Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Macros for mplayer
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# Author: Ivan Gyurdiev <ivg2@cornell.edu>
Chris PeBenito 0fbfa5
#
Chris PeBenito 0fbfa5
# mplayer_domains(user) declares domains for mplayer, gmplayer,
Chris PeBenito 0fbfa5
# and mencoder
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
##############################################
Chris PeBenito 0fbfa5
#    mplayer_common(user, mplayer domain)    #
Chris PeBenito 0fbfa5
##############################################
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
define(`mplayer_common',`
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Read global config
Chris PeBenito 0fbfa5
r_dir_file($1_$2_t, mplayer_etc_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Read data in /usr/share (fonts, icons..)
Chris PeBenito 0fbfa5
r_dir_file($1_$2_t, usr_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Read /proc files and directories
Chris PeBenito 0fbfa5
# Necessary for /proc/meminfo, /proc/cpuinfo, etc..
Chris PeBenito 0fbfa5
allow $1_$2_t proc_t:dir search;
Chris PeBenito 0fbfa5
allow $1_$2_t proc_t:file { getattr read };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Sysctl on kernel version 
Chris PeBenito 0fbfa5
read_sysctl($1_$2_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Allow ps, shared libs, locale, terminal access
Chris PeBenito 0fbfa5
can_ps($1_t, $1_$2_t)
Chris PeBenito 0fbfa5
uses_shlib($1_$2_t)
Chris PeBenito 0fbfa5
read_locale($1_$2_t)
Chris PeBenito 0fbfa5
access_terminal($1_$2_t, $1)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Required for win32 binary loader 
Chris PeBenito 0fbfa5
allow $1_$2_t zero_device_t:chr_file { read write execute };
Chris PeBenito 0fbfa5
if (allow_execmem) {
Chris PeBenito 0fbfa5
allow $1_$2_t self:process execmem;
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
if (allow_execmod) {
Chris PeBenito 0fbfa5
allow $1_$2_t zero_device_t:chr_file execmod;
Chris PeBenito 0fbfa5
allow $1_$2_t texrel_shlib_t:file execmod;
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Access to DVD/CD/V4L
Chris PeBenito 0fbfa5
allow $1_$2_t device_t:dir r_dir_perms;
Chris PeBenito 0fbfa5
allow $1_$2_t device_t:lnk_file { getattr read };
Chris PeBenito 0fbfa5
allow $1_$2_t removable_device_t:blk_file { getattr read };
Chris PeBenito 0fbfa5
allow $1_$2_t v4l_device_t:chr_file { getattr read };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Legacy domain issues
Chris PeBenito 0fbfa5
if (allow_mplayer_execstack) {
Chris PeBenito 0fbfa5
legacy_domain($1_$2)
Chris PeBenito 0fbfa5
allow $1_$2_t lib_t:file execute;
Chris PeBenito 0fbfa5
allow $1_$2_t locale_t:file execute;
Chris PeBenito 0fbfa5
allow $1_$2_t sound_device_t:chr_file execute;
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
############################
Chris PeBenito 0fbfa5
#  mplayer_domain(user)    #
Chris PeBenito 0fbfa5
############################
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
define(`mplayer_domain',`
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Derive from X client domain
Chris PeBenito 0fbfa5
x_client_domain($1, `mplayer', `')
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Mplayer configuration here
Chris PeBenito 0fbfa5
home_domain($1, mplayer)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Allow mplayer to browse files
Chris PeBenito 0fbfa5
file_browse_domain($1_mplayer_t)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Mplayer common stuff
Chris PeBenito 0fbfa5
mplayer_common($1, mplayer)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Audio
Chris PeBenito 0fbfa5
allow $1_mplayer_t sound_device_t:chr_file rw_file_perms;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# RTC clock 
Chris PeBenito 0fbfa5
allow $1_mplayer_t clock_device_t:chr_file { ioctl read };
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Read home directory content
Chris PeBenito 0fbfa5
r_dir_file($1_mplayer_t, $1_home_t);
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Legacy domain issues
Chris PeBenito 0fbfa5
if (allow_mplayer_execstack) {
Chris PeBenito 0fbfa5
allow $1_mplayer_t $1_mplayer_tmpfs_t:file execute;
Chris PeBenito 0fbfa5
}
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
') dnl end mplayer_domain
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
############################
Chris PeBenito 0fbfa5
#  mencoder_domain(user)   #
Chris PeBenito 0fbfa5
############################
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
define(`mencoder_domain',`
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# FIXME: privhome temporarily removed...
Chris PeBenito 0fbfa5
type $1_mencoder_t, domain;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Transition
Chris PeBenito 0fbfa5
domain_auto_trans($1_t, mencoder_exec_t, $1_mencoder_t)
Chris PeBenito 0fbfa5
can_exec($1_mencoder_t, mencoder_exec_t)
Chris PeBenito 0fbfa5
role $1_r types $1_mencoder_t;
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Read home config
Chris PeBenito 0fbfa5
home_domain_access($1_mencoder_t, $1, mplayer)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
# Mplayer common stuff
Chris PeBenito 0fbfa5
mplayer_common($1, mencoder)
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
') dnl end mencoder_domain
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
#############################
Chris PeBenito 0fbfa5
#  mplayer_domains(user)    #
Chris PeBenito 0fbfa5
#############################
Chris PeBenito 0fbfa5
Chris PeBenito 0fbfa5
define(`mplayer_domains', `
Chris PeBenito 0fbfa5
mplayer_domain($1)
Chris PeBenito 0fbfa5
mencoder_domain($1)
Chris PeBenito 0fbfa5
') dnl end mplayer_domains
Chris PeBenito 0fbfa5