From e5e55ace89604239054b20c7d7b33969f1a195b9 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Jun 28 2007 12:34:08 +0000 Subject: trunk, strict-targeted-merge: add mmap_zero to xserver domains. --- diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index 47faddf..0a32465 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -48,6 +48,7 @@ template(`xserver_common_domain_template',` allow $1_xserver_t self:capability { dac_override fowner fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service }; dontaudit $1_xserver_t self:capability chown; allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap }; + allow $1_xserver_t self:memprotect mmap_zero; allow $1_xserver_t self:fd use; allow $1_xserver_t self:fifo_file rw_fifo_file_perms; allow $1_xserver_t self:sock_file read_sock_file_perms; @@ -126,6 +127,8 @@ template(`xserver_common_domain_template',` dev_rw_input_dev($1_xserver_t) dev_rwx_zero($1_xserver_t) + domain_mmap_low($1_xserver_t) + files_read_etc_files($1_xserver_t) files_read_etc_runtime_files($1_xserver_t) files_read_usr_files($1_xserver_t) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index bd0eea8..d3bef11 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,1.4.2) +policy_module(xserver,1.4.3) ######################################## #