#

# Macros for X server domains.

#

#

# Authors:  Stephen Smalley <sds@epoch.ncsc.mil> and Timothy Fraser

#

#################################

#

# xserver_domain(domain_prefix)

#

# Define a derived domain for the X server when executed

# by a user domain (e.g. via startx).  See the xdm_t domain

# in domains/program/xdm.te if using an X Display Manager.

#

# The type declarations for the executable type for this program 

# and the log type are provided separately in domains/program/xserver.te. 

#

# FIXME!  The X server requires far too many privileges.

#

undefine(`xserver_domain')

ifdef(`xserver.te', `

define(`xserver_domain',`

# Derived domain based on the calling user domain and the program.

ifdef(`distro_redhat', `

type $1_xserver_t, domain, privlog, privmem, privmodule, nscd_client_domain;

allow $1_xserver_t sysctl_modprobe_t:file { getattr read };

ifdef(`rpm.te', `

allow $1_xserver_t rpm_t:shm { unix_read unix_write read write associate getattr };

allow $1_xserver_t rpm_tmpfs_t:file { read write };

allow $1_xserver_t rpm_t:fd use;

')

', `

type $1_xserver_t, domain, privlog, privmem, nscd_client_domain;

')

# for SSP

allow $1_xserver_t urandom_device_t:chr_file { getattr read ioctl };

# Transition from the user domain to this domain.

ifelse($1, xdm, `

ifdef(`xdm.te', `

domain_auto_trans(xdm_t, xserver_exec_t, xdm_xserver_t)

')

', `

domain_auto_trans($1_t, xserver_exec_t, $1_xserver_t)

')dnl end ifelse xdm

can_exec($1_xserver_t, xserver_exec_t)

uses_shlib($1_xserver_t)

if (allow_execmod) {

allow $1_xserver_t texrel_shlib_t:file execmod;

}

can_network($1_xserver_t)

can_ypbind($1_xserver_t)

allow $1_xserver_t xserver_port_t:tcp_socket name_bind;

# for access within the domain

general_domain_access($1_xserver_t)

if (allow_execmem) {

allow $1_xserver_t self:process execmem;

}

allow $1_xserver_t etc_runtime_t:file { getattr read };

ifelse($1, xdm, `

# The system role is authorised for the xdm and initrc domains

role system_r types xdm_xserver_t;

allow xdm_xserver_t init_t:fd use;

dontaudit xdm_xserver_t home_dir_type:dir { read search };

', `

# The user role is authorized for this domain.

role $1_r types $1_xserver_t;

allow $1_xserver_t getty_t:fd use;

allow $1_xserver_t local_login_t:fd use;

allow $1_xserver_t $1_tty_device_t:chr_file { setattr rw_file_perms };

allow $1_xserver_t $1_tmpfs_t:file rw_file_perms;

allow $1_t $1_xserver_tmpfs_t:file rw_file_perms;

can_unix_connect($1_t, $1_xserver_t)

# Access the home directory.

allow $1_xserver_t home_root_t:dir search;

allow $1_xserver_t $1_home_dir_t:dir { getattr search };

if (allow_xserver_home_fonts) {

r_dir_file($1_xserver_t, $1_home_t)

}

ifdef(`xauth.te', `

domain_auto_trans($1_xserver_t, xauth_exec_t, $1_xauth_t)

allow $1_xserver_t $1_xauth_home_t:file { getattr read };

', `

allow $1_xserver_t $1_home_t:file { getattr read };

')dnl end ifdef xauth

ifdef(`userhelper.te', `

allow $1_xserver_t userhelper_conf_t:dir search;

')dnl end ifdef userhelper

')dnl end ifelse xdm

allow $1_xserver_t self:process setsched;

allow $1_xserver_t fs_t:filesystem getattr;

# Xorg wants to check if kernel is tainted

read_sysctl($1_xserver_t)

# Use capabilities.

# allow setuid/setgid for the wrapper program to change UID

# sys_rawio is for iopl access - should not be needed for frame-buffer

# sys_admin, locking shared mem?  chowning IPC message queues or semaphores?

# admin of APM bios?

# sys_nice is so that the X server can set a negative nice value

allow $1_xserver_t self:capability { dac_override fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };

allow $1_xserver_t nfs_t:dir { getattr search };

# memory_device_t access is needed if not using the frame buffer

#dontaudit $1_xserver_t memory_device_t:chr_file read;

allow $1_xserver_t memory_device_t:chr_file { rw_file_perms execute };

# net_bind_service is needed if you want your X server to allow TCP connections

# from other hosts, EG an XDM serving a network of X terms

# if you want good security you do not want this

# not sure why some people want chown, fsetid, and sys_tty_config.

#allow $1_xserver_t self:capability { net_bind_service chown fsetid sys_tty_config };

dontaudit $1_xserver_t self:capability chown;

# for nscd

dontaudit $1_xserver_t var_run_t:dir search;

allow $1_xserver_t mtrr_device_t:file rw_file_perms;

allow $1_xserver_t apm_bios_t:chr_file rw_file_perms;

allow $1_xserver_t framebuf_device_t:chr_file rw_file_perms;

allow $1_xserver_t device_t:lnk_file { getattr read };

allow $1_xserver_t devtty_t:chr_file rw_file_perms;

allow $1_xserver_t zero_device_t:chr_file { read write execute };

# Type for temporary files.

tmp_domain($1_xserver, `', `{ dir file sock_file }')

file_type_auto_trans($1_xserver_t, xdm_xserver_tmp_t, $1_xserver_tmp_t, sock_file)

ifelse($1, xdm, `

ifdef(`xdm.te', `

allow xdm_t xdm_xserver_tmp_t:dir r_dir_perms;

allow xdm_t xdm_xserver_t:unix_stream_socket connectto;

allow xdm_t $1_xserver_t:process signal;

can_unix_connect(xdm_t, xdm_xserver_t)

allow xdm_t xdm_xserver_tmp_t:sock_file rw_file_perms;

allow xdm_t xdm_xserver_tmp_t:dir r_dir_perms;

allow xdm_xserver_t xdm_t:process signal;

allow xdm_xserver_t xdm_t:shm rw_shm_perms;

allow xdm_t xdm_xserver_t:shm rw_shm_perms;

dontaudit xdm_xserver_t sysadm_t:shm { unix_read unix_write };

')

', `

allow $1_t xdm_xserver_tmp_t:dir r_dir_perms;

allow $1_t xdm_xserver_t:unix_stream_socket connectto;

allow $1_t $1_xserver_t:process signal;

# Allow the user domain to connect to the X server.

can_unix_connect($1_t, $1_xserver_t)

allow $1_t $1_xserver_tmp_t:sock_file rw_file_perms;

allow $1_t $1_xserver_tmp_t:dir r_dir_perms;

ifdef(`xdm.te', `

allow $1_t xdm_tmp_t:sock_file unlink;

allow $1_xserver_t xdm_var_run_t:dir search;

# for /tmp/.ICE-unix

file_type_auto_trans($1_t, xdm_xserver_tmp_t, $1_tmp_t, sock_file)

')

# Signal the user domain.

allow $1_xserver_t $1_t:process signal;

# Communicate via System V shared memory.

allow $1_xserver_t $1_t:shm rw_shm_perms;

allow $1_t $1_xserver_t:shm rw_shm_perms;

allow $1_xserver_t initrc_t:shm rw_shm_perms;

')dnl end ifelse xdm

# Create files in /var/log with the xserver_log_t type.

allow $1_xserver_t var_t:dir search;

file_type_auto_trans($1_xserver_t, var_log_t, xserver_log_t, file)

allow $1_xserver_t xserver_log_t:dir r_dir_perms;

# Access AGP device.

allow $1_xserver_t agp_device_t:chr_file rw_file_perms;

# for other device nodes such as the NVidia binary-only driver

allow $1_xserver_t xserver_misc_device_t:chr_file rw_file_perms;

# Access /proc/mtrr

allow $1_xserver_t proc_t:file rw_file_perms;

allow $1_xserver_t proc_t:lnk_file { getattr read };

# Access /proc/sys/dev

allow $1_xserver_t sysctl_dev_t:dir search;

allow $1_xserver_t sysctl_dev_t:file { getattr read };

# Access /proc/bus/pci

allow $1_xserver_t proc_t:dir r_dir_perms;

# Create and access /dev/dri devices.

allow $1_xserver_t device_t:dir { create setattr };

file_type_auto_trans($1_xserver_t, device_t, dri_device_t, chr_file)

# brought on by rhgb

allow $1_xserver_t mnt_t:dir search;

allow $1_xserver_t tty_device_t:chr_file { setattr rw_file_perms };

# Run helper programs in $1_xserver_t.

allow $1_xserver_t { bin_t sbin_t }:dir search;

allow $1_xserver_t etc_t:{ file lnk_file } { getattr read };

allow $1_xserver_t bin_t:lnk_file read;

can_exec($1_xserver_t, { bin_t shell_exec_t })

# Connect to xfs.

ifdef(`xfs.te', `

can_unix_connect($1_xserver_t, xfs_t)

allow $1_xserver_t xfs_tmp_t:dir r_dir_perms;

allow $1_xserver_t xfs_tmp_t:sock_file rw_file_perms;

# Bind to the X server socket in /tmp.

allow $1_xserver_t $1_xserver_tmp_t:unix_stream_socket name_bind;

')

read_locale($1_xserver_t)

# Type for tmpfs/shm files.

tmpfs_domain($1_xserver)

ifelse($1, xdm, `

ifdef(`xdm.te', `

allow xdm_xserver_t xdm_t:shm rw_shm_perms;

allow xdm_xserver_t xdm_tmpfs_t:file rw_file_perms;

')

', `

allow $1_xserver_t $1_t:shm rw_shm_perms;

rw_dir_file($1_xserver_t, $1_tmpfs_t)

')dnl end ifelse xdm

r_dir_file($1_xserver_t,sysfs_t)

# Use the mouse.

allow $1_xserver_t mouse_device_t:chr_file rw_file_perms;

# Allow xserver to read events - the synaptics touchpad

# driver reads raw events

allow $1_xserver_t event_device_t:chr_file rw_file_perms;

ifdef(`pamconsole.te', `

allow $1_xserver_t pam_var_console_t:dir search;

')

dontaudit $1_xserver_t selinux_config_t:dir search;

allow $1_xserver_t var_lib_t:dir search;

rw_dir_create_file($1_xserver_t, var_lib_xkb_t)

# for fonts

r_dir_file($1_xserver_t, fonts_t)

')dnl end macro definition

', `

define(`xserver_domain',`')

')