#

# Macros for X client programs 

#

#

# Author: Russell Coker <russell@coker.com.au>

# Based on the work of Stephen Smalley <sds@epoch.ncsc.mil>

# and Timothy Fraser 

#

# Allows clients to write to the X server's shm 

bool allow_write_xshm false;

define(`xsession_domain', `

# Connect to xserver

can_unix_connect($1_t, $2_xserver_t)

# Read /tmp/.X0-lock

allow $1_t $2_xserver_tmp_t:file { getattr read };

# Signal Xserver

allow $1_t $2_xserver_t:process signal;

# Xserver read/write client shm

allow $2_xserver_t $1_t:fd use;

allow $2_xserver_t $1_t:shm rw_shm_perms;

allow $2_xserver_t $1_tmpfs_t:file rw_file_perms;

# Client read xserver shm

allow $1_t $2_xserver_t:fd use;

allow $1_t $2_xserver_t:shm r_shm_perms;

allow $1_t $2_xserver_tmpfs_t:file r_file_perms;

# Client write xserver shm

if (allow_write_xshm) {

allow $1_t $2_xserver_t:shm rw_shm_perms;

allow $1_t $2_xserver_tmpfs_t:file rw_file_perms;

}

')

#

# x_client_domain(client, role)

#

# Defines common X access rules for the client domain

#

define(`x_client_domain',`

# Create socket to communicate with X server

allow $1_t self:unix_dgram_socket create_socket_perms;

allow $1_t self:unix_stream_socket { connectto create_stream_socket_perms };

# Read .Xauthority file

ifdef(`xauth.te',`

allow $1_t home_root_t:dir { search getattr };

allow $1_t $2_home_dir_t:dir { search getattr };

allow $1_t $2_xauth_home_t:file { getattr read };

')

# for .xsession-errors

dontaudit $1_t $2_home_t:file write;

# for X over a ssh tunnel

ifdef(`ssh.te', `

can_tcp_connect($1_t, sshd_t)

')

# Use a separate type for tmpfs/shm pseudo files.

tmpfs_domain($1)

allow $1_t self:shm create_shm_perms;

# allow X client to read all font files

read_fonts($1_t, $2)

# Allow connections to X server.

ifdef(`xserver.te', `

allow $1_t tmp_t:dir search;

ifdef(`xdm.te', `

xsession_domain($1, xdm)

# for when /tmp/.X11-unix is created by the system

can_pipe_xdm($1_t)

allow $1_t xdm_tmp_t:dir search;

allow $1_t xdm_tmp_t:sock_file { read write };

dontaudit $1_t xdm_t:tcp_socket { read write };

')

ifdef(`startx.te', `

xsession_domain($1, $2)

')dnl end startx

')dnl end xserver

')dnl end x_client macro