diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if index 95448d9..bb86a62 100644 --- a/policy/modules/apps/pulseaudio.if +++ b/policy/modules/apps/pulseaudio.if @@ -104,6 +104,43 @@ interface(`pulseaudio_exec',` can_exec($1, pulseaudio_exec_t) ') +######################################## +## +## Do not audit to execute a pulseaudio. +## +## +## +## Domain to not audit. +## +## +# +interface(`pulseaudio_dontaudit_exec',` + gen_require(` + type pulseaudio_exec_t; + ') + + dontaudit $1 pulseaudio_exec_t:file exec_file_perms; +') + +######################################## +## +## Send signull signal to pulseaudio +## processes. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_signull',` + gen_require(` + type pulseaudio_t; + ') + + allow $1 pulseaudio_t:process signull; +') + ##################################### ## ## Connect to pulseaudio over a unix domain @@ -186,6 +223,25 @@ interface(`pulseaudio_read_home_files',` ######################################## ## +## Read and write Pulse Audio files. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_rw_home_files',` + gen_require(` + type pulseaudio_home_t; + ') + + rw_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) + userdom_search_user_home_dirs($1) +') + +######################################## +## ## Create, read, write, and delete pulseaudio ## home directory files. ## @@ -202,4 +258,5 @@ interface(`pulseaudio_manage_home_files',` userdom_search_user_home_dirs($1) manage_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) + read_lnk_files_pattern($1, pulseaudio_home_t, pulseaudio_home_t) ') diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te index 964a73b..7e3e3b2 100644 --- a/policy/modules/apps/pulseaudio.te +++ b/policy/modules/apps/pulseaudio.te @@ -1,4 +1,4 @@ -policy_module(pulseaudio, 1.2.0) +policy_module(pulseaudio, 1.2.1) ######################################## # @@ -43,6 +43,7 @@ userdom_search_user_home_dirs(pulseaudio_t) manage_dirs_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) manage_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) +manage_lnk_files_pattern(pulseaudio_t, pulseaudio_var_lib_t, pulseaudio_var_lib_t) files_var_lib_filetrans(pulseaudio_t, pulseaudio_var_lib_t, { dir file }) manage_dirs_pattern(pulseaudio_t, pulseaudio_var_run_t, pulseaudio_var_run_t) @@ -127,6 +128,7 @@ optional_policy(` ') optional_policy(` + udev_read_state(pulseaudio_t) udev_read_db(pulseaudio_t) ')