev(xdm_t)

dev_dontaudit_rw_misc(xdm_t)

dev_getattr_video_dev(xdm_t)

dev_setattr_video_dev(xdm_t)

dev_getattr_scanner_dev(xdm_t)

dev_setattr_scanner_dev(xdm_t)

dev_getattr_sound_dev(xdm_t)

dev_setattr_sound_dev(xdm_t)

dev_getattr_power_mgmt_dev(xdm_t)

dev_setattr_power_mgmt_dev(xdm_t)

domain_use_interactive_fds(xdm_t)

# Do not audit denied probes of /proc.

domain_dontaudit_read_all_domains_state(xdm_t)

files_read_etc_files(xdm_t)

files_read_var_files(xdm_t)

files_read_etc_runtime_files(xdm_t)

files_exec_etc_files(xdm_t)

files_list_mnt(xdm_t)

# Read /usr/share/terminfo/l/linux and /usr/share/icons/default/index.theme...

files_read_usr_files(xdm_t)

# Poweroff wants to create the /poweroff file when run from xdm

files_create_boot_flag(xdm_t)

fs_getattr_all_fs(xdm_t)

fs_search_auto_mountpoints(xdm_t)

storage_dontaudit_read_fixed_disk(xdm_t)

storage_dontaudit_write_fixed_disk(xdm_t)

storage_dontaudit_setattr_fixed_disk_dev(xdm_t)

storage_dontaudit_raw_read_removable_device(xdm_t)

storage_dontaudit_raw_write_removable_device(xdm_t)

storage_dontaudit_setattr_removable_dev(xdm_t)

storage_dontaudit_rw_scsi_generic(xdm_t)

term_setattr_console(xdm_t)

term_use_unallocated_ttys(xdm_t)

term_setattr_unallocated_ttys(xdm_t)

auth_domtrans_pam_console(xdm_t)

auth_manage_pam_pid(xdm_t)

auth_manage_pam_console_data(xdm_t)

auth_rw_faillog(xdm_t)

auth_write_login_records(xdm_t)

# Run telinit->init to shutdown.

init_telinit(xdm_t)

libs_exec_lib_files(xdm_t)

logging_read_generic_logs(xdm_t)

miscfiles_read_localization(xdm_t)

miscfiles_read_fonts(xdm_t)

sysnet_read_config(xdm_t)

userdom_dontaudit_use_unpriv_user_fds(xdm_t)

userdom_create_all_users_keys(xdm_t)

# for .dmrc

userdom_read_user_home_content_files(xdm_t)

# Search /proc for any user domain processes.

userdom_read_all_users_state(xdm_t)

userdom_signal_all_users(xdm_t)

xserver_rw_session(xdm_t,xdm_tmpfs_t)

xserver_unconfined(xdm_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_dirs(xdm_t)

	fs_manage_nfs_files(xdm_t)

	fs_manage_nfs_symlinks(xdm_t)

	fs_exec_nfs_files(xdm_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_dirs(xdm_t)

	fs_manage_cifs_files(xdm_t)

	fs_manage_cifs_symlinks(xdm_t)

	fs_exec_cifs_files(xdm_t)

')

tunable_policy(`xdm_sysadm_login',`

	userdom_xsession_spec_domtrans_all_users(xdm_t)

	# FIXME:

#	xserver_rw_session_template(xdm,userdomain)

',`

	userdom_xsession_spec_domtrans_unpriv_users(xdm_t)

	# FIXME:

#	xserver_rw_session_template(xdm,unpriv_userdomain)

#	dontaudit xserver_t sysadm_t:shm { unix_read unix_write };

#	allow xserver_t xdm_tmpfs_t:file rw_file_perms;

')

optional_policy(`

	alsa_domtrans(xdm_t)

')

optional_policy(`

	consolekit_dbus_chat(xdm_t)

')

optional_policy(`

	consoletype_exec(xdm_t)

')

optional_policy(`

	# Talk to the console mouse server.

	gpm_stream_connect(xdm_t)

	gpm_setattr_gpmctl(xdm_t)

')

optional_policy(`

	hostname_exec(xdm_t)

')

optional_policy(`

	loadkeys_exec(xdm_t)

')

optional_policy(`

	locallogin_signull(xdm_t)

')

optional_policy(`

	# Do not audit attempts to check whether user root has email

	mta_dontaudit_getattr_spool_files(xdm_t)

')

optional_policy(`

	resmgr_stream_connect(xdm_t)

')

optional_policy(`

	seutil_sigchld_newrole(xdm_t)

')

optional_policy(`

	udev_read_db(xdm_t)

')

optional_policy(`

	unconfined_domain(xdm_t)

	unconfined_domtrans(xdm_t)

	ifndef(`distro_redhat',`

		allow xdm_t self:process { execheap execmem };

	')

	ifdef(`distro_rhel4',`

		allow xdm_t self:process { execheap execmem };

	')

')

optional_policy(`

	userhelper_dontaudit_search_config(xdm_t)

')

optional_policy(`

	usermanage_read_crack_db(xdm_t)

')

optional_policy(`

	xfs_stream_connect(xdm_t)

')

########################################

#

# X server local policy

#

# setuid/setgid for the wrapper program to change UID

# sys_rawio is for iopl access - should not be needed for frame-buffer

# sys_admin, locking shared mem?  chowning IPC message queues or semaphores?

# admin of APM bios?

# sys_nice is so that the X server can set a negative nice value

# execheap needed until the X module loader is fixed.

# NVIDIA Needs execstack

allow xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };

dontaudit xserver_t self:capability chown;

allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

allow xserver_t self:memprotect mmap_zero;

allow xserver_t self:fd use;

allow xserver_t self:fifo_file rw_fifo_file_perms;

allow xserver_t self:sock_file read_sock_file_perms;

allow xserver_t self:shm create_shm_perms;

allow xserver_t self:sem create_sem_perms;

allow xserver_t self:msgq create_msgq_perms;

allow xserver_t self:msg { send receive };

allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };

allow xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };

allow xserver_t self:tcp_socket create_stream_socket_perms;

allow xserver_t self:udp_socket create_socket_perms;

# Device rules

allow x_domain xserver_t:x_device { read getattr use setattr setfocus grab bell };

allow xserver_t { input_xevent_t input_xevent_type }:x_event send;

domtrans_pattern(xserver_t, xauth_exec_t, xauth_t)

allow xserver_t xauth_home_t:file read_file_perms;

# Labeling rules for root windows and colormaps

type_transition xserver_t xserver_t:{ x_drawable x_colormap } rootwindow_t;

allow xserver_t { rootwindow_t x_domain }:x_drawable send;

manage_dirs_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)

manage_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)

manage_sock_files_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t)

files_tmp_filetrans(xserver_t, xserver_tmp_t, { file dir sock_file })

filetrans_pattern(xserver_t, xserver_tmp_t, xserver_tmp_t,sock_file)

manage_dirs_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)

manage_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)

manage_lnk_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)

manage_fifo_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)

manage_sock_files_pattern(xserver_t, xserver_tmpfs_t, xserver_tmpfs_t)

fs_tmpfs_filetrans(xserver_t, xserver_tmpfs_t, { dir file lnk_file sock_file fifo_file })

manage_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)

manage_lnk_files_pattern(xserver_t, xkb_var_lib_t, xkb_var_lib_t)

files_search_var_lib(xserver_t)

# Create files in /var/log with the xserver_log_t type.

manage_files_pattern(xserver_t, xserver_log_t, xserver_log_t)

logging_log_filetrans(xserver_t, xserver_log_t,file)

kernel_read_system_state(xserver_t)

kernel_read_device_sysctls(xserver_t)

kernel_read_modprobe_sysctls(xserver_t)

# Xorg wants to check if kernel is tainted

kernel_read_kernel_sysctls(xserver_t)

kernel_write_proc_files(xserver_t)

# Run helper programs in xserver_t.

corecmd_exec_bin(xserver_t)

corecmd_exec_shell(xserver_t)

corenet_all_recvfrom_unlabeled(xserver_t)

corenet_all_recvfrom_netlabel(xserver_t)

corenet_tcp_sendrecv_generic_if(xserver_t)

corenet_udp_sendrecv_generic_if(xserver_t)

corenet_tcp_sendrecv_all_nodes(xserver_t)

corenet_udp_sendrecv_all_nodes(xserver_t)

corenet_tcp_sendrecv_all_ports(xserver_t)

corenet_udp_sendrecv_all_ports(xserver_t)

corenet_tcp_bind_all_nodes(xserver_t)

corenet_tcp_bind_xserver_port(xserver_t)

corenet_tcp_connect_all_ports(xserver_t)

corenet_sendrecv_xserver_server_packets(xserver_t)

corenet_sendrecv_all_client_packets(xserver_t)

dev_rw_sysfs(xserver_t)

dev_rw_mouse(xserver_t)

dev_rw_mtrr(xserver_t)

dev_rw_apm_bios(xserver_t)

dev_rw_agp(xserver_t)

dev_rw_framebuffer(xserver_t)

dev_manage_dri_dev(xserver_t)

dev_create_generic_dirs(xserver_t)

dev_setattr_generic_dirs(xserver_t)

# raw memory access is needed if not using the frame buffer

dev_read_raw_memory(xserver_t)

dev_wx_raw_memory(xserver_t)

# for other device nodes such as the NVidia binary-only driver

dev_rw_xserver_misc(xserver_t)

# read events - the synaptics touchpad driver reads raw events

dev_rw_input_dev(xserver_t)

dev_rwx_zero(xserver_t)

domain_mmap_low(xserver_t)

files_read_etc_files(xserver_t)

files_read_etc_runtime_files(xserver_t)

files_read_usr_files(xserver_t)

# brought on by rhgb

files_search_mnt(xserver_t)

# for nscd

files_dontaudit_search_pids(xserver_t)

fs_getattr_xattr_fs(xserver_t)

fs_search_nfs(xserver_t)

fs_search_auto_mountpoints(xserver_t)

fs_search_ramfs(xserver_t)

mls_xwin_read_to_clearance(xserver_t)

selinux_validate_context(xserver_t)

selinux_compute_access_vector(xserver_t)

selinux_compute_create_context(xserver_t)

auth_use_nsswitch(xserver_t)

init_getpgid(xserver_t)

term_setattr_unallocated_ttys(xserver_t)

term_use_unallocated_ttys(xserver_t)

getty_use_fds(xserver_t)

locallogin_use_fds(xserver_t)

logging_send_syslog_msg(xserver_t)

logging_send_audit_msgs(xserver_t)

miscfiles_read_localization(xserver_t)

miscfiles_read_fonts(xserver_t)

modutils_domtrans_insmod(xserver_t)

# read x_contexts

seutil_read_default_contexts(xserver_t)

userdom_search_user_home_dirs(xserver_t)

userdom_use_user_ttys(xserver_t)

userdom_setattr_user_ttys(xserver_t)

userdom_rw_user_tmpfs_files(xserver_t)

xserver_use_user_fonts(xserver_t)

ifndef(`distro_redhat',`

	allow xserver_t self:process { execmem execheap execstack };

')

ifdef(`distro_rhel4',`

	allow xserver_t self:process { execmem execheap execstack };

')

ifdef(`enable_mls',`

	range_transition xserver_t xserver_tmp_t:sock_file s0 - mls_systemhigh;

	range_transition xserver_t rootwindow_t:x_drawable s0 - mls_systemhigh;

')

tunable_policy(`!xserver_object_manager',`

	# should be xserver_unconfined(xserver_t),

	# but typeattribute doesnt work in conditionals

	allow xserver_t xserver_t:x_server *;

	allow xserver_t { x_domain rootwindow_t }:x_drawable *;

	allow xserver_t xserver_t:x_screen *;

	allow xserver_t x_domain:x_gc *;

	allow xserver_t { x_domain rootwindow_t }:x_colormap *;

	allow xserver_t xproperty_type:x_property *;

	allow xserver_t xselection_type:x_selection *;

	allow xserver_t x_domain:x_cursor *;

	allow xserver_t { x_domain remote_xclient_t }:x_client *;

	allow xserver_t { x_domain xserver_t }:x_device *;

	allow xserver_t xextension_type:x_extension *;

	allow xserver_t { x_domain xserver_t }:x_resource *;

	allow xserver_t xevent_type:{ x_event x_synthetic_event } *;

')

optional_policy(`

	apm_stream_connect(xserver_t)

')

optional_policy(`

	auth_search_pam_console_data(xserver_t)

')

optional_policy(`

	rhgb_getpgid(xserver_t)

	rhgb_signal(xserver_t)

')

optional_policy(`

	unconfined_domain_noaudit(xserver_t)

	unconfined_domtrans(xserver_t)

')

optional_policy(`

	userhelper_search_config(xserver_t)

')

optional_policy(`

	xfs_stream_connect(xserver_t)

')

########################################

#

# XDM Xserver local policy

#

# cjp: when xdm is configurable via tunable these

# rules will be enabled only when xdm is enabled

allow xserver_t xdm_t:process { signal getpgid };

allow xserver_t xdm_t:shm rw_shm_perms;

# NB we do NOT allow xserver_t xdm_var_lib_t:dir, only access to an open

# handle of a file inside the dir!!!

allow xserver_t xdm_var_lib_t:file { getattr read };

dontaudit xserver_t xdm_var_lib_t:dir search;

allow xserver_t xdm_var_run_t:file read_file_perms;

# Label pid and temporary files with derived types.

manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)

manage_lnk_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)

manage_sock_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)

# Run xkbcomp.

allow xserver_t xkb_var_lib_t:lnk_file read;

can_exec(xserver_t, xkb_var_lib_t)

# VNC v4 module in X server

corenet_tcp_bind_vnc_port(xserver_t)

init_use_fds(xserver_t)

# FIXME: After per user fonts are properly working

# xserver_t may no longer have any reason

# to read ROLE_home_t - examine this in more detail

# (xauth?)

userdom_read_user_home_content_files(xserver_t)

xserver_use_user_fonts(xserver_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_dirs(xserver_t)

	fs_manage_nfs_files(xserver_t)

	fs_manage_nfs_symlinks(xserver_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_dirs(xserver_t)

	fs_manage_cifs_files(xserver_t)

	fs_manage_cifs_symlinks(xserver_t)

')

optional_policy(`

	dbus_system_bus_client(xserver_t)

	hal_dbus_chat(xserver_t)

')

optional_policy(`

	resmgr_stream_connect(xdm_t)

')

optional_policy(`

	rhgb_rw_shm(xserver_t)

	rhgb_rw_tmpfs_files(xserver_t)

')

########################################

#

# Rules common to all X window domains

#

# Hacks

# everyone can get the input focus of everyone else

# this is a fundamental brokenness in the X protocol

allow x_domain { x_domain xserver_t }:x_device getfocus;

# everyone can grab the server

# everyone does it, it is basically a free DOS attack

allow x_domain xserver_t:x_server grab;

# everyone can get the font path, etc.

# this could leak out sensitive information

allow x_domain xserver_t:x_server getattr;

# everyone can do override-redirect windows.

# this could be used to spoof labels

allow x_domain self:x_drawable override;

# everyone can receive management events on the root window