policy_module(xserver, 3.4.2)

gen_require(`

	class x_drawable all_x_drawable_perms;

	class x_screen all_x_screen_perms;

	class x_gc all_x_gc_perms;

	class x_font all_x_font_perms;

	class x_colormap all_x_colormap_perms;

	class x_property all_x_property_perms;

	class x_selection all_x_selection_perms;

	class x_cursor all_x_cursor_perms;

	class x_client all_x_client_perms;

	class x_device all_x_device_perms;

	class x_pointer all_x_pointer_perms;

	class x_keyboard all_x_keyboard_perms;

	class x_server all_x_server_perms;

	class x_extension all_x_extension_perms;

	class x_resource all_x_resource_perms;

	class x_event all_x_event_perms;

	class x_synthetic_event all_x_synthetic_event_perms;

')

########################################

#

# Declarations

#

## <desc>

##	

##	Allows clients to write to the X server shared

##	memory segments.

##	

## </desc>

gen_tunable(allow_write_xshm, false)

## <desc>

##	

##	Allows XServer to execute writable memory

##	

## </desc>

gen_tunable(allow_xserver_execmem, false)

## <desc>

##	

##	Allow xdm logins as sysadm

##	

## </desc>

gen_tunable(xdm_sysadm_login, false)

## <desc>

##	

##	Support X userspace object manager

##	

## </desc>

gen_tunable(xserver_object_manager, false)

## <desc>

##	

##	Allow regular users direct dri device access

##	

## </desc>

gen_tunable(user_direct_dri, false)

attribute xdmhomewriter;

attribute x_userdomain;

attribute x_domain;

# X Events

attribute xevent_type;

attribute input_xevent_type;

type xevent_t, xevent_type;

typealias xevent_t alias { user_property_xevent_t staff_property_xevent_t sysadm_property_xevent_t };

typealias xevent_t alias { auditadm_property_xevent_t secadm_property_xevent_t };

typealias xevent_t alias { user_focus_xevent_t staff_focus_xevent_t sysadm_focus_xevent_t };

typealias xevent_t alias { auditadm_focus_xevent_t secadm_focus_xevent_t };

typealias xevent_t alias { user_manage_xevent_t staff_manage_xevent_t sysadm_manage_xevent_t };

typealias xevent_t alias { auditadm_manage_xevent_t secadm_manage_xevent_t };

typealias xevent_t alias { user_default_xevent_t staff_default_xevent_t sysadm_default_xevent_t };

typealias xevent_t alias { auditadm_default_xevent_t secadm_default_xevent_t };

type client_xevent_t, xevent_type;

typealias client_xevent_t alias { user_client_xevent_t staff_client_xevent_t sysadm_client_xevent_t };

typealias client_xevent_t alias { auditadm_client_xevent_t secadm_client_xevent_t };

type input_xevent_t, xevent_type, input_xevent_type;

# X Extensions

attribute xextension_type;

type xextension_t, xextension_type;

type security_xextension_t, xextension_type;

# X Properties

attribute xproperty_type;

type xproperty_t, xproperty_type;

type seclabel_xproperty_t, xproperty_type;

type clipboard_xproperty_t, xproperty_type;

# X Selections

attribute xselection_type;

type xselection_t, xselection_type;

type clipboard_xselection_t, xselection_type;

#type settings_xselection_t, xselection_type;

#type dbus_xselection_t, xselection_type;

# X Drawables

attribute xdrawable_type;

attribute xcolormap_type;

type root_xdrawable_t, xdrawable_type;

type root_xcolormap_t, xcolormap_type;

attribute xserver_unconfined_type;

xserver_object_types_template(root)

xserver_object_types_template(user)

typealias user_xproperty_t alias { staff_xproperty_t sysadm_xproperty_t };

typealias user_xproperty_t alias { auditadm_xproperty_t secadm_xproperty_t };

typealias user_input_xevent_t alias { staff_input_xevent_t sysadm_input_xevent_t };

typealias user_input_xevent_t alias { auditadm_input_xevent_t secadm_input_xevent_t };

type remote_t;

xserver_object_types_template(remote)

xserver_common_x_domain_template(remote, remote_t)

type user_fonts_t;

typealias user_fonts_t alias { staff_fonts_t sysadm_fonts_t };

typealias user_fonts_t alias { auditadm_fonts_t secadm_fonts_t };

typealias user_fonts_t alias { xguest_fonts_t unconfined_fonts_t user_fonts_home_t };

userdom_user_home_content(user_fonts_t)

type user_fonts_cache_t;

typealias user_fonts_cache_t alias { staff_fonts_cache_t sysadm_fonts_cache_t };

typealias user_fonts_cache_t alias { auditadm_fonts_cache_t secadm_fonts_cache_t };

typealias user_fonts_cache_t alias { xguest_fonts_cache_t unconfined_fonts_cache_t };

;

userdom_user_home_content(user_fonts_cache_t)

type user_fonts_config_t;

typealias user_fonts_config_t alias { staff_fonts_config_t sysadm_fonts_config_t };

typealias user_fonts_config_t alias { auditadm_fonts_config_t secadm_fonts_config_t };

typealias user_fonts_config_t alias { fonts_config_home_t xguest_fonts_config_t unconfined_fonts_config_t };

userdom_user_home_content(user_fonts_config_t)

type iceauth_t;

type iceauth_exec_t;

typealias iceauth_t alias { user_iceauth_t staff_iceauth_t sysadm_iceauth_t };

typealias iceauth_t alias { xguest_iceauth_t };

typealias iceauth_t alias { auditadm_iceauth_t secadm_iceauth_t };

application_domain(iceauth_t, iceauth_exec_t)

ubac_constrained(iceauth_t)

type iceauth_home_t;

typealias iceauth_home_t alias { user_iceauth_home_t staff_iceauth_home_t sysadm_iceauth_home_t };

typealias iceauth_home_t alias { auditadm_iceauth_home_t secadm_iceauth_home_t };

typealias iceauth_home_t alias { xguest_iceauth_home_t };

files_poly_member(iceauth_home_t)

userdom_user_home_content(iceauth_home_t)

type xauth_t;

type xauth_exec_t;

typealias xauth_t alias { user_xauth_t staff_xauth_t sysadm_xauth_t };

typealias xauth_t alias { auditadm_xauth_t secadm_xauth_t };

typealias xauth_t alias { xguest_xauth_t unconfined_xauth_t };

application_domain(xauth_t, xauth_exec_t)

ubac_constrained(xauth_t)

type xauth_home_t;

typealias xauth_home_t alias { user_xauth_home_t staff_xauth_home_t sysadm_xauth_home_t };

typealias xauth_home_t alias { auditadm_xauth_home_t secadm_xauth_home_t };

typealias xauth_home_t alias { xguest_xauth_home_t unconfined_xauth_home_t };

files_poly_member(xauth_home_t)

userdom_user_home_content(xauth_home_t)

type xauth_tmp_t;

typealias xauth_tmp_t alias { user_xauth_tmp_t staff_xauth_tmp_t sysadm_xauth_tmp_t };

typealias xauth_tmp_t alias { xguest_xauth_tmp_t unconfined_xauth_tmp_t };

typealias xauth_tmp_t alias { auditadm_xauth_tmp_t secadm_xauth_tmp_t };

files_tmp_file(xauth_tmp_t)

ubac_constrained(xauth_tmp_t)

# this is not actually a device, its a pipe

type xconsole_device_t;

files_type(xconsole_device_t)

fs_associate_tmpfs(xconsole_device_t)

files_associate_tmp(xconsole_device_t)

type xdm_t;

type xdm_exec_t;

auth_login_pgm_domain(xdm_t)

init_domain(xdm_t, xdm_exec_t)

init_system_domain(xdm_t, xdm_exec_t)

xserver_object_types_template(xdm)

xserver_common_x_domain_template(xdm, xdm_t)

type xdm_lock_t;

files_lock_file(xdm_lock_t)

type xdm_etc_t;

files_config_file(xdm_etc_t)

type xdm_rw_etc_t;

files_config_file(xdm_rw_etc_t)

type xdm_spool_t;

files_type(xdm_spool_t)

type xdm_var_lib_t;

files_type(xdm_var_lib_t)

type xdm_var_run_t;

files_pid_file(xdm_var_run_t)

type xserver_var_lib_t;

files_type(xserver_var_lib_t)

type xserver_var_run_t;

files_pid_file(xserver_var_run_t)

type xdm_tmp_t;

files_tmp_file(xdm_tmp_t)

typealias xdm_tmp_t alias { xserver_tmp_t user_xserver_tmp_t staff_xserver_tmp_t sysadm_xserver_tmp_t ice_tmp_t };

typealias xdm_tmp_t alias { auditadm_xserver_tmp_t secadm_xserver_tmp_t xdm_xserver_tmp_t };

ubac_constrained(xdm_tmp_t)

type xdm_tmpfs_t;

files_tmpfs_file(xdm_tmpfs_t)

type xdm_home_t;

userdom_user_home_content(xdm_home_t)

type xdm_log_t;

logging_log_file(xdm_log_t)

# type for /var/lib/xkb

type xkb_var_lib_t;

files_type(xkb_var_lib_t)

# Type for the executable used to start the X server, e.g. Xwrapper.

type xserver_t;

type xserver_exec_t;

typealias xserver_t alias { user_xserver_t staff_xserver_t sysadm_xserver_t };

typealias xserver_t alias { auditadm_xserver_t secadm_xserver_t xdm_xserver_t };

init_system_domain(xserver_t, xserver_exec_t)

ubac_constrained(xserver_t)

type xserver_tmpfs_t;

typealias xserver_tmpfs_t alias { user_xserver_tmpfs_t staff_xserver_tmpfs_t sysadm_xserver_tmpfs_t xguest_xserver_tmpfs_t unconfined_xserver_tmpfs_t xdm_xserver_tmpfs_t };

typealias xserver_tmpfs_t alias { auditadm_xserver_tmpfs_t secadm_xserver_tmpfs_t };

files_tmpfs_file(xserver_tmpfs_t)

ubac_constrained(xserver_tmpfs_t)

type xsession_exec_t;

corecmd_executable_file(xsession_exec_t)

# Type for the X server log file.

type xserver_log_t;

logging_log_file(xserver_log_t)

ifdef(`enable_mcs',`

	init_ranged_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)

	init_ranged_daemon_domain(xdm_t, xdm_exec_t, s0 - mcs_systemhigh)

')

optional_policy(`

	prelink_object_file(xkb_var_lib_t)

')

########################################

#

# Iceauth local policy

#

allow iceauth_t iceauth_home_t:file manage_file_perms;

userdom_user_home_dir_filetrans(iceauth_t, iceauth_home_t, file)

allow xdm_t iceauth_home_t:file read_file_perms;

dev_read_rand(iceauth_t)

fs_search_auto_mountpoints(iceauth_t)

userdom_use_user_terminals(iceauth_t)

userdom_read_user_tmp_files(iceauth_t)

userdom_read_all_users_state(iceauth_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_files(iceauth_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_files(iceauth_t)

')

ifdef(`hide_broken_symptoms',`

	dev_dontaudit_read_urand(iceauth_t)

	dev_dontaudit_rw_dri(iceauth_t)

	dev_dontaudit_rw_generic_dev_nodes(iceauth_t)

	fs_dontaudit_list_inotifyfs(iceauth_t)

	fs_dontaudit_rw_anon_inodefs_files(iceauth_t)

	term_dontaudit_use_unallocated_ttys(iceauth_t)

	userdom_dontaudit_read_user_home_content_files(iceauth_t)

	userdom_dontaudit_write_user_home_content_files(iceauth_t)

	userdom_dontaudit_write_user_tmp_files(iceauth_t)

	optional_policy(`

		mozilla_dontaudit_rw_user_home_files(iceauth_t)

	')

')

########################################

#

# Xauth local policy

#

allow xauth_t self:capability dac_override;

allow xauth_t self:process signal;

allow xauth_t self:unix_stream_socket create_stream_socket_perms;

allow xauth_t xdm_t:process sigchld;

allow xauth_t xserver_t:unix_stream_socket connectto;

corenet_tcp_connect_xserver_port(xauth_t)

allow xauth_t xauth_home_t:file manage_file_perms;

userdom_user_home_dir_filetrans(xauth_t, xauth_home_t, file)

userdom_admin_home_dir_filetrans(xauth_t, xauth_home_t, file)

manage_dirs_pattern(xauth_t, xdm_var_run_t, xdm_var_run_t)

manage_files_pattern(xauth_t, xdm_var_run_t, xdm_var_run_t)

manage_dirs_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)

manage_files_pattern(xauth_t, xauth_tmp_t, xauth_tmp_t)

files_tmp_filetrans(xauth_t, xauth_tmp_t, { file dir })

stream_connect_pattern(xauth_t, xserver_tmp_t, xserver_tmp_t, xserver_t)

kernel_read_system_state(xauth_t)

domain_use_interactive_fds(xauth_t)

domain_dontaudit_leaks(xauth_t)

files_read_etc_files(xauth_t)

files_read_usr_files(xauth_t)

files_search_pids(xauth_t)

files_dontaudit_getattr_all_dirs(xauth_t)

files_dontaudit_leaks(xauth_t)

files_var_lib_filetrans(xauth_t, xauth_home_t, file)

fs_dontaudit_leaks(xauth_t)

fs_getattr_all_fs(xauth_t)

fs_search_auto_mountpoints(xauth_t)

# Probably a leak

term_dontaudit_use_ptmx(xauth_t)

term_dontaudit_use_console(xauth_t)

auth_use_nsswitch(xauth_t)

userdom_use_user_terminals(xauth_t)

userdom_read_user_tmp_files(xauth_t)

userdom_read_all_users_state(xauth_t)

ifdef(`hide_broken_symptoms',`

	fs_dontaudit_rw_anon_inodefs_files(xauth_t)

	fs_dontaudit_list_inotifyfs(xauth_t)

	userdom_manage_user_home_content_files(xauth_t)

	userdom_manage_user_tmp_files(xauth_t)

	dev_dontaudit_rw_generic_dev_nodes(xauth_t)

	miscfiles_read_fonts(xauth_t)

')

xserver_rw_xdm_tmp_files(xauth_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_files(xauth_t)

	fs_read_nfs_symlinks(xauth_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_files(xauth_t)

')

ifdef(`hide_broken_symptoms',`

	term_dontaudit_use_unallocated_ttys(xauth_t)

	dev_dontaudit_rw_dri(xauth_t)

')

optional_policy(`

	nx_var_lib_filetrans(xauth_t, xauth_home_t, file)

')

optional_policy(`

	ssh_sigchld(xauth_t)

	ssh_read_pipes(xauth_t)

	ssh_dontaudit_rw_tcp_sockets(xauth_t)

')

########################################

#

# XDM Local policy

#

allow xdm_t self:capability { setgid setuid sys_resource kill sys_tty_config mknod chown dac_override dac_read_search fowner fsetid ipc_owner sys_nice sys_rawio net_bind_service sys_ptrace };

allow xdm_t self:process { setexec setpgid getsched setsched setrlimit signal_perms setkeycreate ptrace };

allow xdm_t self:process { getattr getcap setcap };

allow xdm_t self:fifo_file rw_fifo_file_perms;

allow xdm_t self:shm create_shm_perms;

allow xdm_t self:sem create_sem_perms;

allow xdm_t self:unix_stream_socket { connectto create_stream_socket_perms };

allow xdm_t self:unix_dgram_socket { create_socket_perms sendto };

allow xdm_t self:tcp_socket create_stream_socket_perms;

allow xdm_t self:udp_socket create_socket_perms;

allow xdm_t self:netlink_kobject_uevent_socket create_socket_perms;

allow xdm_t self:socket create_socket_perms;

allow xdm_t self:appletalk_socket create_socket_perms;

allow xdm_t self:key { search link write };

allow xdm_t xauth_home_t:file manage_file_perms;

allow xdm_t xconsole_device_t:fifo_file { getattr setattr };

manage_dirs_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)

manage_files_pattern(xdm_t, xkb_var_lib_t, xkb_var_lib_t)

manage_files_pattern(xdm_t, xdm_home_t, xdm_home_t)

userdom_user_home_dir_filetrans(xdm_t, xdm_home_t, file)

#Handle mislabeled files in homedir

userdom_delete_user_home_content_files(xdm_t)

userdom_signull_unpriv_users(xdm_t)

userdom_dontaudit_read_admin_home_lnk_files(xdm_t)

# Allow gdm to run gdm-binary

can_exec(xdm_t, xdm_exec_t)

allow xdm_t xdm_lock_t:file manage_file_perms;

files_lock_filetrans(xdm_t, xdm_lock_t, file)

read_lnk_files_pattern(xdm_t, xdm_etc_t, xdm_etc_t)

read_files_pattern(xdm_t, xdm_etc_t, xdm_etc_t)

# wdm has its own config dir /etc/X11/wdm

# this is ugly, daemons should not create files under /etc!

manage_files_pattern(xdm_t, xdm_rw_etc_t, xdm_rw_etc_t)

manage_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_lnk_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_sock_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

files_tmp_filetrans(xdm_t, xdm_tmp_t, { file dir sock_file lnk_file })

relabelfrom_dirs_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

relabelfrom_files_pattern(xdm_t, xdm_tmp_t, xdm_tmp_t)

manage_dirs_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_lnk_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_fifo_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

manage_sock_files_pattern(xdm_t, xdm_tmpfs_t, xdm_tmpfs_t)

fs_getattr_all_fs(xdm_t)

fs_list_inotifyfs(xdm_t)

fs_read_noxattr_fs_files(xdm_t)

fs_dontaudit_list_fusefs(xdm_t)

fs_manage_cgroup_dirs(xdm_t)

fs_manage_cgroup_files(xdm_t)

manage_files_pattern(xdm_t, user_fonts_t, user_fonts_t)

files_search_spool(xdm_t)

manage_dirs_pattern(xdm_t, xdm_spool_t, xdm_spool_t)

manage_files_pattern(xdm_t, xdm_spool_t, xdm_spool_t)

files_spool_filetrans(xdm_t, xdm_spool_t, { file dir })

manage_dirs_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)

manage_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)

manage_lnk_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)

manage_sock_files_pattern(xdm_t, xdm_var_lib_t, xdm_var_lib_t)

files_var_lib_filetrans(xdm_t, xdm_var_lib_t, { file dir })

# Read machine-id

files_read_var_lib_files(xdm_t)

manage_dirs_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

manage_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

manage_fifo_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

manage_sock_files_pattern(xdm_t, xdm_var_run_t, xdm_var_run_t)

files_pid_filetrans(xdm_t, xdm_var_run_t, { dir file fifo_file sock_file })

allow xdm_t xserver_t:process { signal signull };

allow xdm_t xserver_t:unix_stream_socket connectto;

allow xdm_t xserver_tmp_t:sock_file rw_sock_file_perms;

allow xdm_t xserver_tmp_t:dir { setattr list_dir_perms };

# transition to the xdm xserver

domtrans_pattern(xdm_t, xserver_exec_t, xserver_t)

ps_process_pattern(xserver_t, xdm_t)

allow xserver_t xdm_t:process signal;

allow xdm_t xserver_t:process { noatsecure siginh rlimitinh signal sigkill };

allow xdm_t xserver_t:shm rw_shm_perms;

read_files_pattern(xdm_t, xserver_t, xserver_t)

# connect to xdm xserver over stream socket

stream_connect_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t, xserver_t)

# Remove /tmp/.X11-unix/X0.

delete_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)

delete_sock_files_pattern(xdm_t, xserver_tmp_t, xserver_tmp_t)

manage_dirs_pattern(xdm_t, xdm_log_t, xdm_log_t)

manage_files_pattern(xdm_t, xdm_log_t, xdm_log_t)

manage_fifo_files_pattern(xdm_t, xdm_log_t, xdm_log_t)

logging_log_filetrans(xdm_t, xdm_log_t, { dir file })

manage_dirs_pattern(xdm_t, xserver_log_t, xserver_log_t)

manage_files_pattern(xdm_t, xserver_log_t, xserver_log_t)

manage_fifo_files_pattern(xdm_t, xserver_log_t, xserver_log_t)

kernel_read_system_state(xdm_t)

kernel_read_device_sysctls(xdm_t)

kernel_read_kernel_sysctls(xdm_t)

kernel_read_net_sysctls(xdm_t)

kernel_read_network_state(xdm_t)

kernel_request_load_module(xdm_t)

kernel_stream_connect(xdm_t)

corecmd_exec_shell(xdm_t)

corecmd_exec_bin(xdm_t)

corenet_all_recvfrom_unlabeled(xdm_t)

corenet_all_recvfrom_netlabel(xdm_t)

corenet_tcp_sendrecv_generic_if(xdm_t)

corenet_udp_sendrecv_generic_if(xdm_t)

corenet_tcp_sendrecv_generic_node(xdm_t)

corenet_udp_sendrecv_generic_node(xdm_t)

corenet_tcp_sendrecv_all_ports(xdm_t)

corenet_udp_sendrecv_all_ports(xdm_t)

corenet_tcp_bind_generic_node(xdm_t)

corenet_udp_bind_generic_node(xdm_t)

corenet_udp_bind_ipp_port(xdm_t)

corenet_udp_bind_xdmcp_port(xdm_t)

corenet_tcp_connect_all_ports(xdm_t)

corenet_sendrecv_all_client_packets(xdm_t)

# xdm tries to bind to biff_port_t

corenet_dontaudit_tcp_bind_all_ports(xdm_t)

dev_rwx_zero(xdm_t)

dev_read_rand(xdm_t)

dev_rw_sysfs(xdm_t)

dev_getattr_framebuffer_dev(xdm_t)

dev_setattr_framebuffer_dev(xdm_t)

dev_getattr_mouse_dev(xdm_t)

dev_setattr_mouse_dev(xdm_t)

dev_rw_apm_bios(xdm_t)

dev_rw_input_dev(xdm_t)

dev_setattr_apm_bios_dev(xdm_t)

dev_rw_dri(xdm_t)

dev_rw_agp(xdm_t)

dev_getattr_xserver_misc_dev(xdm_t)

dev_setattr_xserver_misc_dev(xdm_t)

dev_getattr_misc_dev(xdm_t)

dev_setattr_misc_dev(xdm_t)

dev_dontaudit_rw_misc(xdm_t)

dev_read_video_dev(xdm_t)

dev_write_video_dev(xdm_t)

dev_setattr_video_dev(xdm_t)

dev_getattr_scanner_dev(xdm_t)

dev_setattr_scanner_dev(xdm_t)

dev_read_sound(xdm_t)

dev_write_sound(xdm_t)

dev_getattr_power_mgmt_dev(xdm_t)

dev_setattr_power_mgmt_dev(xdm_t)

dev_getattr_null_dev(xdm_t)

dev_setattr_null_dev(xdm_t)

domain_use_interactive_fds(xdm_t)

# Do not audit denied probes of /proc.

domain_dontaudit_read_all_domains_state(xdm_t)

domain_dontaudit_ptrace_all_domains(xdm_t)

domain_dontaudit_signal_all_domains(xdm_t)

files_read_etc_files(xdm_t)

files_read_var_files(xdm_t)

files_read_etc_runtime_files(xdm_t)

files_exec_etc_files(xdm_t)

files_list_mnt(xdm_t)

# Read /usr/share/terminfo/l/linux and /usr/share/icons/default/index.theme...

files_read_usr_files(xdm_t)

# Poweroff wants to create the /poweroff file when run from xdm

files_create_boot_flag(xdm_t)

files_dontaudit_getattr_boot_dirs(xdm_t)

files_dontaudit_write_usr_files(xdm_t)

files_dontaudit_getattr_all_dirs(xdm_t)

files_dontaudit_getattr_all_symlinks(xdm_t)

fs_getattr_all_fs(xdm_t)

fs_search_auto_mountpoints(xdm_t)

fs_rw_anon_inodefs_files(xdm_t)

fs_mount_tmpfs(xdm_t)

mls_socket_write_to_clearance(xdm_t)

storage_dontaudit_read_fixed_disk(xdm_t)

storage_dontaudit_write_fixed_disk(xdm_t)

storage_dontaudit_setattr_fixed_disk_dev(xdm_t)

storage_dontaudit_raw_read_removable_device(xdm_t)

storage_dontaudit_raw_write_removable_device(xdm_t)

storage_dontaudit_setattr_removable_dev(xdm_t)

storage_dontaudit_rw_scsi_generic(xdm_t)

storage_dontaudit_rw_fuse(xdm_t)

term_setattr_console(xdm_t)

term_use_console(xdm_t)

term_use_unallocated_ttys(xdm_t)

term_setattr_unallocated_ttys(xdm_t)

term_relabel_all_ttys(xdm_t)

term_relabel_unallocated_ttys(xdm_t)

auth_domtrans_pam_console(xdm_t)

auth_manage_pam_pid(xdm_t)

auth_manage_pam_console_data(xdm_t)

auth_signal_pam(xdm_t)

auth_rw_faillog(xdm_t)

auth_write_login_records(xdm_t)

# Run telinit->init to shutdown.

init_telinit(xdm_t)

init_dbus_chat(xdm_t)

libs_exec_lib_files(xdm_t)

logging_read_generic_logs(xdm_t)

miscfiles_search_man_pages(xdm_t)

miscfiles_read_localization(xdm_t)

miscfiles_read_fonts(xdm_t)

miscfiles_manage_fonts_cache(xdm_t)

miscfiles_manage_localization(xdm_t)

miscfiles_read_hwdata(xdm_t)

userdom_dontaudit_use_unpriv_user_fds(xdm_t)

userdom_create_all_users_keys(xdm_t)

# for .dmrc

userdom_read_user_home_content_files(xdm_t)

# Search /proc for any user domain processes.

userdom_read_all_users_state(xdm_t)

userdom_signal_all_users(xdm_t)

userdom_stream_connect(xdm_t)

userdom_manage_user_tmp_dirs(xdm_t)

userdom_manage_user_tmp_files(xdm_t)

userdom_manage_user_tmp_sockets(xdm_t)

userdom_manage_tmpfs_role(system_r, xdm_t)

application_signal(xdm_t)

xserver_rw_session(xdm_t, xdm_tmpfs_t)

xserver_unconfined(xdm_t)

tunable_policy(`use_nfs_home_dirs',`

	fs_manage_nfs_dirs(xdm_t)

	fs_manage_nfs_files(xdm_t)

	fs_manage_nfs_symlinks(xdm_t)

	fs_exec_nfs_files(xdm_t)

')

tunable_policy(`use_samba_home_dirs',`

	fs_manage_cifs_dirs(xdm_t)

	fs_manage_cifs_files(xdm_t)

	fs_manage_cifs_symlinks(xdm_t)

	fs_exec_cifs_files(xdm_t)

')

tunable_policy(`xdm_sysadm_login',`

	userdom_xsession_spec_domtrans_all_users(xdm_t)

	# FIXME:

#	xserver_rw_session_template(xdm,userdomain)

',`

	userdom_xsession_spec_domtrans_unpriv_users(xdm_t)

	# FIXME:

#	xserver_rw_session_template(xdm,unpriv_userdomain)

#	dontaudit xserver_t sysadm_t:shm { unix_read unix_write };

#	allow xserver_t xdm_tmpfs_t:file rw_file_perms;

')

optional_policy(`

	accountsd_read_lib_files(xdm_t)

')

optional_policy(`

	alsa_domtrans(xdm_t)

	alsa_read_rw_config(xdm_t)

')

optional_policy(`

	consolekit_dbus_chat(xdm_t)

	consolekit_read_log(xdm_t)

')

optional_policy(`

	consoletype_exec(xdm_t)

')

optional_policy(`

	# Use dbus to start other processes as xdm_t

	dbus_role_template(xdm, system_r, xdm_t)

	dontaudit xdm_dbusd_t xdm_var_lib_t:dir search_dir_perms;

	xserver_xdm_append_log(xdm_dbusd_t)

	xserver_read_xdm_pid(xdm_dbusd_t)

	corecmd_bin_entry_type(xdm_t)

	dbus_system_bus_client(xdm_t)

	optional_policy(`

		bluetooth_dbus_chat(xdm_t)

	')

	optional_policy(`

		devicekit_dbus_chat_disk(xdm_t)

		devicekit_dbus_chat_power(xdm_t)

	')

	optional_policy(`

		hal_dbus_chat(xdm_t)

	')

	optional_policy(`

		networkmanager_dbus_chat(xdm_t)

	')

')

optional_policy(`

	# Talk to the console mouse server.

	gpm_stream_connect(xdm_t)

	gpm_setattr_gpmctl(xdm_t)

')

optional_policy(`

	gnome_manage_config(xdm_t)

	gnome_manage_gconf_home_files(xdm_t)

	gnome_read_config(xdm_t)

	gnome_read_gconf_config(xdm_t)

')

optional_policy(`

	hostname_exec(xdm_t)

')

optional_policy(`

	loadkeys_exec(xdm_t)

')

optional_policy(`

	locallogin_signull(xdm_t)

')

optional_policy(`

	# Do not audit attempts to check whether user root has email

	mta_dontaudit_getattr_spool_files(xdm_t)

')

optional_policy(`

	policykit_dbus_chat(xdm_t)

	policykit_domtrans_auth(xdm_t)

	policykit_read_lib(xdm_t)

	policykit_read_reload(xdm_t)

	policykit_signal_auth(xdm_t)

')

optional_policy(`

	pcscd_stream_connect(xdm_t)

')

optional_policy(`

	plymouthd_search_spool(xdm_t)

	plymouthd_exec_plymouth(xdm_t)

	plymouthd_stream_connect(xdm_t)

')

optional_policy(`

	pulseaudio_exec(xdm_t)

	pulseaudio_dbus_chat(xdm_t)

	pulseaudio_stream_connect(xdm_t)

')

optional_policy(`

	resmgr_stream_connect(xdm_t)

')

# On crash gdm execs gdb to dump stack

optional_policy(`

	rpm_exec(xdm_t)

	rpm_read_db(xdm_t)

	rpm_dontaudit_manage_db(xdm_t)

')

optional_policy(`

	rtkit_scheduled(xdm_t)

')

optional_policy(`

	seutil_sigchld_newrole(xdm_t)

')

optional_policy(`

	ssh_signull(xdm_t)

')

optional_policy(`

	shutdown_domtrans(xdm_t)

')

optional_policy(`

	udev_read_db(xdm_t)

')

optional_policy(`

	unconfined_shell_domtrans(xdm_t)

	unconfined_signal(xdm_t)

')

ifndef(`distro_redhat',`

	allow xdm_t self:process { execheap execmem };

')

ifdef(`distro_rhel4',`

	allow xdm_t self:process { execheap execmem };

')

optional_policy(`

	userhelper_dontaudit_search_config(xdm_t)

')

optional_policy(`

	usermanage_read_crack_db(xdm_t)

')

optional_policy(`

	wm_exec(xdm_t)

')

optional_policy(`

	xfs_stream_connect(xdm_t)

')

########################################

#

# X server local policy

#

# X Object Manager rules

type_transition xserver_t xserver_t:x_drawable root_xdrawable_t;

type_transition xserver_t xserver_t:x_colormap root_xcolormap_t;

type_transition root_xdrawable_t input_xevent_t:x_event root_input_xevent_t;

allow xserver_t { root_xdrawable_t x_domain }:x_drawable send;

allow xserver_t input_xevent_t:x_event send;

# setuid/setgid for the wrapper program to change UID

# sys_rawio is for iopl access - should not be needed for frame-buffer

# sys_admin, locking shared mem?  chowning IPC message queues or semaphores?

# admin of APM bios?

# sys_nice is so that the X server can set a negative nice value

# execheap needed until the X module loader is fixed.

# NVIDIA Needs execstack

allow xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_ptrace sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };

dontaudit xserver_t self:capability chown;

allow xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };

allow xserver_t self:fd use;

allow xserver_t self:fifo_file rw_fifo_file_perms;

allow xserver_t self:sock_file read_sock_file_perms;

allow xserver_t self:shm create_shm_perms;

allow xserver_t self:sem create_sem_perms;

allow xserver_t self:msgq create_msgq_perms;

allow xserver_t self:msg { send receive };

allow xserver_t self:unix_dgram_socket { create_socket_perms sendto };