diff --git a/Changelog b/Changelog index 9587cd9..432b777 100644 --- a/Changelog +++ b/Changelog @@ -1,3 +1,4 @@ +- Add core Security Enhanced X Windows support. - Fix winbind socket connection interface for default location of the sock_file. - Add wireshark module based on ethereal module. diff --git a/Makefile b/Makefile index ab508f3..a08c983 100644 --- a/Makefile +++ b/Makefile @@ -236,7 +236,7 @@ seusers := $(appconf)/seusers appdir := $(contextpath) user_default_contexts := $(wildcard config/appconfig-$(TYPE)/*_default_contexts) user_default_contexts_names := $(addprefix $(contextpath)/users/,$(subst _default_contexts,,$(notdir $(user_default_contexts)))) -appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names) +appfiles := $(addprefix $(appdir)/,default_contexts default_type initrc_context failsafe_context userhelper_context removable_context dbus_contexts x_contexts customizable_types securetty_types) $(contextpath)/files/media $(user_default_contexts_names) net_contexts := $(builddir)net_contexts all_layers := $(shell find $(wildcard $(moddir)/*) -maxdepth 0 -type d) diff --git a/config/appconfig-mcs/x_contexts b/config/appconfig-mcs/x_contexts new file mode 100644 index 0000000..08da649 --- /dev/null +++ b/config/appconfig-mcs/x_contexts @@ -0,0 +1,194 @@ +# +# Config file for XSELinux extension +# + + +# +## +### Rules for X Clients +## +# + +# +# The default client rule defines a context to be used for all clients +# connecting to the server from a remote host. +# +client * system_u:object_r:remote_xclient_t:s0 + + +# +## +### Rules for X Properties +## +# + +# +# Property rules map a property name to a context. A default property +# rule indicated by an asterisk should follow all other property rules. +# +# Properties that normal clients may only read +property XFree86_VT system_u:object_r:info_xproperty_t:s0 +property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0 +property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0 +property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0 +property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0 +property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0 +property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0 +property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0 +property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0 + +# Clipboard and selection properties +property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0 + +# Default fallback type +property * system_u:object_r:xproperty_t:s0 + + +# +## +### Rules for X Extensions +## +# + +# +# Extension rules map an extension name to a context. A default extension +# rule indicated by an asterisk should follow all other extension rules. +# +# Standard extensions +extension BIG-REQUESTS system_u:object_r:std_xext_t:s0 +extension SHAPE system_u:object_r:std_xext_t:s0 +extension SYNC system_u:object_r:std_xext_t:s0 +extension XC-MISC system_u:object_r:std_xext_t:s0 +extension XFIXES system_u:object_r:std_xext_t:s0 +extension XInputExtension system_u:object_r:std_xext_t:s0 +extension XKEYBOARD system_u:object_r:std_xext_t:s0 +extension DAMAGE system_u:object_r:std_xext_t:s0 +extension RENDER system_u:object_r:std_xext_t:s0 +extension XINERAMA system_u:object_r:std_xext_t:s0 + +# Direct hardware access extensions +extension XFree86-DGA system_u:object_r:directhw_xext_t:s0 +extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0 + +# Screen management and multihead extensions +extension RANDR system_u:object_r:output_xext_t:s0 +extension Composite system_u:object_r:output_xext_t:s0 + +# Screensaver, power management extensions +extension DPMS system_u:object_r:screensaver_xext_t:s0 +extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0 + +# Shared memory extensions +extension MIT-SHM system_u:object_r:shmem_xext_t:s0 +extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0 + +# Accelerated graphics, OpenGL, direct rendering extensions +extension GLX system_u:object_r:accelgraphics_xext_t:s0 +extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0 +extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0 +extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0 + +# Debugging, testing, and recording extensions +extension RECORD system_u:object_r:debug_xext_t:s0 +extension X-Resource system_u:object_r:debug_xext_t:s0 +extension XTEST system_u:object_r:debug_xext_t:s0 + +# Security-related extensions +extension SECURITY system_u:object_r:security_xext_t:s0 +extension SELinux system_u:object_r:security_xext_t:s0 +extension XAccessControlExtension system_u:object_r:security_xext_t:s0 +extension XC-APPGROUP system_u:object_r:security_xext_t:s0 + +# Video extensions +extension XVideo system_u:object_r:video_xext_t:s0 +extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0 + +# Default fallback type +extension * system_u:object_r:xext_t:s0 + + +# +## +### Rules for X Selections +## +# + +# Selection rules map a selection name to a context. A default selection +# rule indicated by an asterisk should follow all other selection rules. +# +# Standard selections +selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0 +selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0 +selection PRIMARY system_u:object_r:clipboard_xselection_t:s0 +selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0 + +# Default fallback type +selection * system_u:object_r:xselection_t:s0 + + +# +## +### Rules for X Events +## +# + +# +# Event rules map an event protocol name to a context. A default event +# rule indicated by an asterisk should follow all other event rules. +# +# Input events +event X11:KeyPress system_u:object_r:input_xevent_t:s0 +event X11:KeyRelease system_u:object_r:input_xevent_t:s0 +event X11:ButtonPress system_u:object_r:input_xevent_t:s0 +event X11:ButtonRelease system_u:object_r:input_xevent_t:s0 +event X11:MotionNotify system_u:object_r:input_xevent_t:s0 +event X11:SelectionNotify system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0 +event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0 +event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0 + +# Focus events +event X11:FocusIn system_u:object_r:focus_xevent_t:s0 +event X11:FocusOut system_u:object_r:focus_xevent_t:s0 +event X11:EnterNotify system_u:object_r:focus_xevent_t:s0 +event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0 + +# Property events +event X11:PropertyNotify system_u:object_r:property_xevent_t:s0 + +# Client message events +event X11:ClientMessage system_u:object_r:client_xevent_t:s0 + +# Manager events +event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0 +event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0 +event X11:MapRequest system_u:object_r:manage_xevent_t:s0 +event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0 +event X11:CreateNotify system_u:object_r:manage_xevent_t:s0 +event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0 +event X11:MapNotify system_u:object_r:manage_xevent_t:s0 +event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0 +event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0 +event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0 +event X11:GravityNotify system_u:object_r:manage_xevent_t:s0 +event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0 +event X11:Expose system_u:object_r:manage_xevent_t:s0 +event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0 + +# Unknown events (that are not registered in the X server's name database) +event system_u:object_r:unknown_xevent_t:s0 + +# Default fallback type +event * system_u:object_r:xevent_t:s0 diff --git a/config/appconfig-mls/x_contexts b/config/appconfig-mls/x_contexts new file mode 100644 index 0000000..08da649 --- /dev/null +++ b/config/appconfig-mls/x_contexts @@ -0,0 +1,194 @@ +# +# Config file for XSELinux extension +# + + +# +## +### Rules for X Clients +## +# + +# +# The default client rule defines a context to be used for all clients +# connecting to the server from a remote host. +# +client * system_u:object_r:remote_xclient_t:s0 + + +# +## +### Rules for X Properties +## +# + +# +# Property rules map a property name to a context. A default property +# rule indicated by an asterisk should follow all other property rules. +# +# Properties that normal clients may only read +property XFree86_VT system_u:object_r:info_xproperty_t:s0 +property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t:s0 +property RESOURCE_MANAGER system_u:object_r:info_xproperty_t:s0 +property SCREEN_RESOURCES system_u:object_r:info_xproperty_t:s0 +property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t:s0 +property AT_SPI_IOR system_u:object_r:info_xproperty_t:s0 +property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t:s0 +property _NET_WORKAREA system_u:object_r:info_xproperty_t:s0 +property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t:s0 + +# Clipboard and selection properties +property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t:s0 +property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t:s0 + +# Default fallback type +property * system_u:object_r:xproperty_t:s0 + + +# +## +### Rules for X Extensions +## +# + +# +# Extension rules map an extension name to a context. A default extension +# rule indicated by an asterisk should follow all other extension rules. +# +# Standard extensions +extension BIG-REQUESTS system_u:object_r:std_xext_t:s0 +extension SHAPE system_u:object_r:std_xext_t:s0 +extension SYNC system_u:object_r:std_xext_t:s0 +extension XC-MISC system_u:object_r:std_xext_t:s0 +extension XFIXES system_u:object_r:std_xext_t:s0 +extension XInputExtension system_u:object_r:std_xext_t:s0 +extension XKEYBOARD system_u:object_r:std_xext_t:s0 +extension DAMAGE system_u:object_r:std_xext_t:s0 +extension RENDER system_u:object_r:std_xext_t:s0 +extension XINERAMA system_u:object_r:std_xext_t:s0 + +# Direct hardware access extensions +extension XFree86-DGA system_u:object_r:directhw_xext_t:s0 +extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t:s0 + +# Screen management and multihead extensions +extension RANDR system_u:object_r:output_xext_t:s0 +extension Composite system_u:object_r:output_xext_t:s0 + +# Screensaver, power management extensions +extension DPMS system_u:object_r:screensaver_xext_t:s0 +extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t:s0 + +# Shared memory extensions +extension MIT-SHM system_u:object_r:shmem_xext_t:s0 +extension XFree86-Bigfont system_u:object_r:shmem_xext_t:s0 + +# Accelerated graphics, OpenGL, direct rendering extensions +extension GLX system_u:object_r:accelgraphics_xext_t:s0 +extension NV-CONTROL system_u:object_r:accelgraphics_xext_t:s0 +extension NV-GLX system_u:object_r:accelgraphics_xext_t:s0 +extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t:s0 + +# Debugging, testing, and recording extensions +extension RECORD system_u:object_r:debug_xext_t:s0 +extension X-Resource system_u:object_r:debug_xext_t:s0 +extension XTEST system_u:object_r:debug_xext_t:s0 + +# Security-related extensions +extension SECURITY system_u:object_r:security_xext_t:s0 +extension SELinux system_u:object_r:security_xext_t:s0 +extension XAccessControlExtension system_u:object_r:security_xext_t:s0 +extension XC-APPGROUP system_u:object_r:security_xext_t:s0 + +# Video extensions +extension XVideo system_u:object_r:video_xext_t:s0 +extension XVideo-MotionCompensation system_u:object_r:video_xext_t:s0 + +# Default fallback type +extension * system_u:object_r:xext_t:s0 + + +# +## +### Rules for X Selections +## +# + +# Selection rules map a selection name to a context. A default selection +# rule indicated by an asterisk should follow all other selection rules. +# +# Standard selections +selection XA_PRIMARY system_u:object_r:clipboard_xselection_t:s0 +selection XA_SECONDARY system_u:object_r:clipboard_xselection_t:s0 +selection PRIMARY system_u:object_r:clipboard_xselection_t:s0 +selection CLIPBOARD system_u:object_r:clipboard_xselection_t:s0 + +# Default fallback type +selection * system_u:object_r:xselection_t:s0 + + +# +## +### Rules for X Events +## +# + +# +# Event rules map an event protocol name to a context. A default event +# rule indicated by an asterisk should follow all other event rules. +# +# Input events +event X11:KeyPress system_u:object_r:input_xevent_t:s0 +event X11:KeyRelease system_u:object_r:input_xevent_t:s0 +event X11:ButtonPress system_u:object_r:input_xevent_t:s0 +event X11:ButtonRelease system_u:object_r:input_xevent_t:s0 +event X11:MotionNotify system_u:object_r:input_xevent_t:s0 +event X11:SelectionNotify system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t:s0 +event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t:s0 +event XInputExtension:ProximityIn system_u:object_r:input_xevent_t:s0 +event XInputExtension:ProximityOut system_u:object_r:input_xevent_t:s0 + +# Focus events +event X11:FocusIn system_u:object_r:focus_xevent_t:s0 +event X11:FocusOut system_u:object_r:focus_xevent_t:s0 +event X11:EnterNotify system_u:object_r:focus_xevent_t:s0 +event X11:LeaveNotify system_u:object_r:focus_xevent_t:s0 + +# Property events +event X11:PropertyNotify system_u:object_r:property_xevent_t:s0 + +# Client message events +event X11:ClientMessage system_u:object_r:client_xevent_t:s0 + +# Manager events +event X11:ConfigureRequest system_u:object_r:manage_xevent_t:s0 +event X11:ResizeRequest system_u:object_r:manage_xevent_t:s0 +event X11:MapRequest system_u:object_r:manage_xevent_t:s0 +event X11:CirculateRequest system_u:object_r:manage_xevent_t:s0 +event X11:CreateNotify system_u:object_r:manage_xevent_t:s0 +event X11:DestroyNotify system_u:object_r:manage_xevent_t:s0 +event X11:MapNotify system_u:object_r:manage_xevent_t:s0 +event X11:UnmapNotify system_u:object_r:manage_xevent_t:s0 +event X11:ReparentNotify system_u:object_r:manage_xevent_t:s0 +event X11:ConfigureNotify system_u:object_r:manage_xevent_t:s0 +event X11:GravityNotify system_u:object_r:manage_xevent_t:s0 +event X11:CirculateNotify system_u:object_r:manage_xevent_t:s0 +event X11:Expose system_u:object_r:manage_xevent_t:s0 +event X11:VisibilityNotify system_u:object_r:manage_xevent_t:s0 + +# Unknown events (that are not registered in the X server's name database) +event system_u:object_r:unknown_xevent_t:s0 + +# Default fallback type +event * system_u:object_r:xevent_t:s0 diff --git a/config/appconfig-standard/x_contexts b/config/appconfig-standard/x_contexts new file mode 100644 index 0000000..f9cefb9 --- /dev/null +++ b/config/appconfig-standard/x_contexts @@ -0,0 +1,194 @@ +# +# Config file for XSELinux extension +# + + +# +## +### Rules for X Clients +## +# + +# +# The default client rule defines a context to be used for all clients +# connecting to the server from a remote host. +# +client * system_u:object_r:remote_xclient_t + + +# +## +### Rules for X Properties +## +# + +# +# Property rules map a property name to a context. A default property +# rule indicated by an asterisk should follow all other property rules. +# +# Properties that normal clients may only read +property XFree86_VT system_u:object_r:info_xproperty_t +property XFree86_DDC_EDID1_RAWDATA system_u:object_r:info_xproperty_t +property RESOURCE_MANAGER system_u:object_r:info_xproperty_t +property SCREEN_RESOURCES system_u:object_r:info_xproperty_t +property _MIT_PRIORITY_COLORS system_u:object_r:info_xproperty_t +property AT_SPI_IOR system_u:object_r:info_xproperty_t +property _SELINUX_CLIENT_CONTEXT system_u:object_r:info_xproperty_t +property _NET_WORKAREA system_u:object_r:info_xproperty_t +property _XKB_RULES_NAMES system_u:object_r:info_xproperty_t + +# Clipboard and selection properties +property CUT_BUFFER0 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER1 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER2 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER3 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER4 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER5 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER6 system_u:object_r:clipboard_xproperty_t +property CUT_BUFFER7 system_u:object_r:clipboard_xproperty_t + +# Default fallback type +property * system_u:object_r:xproperty_t + + +# +## +### Rules for X Extensions +## +# + +# +# Extension rules map an extension name to a context. A default extension +# rule indicated by an asterisk should follow all other extension rules. +# +# Standard extensions +extension BIG-REQUESTS system_u:object_r:std_xext_t +extension SHAPE system_u:object_r:std_xext_t +extension SYNC system_u:object_r:std_xext_t +extension XC-MISC system_u:object_r:std_xext_t +extension XFIXES system_u:object_r:std_xext_t +extension XInputExtension system_u:object_r:std_xext_t +extension XKEYBOARD system_u:object_r:std_xext_t +extension DAMAGE system_u:object_r:std_xext_t +extension RENDER system_u:object_r:std_xext_t +extension XINERAMA system_u:object_r:std_xext_t + +# Direct hardware access extensions +extension XFree86-DGA system_u:object_r:directhw_xext_t +extension XFree86-VidModeExtension system_u:object_r:directhw_xext_t + +# Screen management and multihead extensions +extension RANDR system_u:object_r:output_xext_t +extension Composite system_u:object_r:output_xext_t + +# Screensaver, power management extensions +extension DPMS system_u:object_r:screensaver_xext_t +extension MIT-SCREEN-SAVER system_u:object_r:screensaver_xext_t + +# Shared memory extensions +extension MIT-SHM system_u:object_r:shmem_xext_t +extension XFree86-Bigfont system_u:object_r:shmem_xext_t + +# Accelerated graphics, OpenGL, direct rendering extensions +extension GLX system_u:object_r:accelgraphics_xext_t +extension NV-CONTROL system_u:object_r:accelgraphics_xext_t +extension NV-GLX system_u:object_r:accelgraphics_xext_t +extension NVIDIA-GLX system_u:object_r:accelgraphics_xext_t + +# Debugging, testing, and recording extensions +extension RECORD system_u:object_r:debug_xext_t +extension X-Resource system_u:object_r:debug_xext_t +extension XTEST system_u:object_r:debug_xext_t + +# Security-related extensions +extension SECURITY system_u:object_r:security_xext_t +extension SELinux system_u:object_r:security_xext_t +extension XAccessControlExtension system_u:object_r:security_xext_t +extension XC-APPGROUP system_u:object_r:security_xext_t + +# Video extensions +extension XVideo system_u:object_r:video_xext_t +extension XVideo-MotionCompensation system_u:object_r:video_xext_t + +# Default fallback type +extension * system_u:object_r:xext_t + + +# +## +### Rules for X Selections +## +# + +# Selection rules map a selection name to a context. A default selection +# rule indicated by an asterisk should follow all other selection rules. +# +# Standard selections +selection XA_PRIMARY system_u:object_r:clipboard_xselection_t +selection XA_SECONDARY system_u:object_r:clipboard_xselection_t +selection PRIMARY system_u:object_r:clipboard_xselection_t +selection CLIPBOARD system_u:object_r:clipboard_xselection_t + +# Default fallback type +selection * system_u:object_r:xselection_t + + +# +## +### Rules for X Events +## +# + +# +# Event rules map an event protocol name to a context. A default event +# rule indicated by an asterisk should follow all other event rules. +# +# Input events +event X11:KeyPress system_u:object_r:input_xevent_t +event X11:KeyRelease system_u:object_r:input_xevent_t +event X11:ButtonPress system_u:object_r:input_xevent_t +event X11:ButtonRelease system_u:object_r:input_xevent_t +event X11:MotionNotify system_u:object_r:input_xevent_t +event X11:SelectionNotify system_u:object_r:input_xevent_t +event XInputExtension:DeviceKeyPress system_u:object_r:input_xevent_t +event XInputExtension:DeviceKeyRelease system_u:object_r:input_xevent_t +event XInputExtension:DeviceButtonPress system_u:object_r:input_xevent_t +event XInputExtension:DeviceButtonRelease system_u:object_r:input_xevent_t +event XInputExtension:DeviceMotionNotify system_u:object_r:input_xevent_t +event XInputExtension:DeviceValuator system_u:object_r:input_xevent_t +event XInputExtension:ProximityIn system_u:object_r:input_xevent_t +event XInputExtension:ProximityOut system_u:object_r:input_xevent_t + +# Focus events +event X11:FocusIn system_u:object_r:focus_xevent_t +event X11:FocusOut system_u:object_r:focus_xevent_t +event X11:EnterNotify system_u:object_r:focus_xevent_t +event X11:LeaveNotify system_u:object_r:focus_xevent_t + +# Property events +event X11:PropertyNotify system_u:object_r:property_xevent_t + +# Client message events +event X11:ClientMessage system_u:object_r:client_xevent_t + +# Manager events +event X11:ConfigureRequest system_u:object_r:manage_xevent_t +event X11:ResizeRequest system_u:object_r:manage_xevent_t +event X11:MapRequest system_u:object_r:manage_xevent_t +event X11:CirculateRequest system_u:object_r:manage_xevent_t +event X11:CreateNotify system_u:object_r:manage_xevent_t +event X11:DestroyNotify system_u:object_r:manage_xevent_t +event X11:MapNotify system_u:object_r:manage_xevent_t +event X11:UnmapNotify system_u:object_r:manage_xevent_t +event X11:ReparentNotify system_u:object_r:manage_xevent_t +event X11:ConfigureNotify system_u:object_r:manage_xevent_t +event X11:GravityNotify system_u:object_r:manage_xevent_t +event X11:CirculateNotify system_u:object_r:manage_xevent_t +event X11:Expose system_u:object_r:manage_xevent_t +event X11:VisibilityNotify system_u:object_r:manage_xevent_t + +# Unknown events (that are not registered in the X server's name database) +event system_u:object_r:unknown_xevent_t + +# Default fallback type +event * system_u:object_r:xevent_t diff --git a/policy/flask/access_vectors b/policy/flask/access_vectors index f7f181c..b5631e9 100644 --- a/policy/flask/access_vectors +++ b/policy/flask/access_vectors @@ -416,141 +416,160 @@ class passwd # # SE-X Windows stuff # -class drawable +class x_drawable { create destroy - draw - copy + read + write + blend getattr + setattr + list_child + add_child + remove_child + list_property + get_property + set_property + manage + override + show + hide + send + receive } -class gc +class x_screen { - create - free getattr setattr + hide_cursor + show_cursor + saver_getattr + saver_setattr + saver_hide + saver_show } -class window +class x_gc { - addchild create destroy - map - unmap - chstack - chproplist - chprop - listprop getattr setattr - setfocus - move - chselection - chparent - ctrllife - enumerate - transparent - mousemotion - clientcomevent - inputevent - drawevent - windowchangeevent - windowchangerequest - serverchangeevent - extensionevent -} - -class font -{ - load - free + use +} + +class x_font +{ + create + destroy getattr + add_glyph + remove_glyph use } -class colormap +class x_colormap { create - free + destroy + read + write + getattr + add_color + remove_color install uninstall - list + use +} + +class x_property +{ + create + destroy read - store + write + append getattr setattr } -class property +class x_selection { - create - free read write + getattr + setattr } -class cursor +class x_cursor { create - createglyph - free - assign + destroy + read + write + getattr setattr + use } -class xclient +class x_client { - kill + destroy + getattr + setattr + manage } -class xinput +class x_device { - lookup getattr setattr + use + read + write + getfocus setfocus - warppointer - activegrab - passivegrab - ungrab bell - mousemotion - relabelinput + force_cursor + freeze + grab + manage } -class xserver +class x_server { - screensaver - gethostlist - sethostlist - getfontpath - setfontpath getattr + setattr + record + debug grab - ungrab + manage } -class xextension +class x_extension { query use } -# -# Define the access vector interpretation for controlling -# PaX flags -# -class pax +class x_resource +{ + read + write +} + +class x_event { - pageexec # Paging based non-executable pages - emutramp # Emulate trampolines - mprotect # Restrict mprotect() - randmmap # Randomize mmap() base - randexec # Randomize ET_EXEC base - segmexec # Segmentation based non-executable pages + send + receive +} + +class x_synthetic_event +{ + send + receive } # diff --git a/policy/flask/security_classes b/policy/flask/security_classes index 68c4374..5b758d9 100644 --- a/policy/flask/security_classes +++ b/policy/flask/security_classes @@ -50,21 +50,19 @@ class ipc # passwd/chfn/chsh class passwd # userspace -# SE-X Windows stuff -class drawable # userspace -class window # userspace -class gc # userspace -class font # userspace -class colormap # userspace -class property # userspace -class cursor # userspace -class xclient # userspace -class xinput # userspace -class xserver # userspace -class xextension # userspace - -# pax flags; deprecated--can be reclaimed -class pax # userspace +# SE-X Windows stuff (more classes below) +class x_drawable # userspace +class x_screen # userspace +class x_gc # userspace +class x_font # userspace +class x_colormap # userspace +class x_property # userspace +class x_selection # userspace +class x_cursor # userspace +class x_client # userspace +class x_device # userspace +class x_server # userspace +class x_extension # userspace # extended netlink sockets class netlink_route_socket @@ -112,4 +110,9 @@ class peer # Capabilities >= 32 class capability2 +# More SE-X Windows stuff +class x_resource # userspace +class x_event # userspace +class x_synthetic_event # userspace + # FLASK diff --git a/policy/mls b/policy/mls index 5105b17..beed2f8 100644 --- a/policy/mls +++ b/policy/mls @@ -371,78 +371,53 @@ mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setexec se # -# MLS policy for the drawable class +# MLS policy for the x_drawable class # -# the drawable "read" ops (implicit single level) -mlsconstrain drawable { getattr copy } +# the x_drawable "read" ops (implicit single level) +mlsconstrain x_drawable { read blend getattr list_child list_property get_property receive } (( l1 dom l2 ) or (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or ( t1 == mlsxwinread )); -# the drawable "write" ops (implicit single level) -mlsconstrain drawable { create destroy draw copy } +# the x_drawable "write" ops (implicit single level) +mlsconstrain x_drawable { create destroy write setattr add_child remove_child send manage } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwrite )); - +# No MLS restrictions: x_drawable { show hide override } # -# MLS policy for the gc class +# MLS policy for the x_gc class # -# the gc "read" ops (implicit single level) -mlsconstrain gc getattr +# the x_gc "read" ops (implicit single level) +mlsconstrain x_gc { getattr use } (( l1 dom l2 ) or (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or ( t1 == mlsxwinread )); -# the gc "write" ops (implicit single level) -mlsconstrain gc { create free setattr } +# the x_gc "write" ops (implicit single level) +mlsconstrain x_gc { create destroy setattr } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwrite )); - - # -# MLS policy for the window class +# MLS policy for the x_font class # -# the window "read" ops (implicit single level) -mlsconstrain window { listprop getattr enumerate mousemotion inputevent drawevent windowchangeevent windowchangerequest serverchangeevent extensionevent } +# the x_font "read" ops (implicit single level) +mlsconstrain x_font { use } (( l1 dom l2 ) or (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or ( t1 == mlsxwinread )); -# the window "write" ops (implicit single level) -mlsconstrain window { addchild create destroy chstack chproplist chprop setattr setfocus move chselection chparent ctrllife transparent clientcomevent } - (( l1 eq l2 ) or - (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or - ( t1 == mlsxwinwrite ) or - ( t2 == mlstrustedobject )); - -# these access vectors have no MLS restrictions -# window { map unmap } - - - - -# -# MLS policy for the font class -# - -# the font "read" ops (implicit single level) -mlsconstrain font { load getattr } - (( l1 dom l2 ) or - (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or - ( t1 == mlsxwinread )); - -# the font "write" ops (implicit single level) -mlsconstrain font free +# the x_font "write" ops (implicit single level) +mlsconstrain x_font { create destroy add_glyph remove_glyph } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwrite )); @@ -451,109 +426,147 @@ mlsconstrain font free # font use - - # -# MLS policy for the colormap class +# MLS policy for the x_colormap class # -# the colormap "read" ops (implicit single level) -mlsconstrain colormap { list read getattr } +# the x_colormap "read" ops (implicit single level) +mlsconstrain x_colormap { read getattr use } (( l1 dom l2 ) or (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or ( t1 == mlsxwinreadcolormap ) or ( t1 == mlsxwinread )); -# the colormap "write" ops (implicit single level) -mlsconstrain colormap { create free install uninstall store setattr } +# the x_colormap "write" ops (implicit single level) +mlsconstrain x_colormap { create destroy write add_color remove_color install uninstall } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwritecolormap ) or ( t1 == mlsxwinwrite )); - - # -# MLS policy for the property class +# MLS policy for the x_property class # -# the property "read" ops (implicit single level) -mlsconstrain property { read } +# the x_property "read" ops (implicit single level) +mlsconstrain x_property { read getattr } (( l1 dom l2 ) or (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or ( t1 == mlsxwinreadproperty ) or ( t1 == mlsxwinread )); -# the property "write" ops (implicit single level) -mlsconstrain property { create free write } +# the x_property "write" ops (implicit single level) +mlsconstrain x_property { create destroy write append setattr } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwriteproperty ) or ( t1 == mlsxwinwrite )); - - # -# MLS policy for the cursor class +# MLS policy for the x_cursor class # -# the cursor "write" ops (implicit single level) -mlsconstrain cursor { create createglyph free assign setattr } +# the x_cursor "read" ops (implicit single level) +mlsconstrain x_cursor { read getattr use } + (( l1 dom l2 ) or + (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or + ( t1 == mlsxwinread )); + +# the x_cursor "write" ops (implicit single level) +mlsconstrain x_cursor { create destroy write setattr } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwrite )); - - # -# MLS policy for the xclient class +# MLS policy for the x_client class # -# the xclient "write" ops (implicit single level) -mlsconstrain xclient kill +# the x_client "read" ops (implicit single level) +mlsconstrain x_client { getattr } + (( l1 dom l2 ) or + (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or + ( t1 == mlsxwinread )); + +# the x_client "write" ops (implicit single level) +mlsconstrain x_client { destroy setattr manage } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwrite )); - - # -# MLS policy for the xinput class +# MLS policy for the x_device class # -# these access vectors have no MLS restrictions -# xinput ~{ relabelinput setattr } +# the x_device "read" ops (implicit single level) +mlsconstrain x_device { getattr use read getfocus grab } + (( l1 dom l2 ) or + (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or + ( t1 == mlsxwinread )); -# the xinput "write" ops (implicit single level) -mlsconstrain xinput { setattr relabelinput } +# the x_device "write" ops (implicit single level) +mlsconstrain x_device { setattr write setfocus bell force_cursor freeze manage } (( l1 eq l2 ) or (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or ( t1 == mlsxwinwritexinput ) or ( t1 == mlsxwinwrite )); +# +# MLS policy for the x_server class +# + +# these access vectors have no MLS restrictions +# x_server * # -# MLS policy for the xserver class +# MLS policy for the x_extension class # # these access vectors have no MLS restrictions -# xserver * +# x_extension { query use } + +# +# MLS policy for the x_resource class +# + +# the x_resource "read" ops (implicit single level) +mlsconstrain x_resource { read } + (( l1 dom l2 ) or + (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or + ( t1 == mlsxwinread )); +# the x_resource "write" ops (implicit single level) +mlsconstrain x_resource { write } + (( l1 eq l2 ) or + (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or + ( t1 == mlsxwinwritexinput ) or + ( t1 == mlsxwinwrite )); # -# MLS policy for the xextension class +# MLS policy for the x_event class # -# these access vectors have no MLS restrictions -# xextension { query use } +# the x_event "read" ops (implicit single level) +mlsconstrain x_event { receive } + (( l1 dom l2 ) or + (( t1 == mlsxwinreadtoclr ) and ( h1 dom l2 )) or + ( t1 == mlsxwinread )); + +# the x_event "write" ops (implicit single level) +mlsconstrain x_event { send } + (( l1 eq l2 ) or + (( t1 == mlsxwinwritetoclr ) and ( h1 dom l2 ) and ( l1 domby l2 )) or + ( t1 == mlsxwinwritexinput ) or + ( t1 == mlsxwinwrite )); + # diff --git a/policy/modules/apps/ethereal.if b/policy/modules/apps/ethereal.if index c9dd4f3..b9b8c36 100644 --- a/policy/modules/apps/ethereal.if +++ b/policy/modules/apps/ethereal.if @@ -159,7 +159,7 @@ template(`ethereal_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_ethereal_t,$1_ethereal_tmpfs_t) + xserver_user_x_domain_template($1,$1_ethereal,$1_ethereal_t,$1_ethereal_tmpfs_t) xserver_create_xdm_tmp_sockets($1_ethereal_t) ') diff --git a/policy/modules/apps/ethereal.te b/policy/modules/apps/ethereal.te index 48dc20e..eca8fbb 100644 --- a/policy/modules/apps/ethereal.te +++ b/policy/modules/apps/ethereal.te @@ -1,5 +1,5 @@ -policy_module(ethereal,1.4.0) +policy_module(ethereal,1.4.1) ######################################## # diff --git a/policy/modules/apps/evolution.if b/policy/modules/apps/evolution.if index 3480e41..8a7abdb 100644 --- a/policy/modules/apps/evolution.if +++ b/policy/modules/apps/evolution.if @@ -247,7 +247,7 @@ template(`evolution_per_role_template',` mta_read_config($1_evolution_t) - xserver_user_client_template($1,$1_evolution_t,$1_evolution_tmpfs_t) + xserver_user_x_domain_template($1,$1_evolution,$1_evolution_t,$1_evolution_tmpfs_t) xserver_read_xdm_tmp_files($1_evolution_t) tunable_policy(`use_nfs_home_dirs',` @@ -513,7 +513,7 @@ template(`evolution_per_role_template',` # until properly implemented userdom_dontaudit_read_user_home_content_files($1,$1_evolution_alarm_t) - xserver_user_client_template($1,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t) + xserver_user_x_domain_template($1,$1_evolution_alarm,$1_evolution_alarm_t,$1_evolution_alarm_tmpfs_t) # Access evolution home tunable_policy(`use_nfs_home_dirs',` @@ -615,7 +615,7 @@ template(`evolution_per_role_template',` # until properly implemented userdom_dontaudit_read_user_home_content_files($1,$1_evolution_exchange_t) - xserver_user_client_template($1,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t) + xserver_user_x_domain_template($1,$1_evolution_exchange,$1_evolution_exchange_t,$1_evolution_exchange_tmpfs_t) # Access evolution home tunable_policy(`use_nfs_home_dirs',` @@ -776,7 +776,7 @@ template(`evolution_per_role_template',` # until properly implemented userdom_dontaudit_read_user_home_content_files($1,$1_evolution_webcal_t) - xserver_user_client_template($1,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t) + xserver_user_x_domain_template($1,$1_evolution_webcal,$1_evolution_webcal_t,$1_evolution_webcal_tmpfs_t) optional_policy(` nscd_socket_use($1_evolution_webcal_t) diff --git a/policy/modules/apps/evolution.te b/policy/modules/apps/evolution.te index 448ff89..5189a7e 100644 --- a/policy/modules/apps/evolution.te +++ b/policy/modules/apps/evolution.te @@ -1,5 +1,5 @@ -policy_module(evolution,1.5.0) +policy_module(evolution,1.5.1) ######################################## # diff --git a/policy/modules/apps/games.if b/policy/modules/apps/games.if index 629af63..9447457 100644 --- a/policy/modules/apps/games.if +++ b/policy/modules/apps/games.if @@ -146,7 +146,7 @@ template(`games_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_games_t,$1_games_tmpfs_t) + xserver_user_x_domain_template($1,$1_games,$1_games_t,$1_games_tmpfs_t) xserver_create_xdm_tmp_sockets($1_games_t) xserver_read_xdm_lib_files($1_games_t) ') diff --git a/policy/modules/apps/games.te b/policy/modules/apps/games.te index 2575b2a..bc9c387 100644 --- a/policy/modules/apps/games.te +++ b/policy/modules/apps/games.te @@ -1,5 +1,5 @@ -policy_module(games,1.5.0) +policy_module(games,1.5.1) ######################################## # diff --git a/policy/modules/apps/gift.if b/policy/modules/apps/gift.if index 8d034ae..786fe55 100644 --- a/policy/modules/apps/gift.if +++ b/policy/modules/apps/gift.if @@ -130,7 +130,7 @@ template(`gift_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_gift_t,$1_gift_tmpfs_t) + xserver_user_x_domain_template($1,$1_gift,$1_gift_t,$1_gift_tmpfs_t) ') ############################## diff --git a/policy/modules/apps/gift.te b/policy/modules/apps/gift.te index 47db334..0f31d5e 100644 --- a/policy/modules/apps/gift.te +++ b/policy/modules/apps/gift.te @@ -1,5 +1,5 @@ -policy_module(gift,1.3.0) +policy_module(gift,1.3.1) ######################################## # diff --git a/policy/modules/apps/java.if b/policy/modules/apps/java.if index cb557b0..47c801b 100644 --- a/policy/modules/apps/java.if +++ b/policy/modules/apps/java.if @@ -164,7 +164,7 @@ template(`java_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_javaplugin_t,$1_javaplugin_tmpfs_t) + xserver_user_x_domain_template($1,$1_javaplugin,$1_javaplugin_t,$1_javaplugin_tmpfs_t) ') ') diff --git a/policy/modules/apps/java.te b/policy/modules/apps/java.te index bbba38e..a6462f7 100644 --- a/policy/modules/apps/java.te +++ b/policy/modules/apps/java.te @@ -1,5 +1,5 @@ -policy_module(java,1.7.0) +policy_module(java,1.7.1) ######################################## # diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if index e1eb340..fe1ff3a 100644 --- a/policy/modules/apps/mozilla.if +++ b/policy/modules/apps/mozilla.if @@ -191,7 +191,7 @@ template(`mozilla_per_role_template',` userdom_manage_user_tmp_files($1,$1_mozilla_t) userdom_manage_user_tmp_sockets($1,$1_mozilla_t) - xserver_user_client_template($1,$1_mozilla_t,$1_mozilla_tmpfs_t) + xserver_user_x_domain_template($1,$1_mozilla,$1_mozilla_t,$1_mozilla_tmpfs_t) xserver_dontaudit_read_xdm_tmp_files($1_mozilla_t) xserver_dontaudit_getattr_xdm_tmp_sockets($1_mozilla_t) diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te index fa6a5cb..e92a173 100644 --- a/policy/modules/apps/mozilla.te +++ b/policy/modules/apps/mozilla.te @@ -1,5 +1,5 @@ -policy_module(mozilla,1.5.0) +policy_module(mozilla,1.5.1) ######################################## # diff --git a/policy/modules/apps/mplayer.if b/policy/modules/apps/mplayer.if index 39b1bf4..fa5597e 100644 --- a/policy/modules/apps/mplayer.if +++ b/policy/modules/apps/mplayer.if @@ -342,7 +342,7 @@ template(`mplayer_per_role_template',` userdom_read_user_home_content_files($1,$1_mplayer_t) userdom_read_user_home_content_symlinks($1,$1_mplayer_t) - xserver_user_client_template($1,$1_mplayer_t,$1_mplayer_tmpfs_t) + xserver_user_x_domain_template($1,$1_mplayer,$1_mplayer_t,$1_mplayer_tmpfs_t) # Read songs ifdef(`enable_mls',`',` diff --git a/policy/modules/apps/mplayer.te b/policy/modules/apps/mplayer.te index 0ecb614..a2e31e6 100644 --- a/policy/modules/apps/mplayer.te +++ b/policy/modules/apps/mplayer.te @@ -1,5 +1,5 @@ -policy_module(mplayer,1.4.0) +policy_module(mplayer,1.4.1) ######################################## # diff --git a/policy/modules/apps/thunderbird.if b/policy/modules/apps/thunderbird.if index ee4d4b2..0d95bfd 100644 --- a/policy/modules/apps/thunderbird.if +++ b/policy/modules/apps/thunderbird.if @@ -160,7 +160,7 @@ template(`thunderbird_per_role_template',` # .kde/....gtkrc userdom_read_user_home_content_files($1,$1_thunderbird_t) - xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t) + xserver_user_x_domain_template($1,$1_thunderbird,$1_thunderbird_t,$1_thunderbird_tmpfs_t) xserver_read_xdm_tmp_files($1_thunderbird_t) xserver_dontaudit_getattr_xdm_tmp_sockets($1_thunderbird_t) diff --git a/policy/modules/apps/thunderbird.te b/policy/modules/apps/thunderbird.te index b588be0..746d3e3 100644 --- a/policy/modules/apps/thunderbird.te +++ b/policy/modules/apps/thunderbird.te @@ -1,5 +1,5 @@ -policy_module(thunderbird,1.5.0) +policy_module(thunderbird,1.5.1) ######################################## # diff --git a/policy/modules/apps/tvtime.if b/policy/modules/apps/tvtime.if index 2c65aad..48c9004 100644 --- a/policy/modules/apps/tvtime.if +++ b/policy/modules/apps/tvtime.if @@ -134,6 +134,6 @@ template(`tvtime_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_tvtime_t,$1_tvtime_tmpfs_t) + xserver_user_x_domain_template($1,$1_tvtime,$1_tvtime_t,$1_tvtime_tmpfs_t) ') ') diff --git a/policy/modules/apps/tvtime.te b/policy/modules/apps/tvtime.te index 7382549..ecafab3 100644 --- a/policy/modules/apps/tvtime.te +++ b/policy/modules/apps/tvtime.te @@ -1,5 +1,5 @@ -policy_module(tvtime,1.3.0) +policy_module(tvtime,1.3.1) ######################################## # diff --git a/policy/modules/apps/vmware.if b/policy/modules/apps/vmware.if index 6bb0915..47069cf 100644 --- a/policy/modules/apps/vmware.if +++ b/policy/modules/apps/vmware.if @@ -164,7 +164,7 @@ template(`vmware_per_role_template',` sysnet_dns_name_resolve($1_vmware_t) sysnet_read_config($1_vmware_t) - xserver_user_client_template($1,$1_vmware_t,$1_vmware_tmpfs_t) + xserver_user_x_domain_template($1,$1_vmware,$1_vmware_t,$1_vmware_tmpfs_t) ') ######################################## diff --git a/policy/modules/apps/vmware.te b/policy/modules/apps/vmware.te index 42c65d7..857b7a3 100644 --- a/policy/modules/apps/vmware.te +++ b/policy/modules/apps/vmware.te @@ -1,5 +1,5 @@ -policy_module(vmware,1.4.0) +policy_module(vmware,1.4.1) ######################################## # diff --git a/policy/modules/kernel/mls.if b/policy/modules/kernel/mls.if index a24f121..38d10af 100644 --- a/policy/modules/kernel/mls.if +++ b/policy/modules/kernel/mls.if @@ -612,6 +612,26 @@ interface(`mls_process_set_level',` ######################################## ## ## Make specified domain MLS trusted +## for reading from X objects up to its clearance. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`mls_xwin_read_to_clearance',` + gen_require(` + attribute mlsxwinreadtoclr; + ') + + typeattribute $1 mlsxwinreadtoclr; +') + +######################################## +## +## Make specified domain MLS trusted ## for reading from X objects at any level. ## ## @@ -632,6 +652,26 @@ interface(`mls_xwin_read_all_levels',` ######################################## ## ## Make specified domain MLS trusted +## for write to X objects up to its clearance. +## +## +## +## Domain allowed access. +## +## +## +# +interface(`mls_xwin_write_to_clearance',` + gen_require(` + attribute mlsxwinwritetoclr; + ') + + typeattribute $1 mlsxwinwritetoclr; +') + +######################################## +## +## Make specified domain MLS trusted ## for writing to X objects at any level. ## ## diff --git a/policy/modules/kernel/mls.te b/policy/modules/kernel/mls.te index b03867c..ad80ba3 100644 --- a/policy/modules/kernel/mls.te +++ b/policy/modules/kernel/mls.te @@ -1,5 +1,5 @@ -policy_module(mls,1.6.1) +policy_module(mls,1.6.2) ######################################## # diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if index 4a5c03d..6d971f0 100644 --- a/policy/modules/services/bluetooth.if +++ b/policy/modules/services/bluetooth.if @@ -107,7 +107,7 @@ template(`bluetooth_per_role_template',` ') optional_policy(` - xserver_user_client_template($1, $1_bluetooth_t, $1_bluetooth_tmpfs_t) + xserver_user_x_domain_template($1, $1_bluetooth, $1_bluetooth_t, $1_bluetooth_tmpfs_t) ') ') diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index 062c11f..2552087 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -1,5 +1,5 @@ -policy_module(bluetooth,2.0.0) +policy_module(bluetooth,2.0.1) ######################################## # diff --git a/policy/modules/services/ssh.if b/policy/modules/services/ssh.if index e1a478c..f4eb2c8 100644 --- a/policy/modules/services/ssh.if +++ b/policy/modules/services/ssh.if @@ -282,7 +282,7 @@ template(`ssh_per_role_template',` ') optional_policy(` - xserver_user_client_template($1,$1_ssh_t,$1_ssh_tmpfs_t) + xserver_user_x_domain_template($1,$1_ssh,$1_ssh_t,$1_ssh_tmpfs_t) xserver_domtrans_user_xauth($1,$1_ssh_t) ') diff --git a/policy/modules/services/ssh.te b/policy/modules/services/ssh.te index 8a76ce7..4dd6e69 100644 --- a/policy/modules/services/ssh.te +++ b/policy/modules/services/ssh.te @@ -1,5 +1,5 @@ -policy_module(ssh,1.9.0) +policy_module(ssh,1.9.1) ######################################## # diff --git a/policy/modules/services/xserver.fc b/policy/modules/services/xserver.fc index ca40ef8..1c4a31d 100644 --- a/policy/modules/services/xserver.fc +++ b/policy/modules/services/xserver.fc @@ -60,7 +60,7 @@ ifdef(`distro_redhat',` /usr/(s)?bin/gdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/(s)?bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0) -/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) +/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) /usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0) /usr/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0) /usr/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0) @@ -74,7 +74,7 @@ ifdef(`distro_debian', ` /usr/X11R6/bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0) /usr/X11R6/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0) -/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0) +/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0) /usr/X11R6/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0) /usr/X11R6/bin/XFree86 -- gen_context(system_u:object_r:xserver_exec_t,s0) /usr/X11R6/bin/Xipaq -- gen_context(system_u:object_r:xserver_exec_t,s0) diff --git a/policy/modules/services/xserver.if b/policy/modules/services/xserver.if index ccf2176..6037a2f 100644 --- a/policy/modules/services/xserver.if +++ b/policy/modules/services/xserver.if @@ -15,6 +15,11 @@ template(`xserver_common_domain_template',` gen_require(` type xkb_var_lib_t, xserver_exec_t, xserver_log_t; + + attribute x_server_domain; + class x_drawable all_x_drawable_perms; + class x_colormap all_x_colormap_perms; + class x_screen all_x_screen_perms; ') ############################## @@ -22,7 +27,12 @@ template(`xserver_common_domain_template',` # Declarations # - type $1_xserver_t; + attribute $1_x_domain; + attribute $1_input_xevent_type; + + type $1_rootwindow_t, rootwindow_type; + + type $1_xserver_t, x_server_domain; domain_type($1_xserver_t) domain_entry_file($1_xserver_t,xserver_exec_t) @@ -83,6 +93,9 @@ template(`xserver_common_domain_template',` manage_files_pattern($1_xserver_t,xserver_log_t,xserver_log_t) logging_log_filetrans($1_xserver_t,xserver_log_t,file) + # Labeling rules for default windows and colormaps + type_transition $1_xserver_t $1_xserver_t:{ x_drawable x_colormap } $1_rootwindow_t; + kernel_read_system_state($1_xserver_t) kernel_read_device_sysctls($1_xserver_t) kernel_read_modprobe_sysctls($1_xserver_t) @@ -142,6 +155,10 @@ template(`xserver_common_domain_template',` fs_search_auto_mountpoints($1_xserver_t) fs_search_ramfs($1_xserver_t) + selinux_validate_context($1_xserver_t) + selinux_compute_access_vector($1_xserver_t) + selinux_compute_create_context($1_xserver_t) + auth_use_nsswitch($1_xserver_t) init_getpgid($1_xserver_t) @@ -153,13 +170,15 @@ template(`xserver_common_domain_template',` libs_use_shared_libs($1_xserver_t) logging_send_syslog_msg($1_xserver_t) + logging_send_audit_msgs($1_xserver_t) miscfiles_read_localization($1_xserver_t) miscfiles_read_fonts($1_xserver_t) modutils_domtrans_insmod($1_xserver_t) - seutil_dontaudit_search_config($1_xserver_t) + # read x_contexts + seutil_read_default_contexts($1_xserver_t) ifndef(`distro_redhat',` allow $1_xserver_t self:process { execmem execheap execstack }; @@ -169,6 +188,32 @@ template(`xserver_common_domain_template',` allow $1_xserver_t self:process { execmem execheap execstack }; ') + tunable_policy(`!xserver_object_manager',` + # should be xserver_unconfined($1_xserver_t), + # but typeattribute doesnt work in conditionals + gen_require(` + attribute x_server_domain, x_domain; + attribute xproperty_type, xselection_type; + attribute xextension_type, xevent_type; + attribute rootwindow_type; + + type remote_xclient_t; + ') + allow $1_xserver_t x_server_domain:x_server *; + allow $1_xserver_t { x_domain rootwindow_type }:x_drawable *; + allow $1_xserver_t x_server_domain:x_screen *; + allow $1_xserver_t x_domain:x_gc *; + allow $1_xserver_t { x_domain rootwindow_type }:x_colormap *; + allow $1_xserver_t xproperty_type:x_property *; + allow $1_xserver_t xselection_type:x_selection *; + allow $1_xserver_t x_domain:x_cursor *; + allow $1_xserver_t { x_domain remote_xclient_t }:x_client *; + allow $1_xserver_t { x_domain x_server_domain }:x_device *; + allow $1_xserver_t xextension_type:x_extension *; + allow $1_xserver_t { x_domain x_server_domain }:x_resource *; + allow $1_xserver_t xevent_type:{ x_event x_synthetic_event } *; + ') + optional_policy(` apm_stream_connect($1_xserver_t) ') @@ -415,6 +460,47 @@ template(`xserver_per_role_template',` tunable_policy(`use_samba_home_dirs',` fs_manage_cifs_files($1_iceauth_t) ') + + ############################## + # + # User X object manager local policy + # + + # Device rules + allow $1_x_domain $1_xserver_t:x_device { read getattr use setattr setfocus grab bell }; + + allow $1_xserver_t { input_xevent_t $1_input_xevent_type }:x_event send; + allow $1_xserver_t { $1_rootwindow_t $1_x_domain }:x_drawable send; + + # manage: xhost X11:ChangeHosts + # freeze: metacity X11:GrabKey + # force_cursor: metacity X11:GrabPointer + allow $2 $1_xserver_t:x_device { manage freeze force_cursor }; + + # gnome-settings-daemon XKEYBOARD:SetControls + allow $2 $1_xserver_t:x_server manage; + + # gnome-settings-daemon RANDR:SelectInput + allow $2 $1_xserver_t:x_resource write; + + # metacity X11:InstallColormap X11:UninstallColormap + allow $2 $1_rootwindow_t:x_colormap { install uninstall }; + + # read: gnome-settings-daemon RANDR:GetScreenSizeRange + # write: gnome-settings-daemon RANDR:SelectInput + # setattr: gnome-settings-daemon X11:GrabKey + # manage: metacity X11:ChangeWindowAttributes + allow $2 $1_rootwindow_t:x_drawable { read write manage setattr }; + + # setattr: metacity X11:InstallColormap + allow $2 $1_xserver_t:x_screen { saver_setattr saver_getattr setattr }; + + # xrdb X11:ChangeProperty prop=RESOURCE_MANAGER + allow $2 info_xproperty_t:x_property { create write append }; + + mls_xwin_read_to_clearance($1_xserver_t) + + xserver_common_x_domain_template($1,$1,$2) ') ####################################### @@ -521,7 +607,7 @@ template(`xserver_rw_session_template',` ## # template(`xserver_user_client_template',` - +# refpolicywarn(`$0() has been deprecated, please use xserver_user_x_domain_template instead.') gen_require(` type xdm_t, xdm_tmp_t; type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t; @@ -564,6 +650,279 @@ template(`xserver_user_client_template',` ') ') +####################################### +## +## Interface to provide X object permissions on a given X server to +## an X client domain. Provides the minimal set required by a basic +## X client application. +## +## +## +## The prefix of the X server domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The prefix of the X client domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## Client domain allowed access. +## +## +# +template(`xserver_common_x_domain_template',` + gen_require(` + type $1_rootwindow_t, std_xext_t, shmem_xext_t; + type xproperty_t, info_xproperty_t, clipboard_xproperty_t; + type input_xevent_t, focus_xevent_t, property_xevent_t, manage_xevent_t; + type xevent_t, client_xevent_t; + type clipboard_xselection_t, xselection_t; + + attribute x_server_domain, x_domain; + attribute xproperty_type; + attribute xevent_type, xextension_type; + attribute $1_x_domain, $1_input_xevent_type; + + class x_drawable all_x_drawable_perms; + class x_screen all_x_screen_perms; + class x_gc all_x_gc_perms; + class x_font all_x_font_perms; + class x_colormap all_x_colormap_perms; + class x_property all_x_property_perms; + class x_selection all_x_selection_perms; + class x_cursor all_x_cursor_perms; + class x_client all_x_client_perms; + class x_device all_x_device_perms; + class x_server all_x_server_perms; + class x_extension all_x_extension_perms; + class x_resource all_x_resource_perms; + class x_event all_x_event_perms; + class x_synthetic_event all_x_synthetic_event_perms; + ') + + ############################## + # + # Declarations + # + + # Type attributes + typeattribute $3 $1_x_domain, x_domain; + + # Types for properties + type $2_xproperty_t alias $2_default_xproperty_t, xproperty_type; + + # Types for events + type $2_input_xevent_t, $1_input_xevent_type, xevent_type; + type $2_property_xevent_t, xevent_type; + type $2_focus_xevent_t, xevent_type; + type $2_manage_xevent_t, xevent_type; + type $2_default_xevent_t, xevent_type; + type $2_client_xevent_t, xevent_type; + + ############################## + # + # Local Policy + # + + # Hacks + # everyone can get the input focus of everyone else + # this is a fundamental brokenness in the X protocol + allow $3 { x_domain x_server_domain }:x_device getfocus; + # everyone can grab the server + # everyone does it, it is basically a free DOS attack + allow $3 x_server_domain:x_server grab; + # everyone can get the font path, etc. + # this could leak out sensitive information + allow $3 x_server_domain:x_server getattr; + # everyone can do override-redirect windows. + # this could be used to spoof labels + allow $3 self:x_drawable override; + # everyone can receive management events on the root window + # allows to know when new windows appear, among other things + allow $3 manage_xevent_t:x_event receive; + + # X Server + # can read server-owned resources + allow $3 x_server_domain:x_resource read; + # can mess with own clients + allow $3 self:x_client { manage destroy }; + + # X Protocol Extensions + allow $3 std_xext_t:x_extension { query use }; + allow $3 shmem_xext_t:x_extension { query use }; + dontaudit $3 xextension_type:x_extension { query use }; + + # X Properties + # can read and write client properties + allow $3 $2_xproperty_t:x_property { create destroy read write append }; + type_transition $3 xproperty_t:x_property $2_xproperty_t; + # can read and write cut buffers + allow $3 clipboard_xproperty_t:x_property { create read write append }; + # can read info properties + allow $3 info_xproperty_t:x_property read; + # can change properties of root window + allow $3 $1_rootwindow_t:x_drawable { list_property get_property set_property }; + # can change properties of own windows + allow $3 self:x_drawable { list_property get_property set_property }; + + # X Windows + # operations allowed on root windows + allow $3 $1_rootwindow_t:x_drawable { getattr list_child add_child remove_child send receive }; + # operations allowed on my windows + allow $3 self:x_drawable { create destroy getattr setattr read write show hide list_child add_child remove_child manage send receive }; + type_transition $3 $1_rootwindow_t:x_drawable $3; + + # X Colormaps + # can use the default colormap + allow $3 $1_rootwindow_t:x_colormap { read use add_color }; + + # X Input + # can receive own events + allow $3 $2_input_xevent_t:{ x_event x_synthetic_event } receive; + allow $3 $2_property_xevent_t:{ x_event x_synthetic_event } receive; + allow $3 $2_focus_xevent_t:{ x_event x_synthetic_event } receive; + allow $3 $2_manage_xevent_t:{ x_event x_synthetic_event } receive; + allow $3 $2_default_xevent_t:{ x_event x_synthetic_event } receive; + allow $3 $2_client_xevent_t:{ x_event x_synthetic_event } receive; + type_transition $3 input_xevent_t:x_event $2_input_xevent_t; + type_transition $3 property_xevent_t:x_event $2_property_xevent_t; + type_transition $3 focus_xevent_t:x_event $2_focus_xevent_t; + type_transition $3 manage_xevent_t:x_event $2_manage_xevent_t; + type_transition $3 client_xevent_t:x_event $2_client_xevent_t; + type_transition $3 xevent_t:x_event $2_default_xevent_t; + # can receive certain root window events + allow $3 focus_xevent_t:x_event receive; + allow $3 property_xevent_t:x_event receive; + allow $3 client_xevent_t:x_synthetic_event receive; + allow $3 manage_xevent_t:x_synthetic_event receive; + # can send ICCCM events to myself + allow $3 $2_manage_xevent_t:x_synthetic_event send; + # can send ICCCM events to the root window + allow $3 manage_xevent_t:x_synthetic_event send; + allow $3 client_xevent_t:x_synthetic_event send; + + # X Selections + # can use the clipboard + allow $3 clipboard_xselection_t:x_selection { getattr setattr read }; + # can query all other selections + allow $3 xselection_t:x_selection { getattr read }; + + # Other X Objects + # can create and use cursors + allow $3 self:x_cursor *; + # can create and use graphics contexts + allow $3 self:x_gc *; + # can create and use colormaps + allow $3 self:x_colormap *; + # can read and write own objects + allow $3 self:x_resource { read write }; + + tunable_policy(`! xserver_object_manager',` + # should be xserver_unconfined($3), + # but typeattribute doesnt work in conditionals + gen_require(` + attribute x_server_domain, x_domain; + attribute xproperty_type, xselection_type; + attribute xextension_type, xevent_type; + attribute rootwindow_type; + + type remote_xclient_t; + ') + allow $3 x_server_domain:x_server *; + allow $3 { x_domain rootwindow_type }:x_drawable *; + allow $3 x_server_domain:x_screen *; + allow $3 x_domain:x_gc *; + allow $3 { x_domain rootwindow_type }:x_colormap *; + allow $3 xproperty_type:x_property *; + allow $3 xselection_type:x_selection *; + allow $3 x_domain:x_cursor *; + allow $3 { x_domain remote_xclient_t }:x_client *; + allow $3 { x_domain x_server_domain }:x_device *; + allow $3 xextension_type:x_extension *; + allow $3 { x_domain x_server_domain }:x_resource *; + allow $3 xevent_type:{ x_event x_synthetic_event } *; + ') +') + +####################################### +## +## Interface to provide X object permissions on a given X server to +## an X client domain. Provides the minimal set required by a basic +## X client application. +## +## +## +## The prefix of the X server domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## The prefix of the X client domain (e.g., user +## is the prefix for user_t). +## +## +## +## +## Client domain allowed access. +## +## +## +## +## The type of the domain SYSV tmpfs files. +## +## +# +template(`xserver_user_x_domain_template',` + gen_require(` + type xdm_t, xdm_tmp_t; + type $1_xauth_home_t, $1_iceauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t; + ') + + allow $3 self:shm create_shm_perms; + allow $3 self:unix_dgram_socket create_socket_perms; + allow $3 self:unix_stream_socket { connectto create_stream_socket_perms }; + + # Read .Xauthority file + allow $3 $1_xauth_home_t:file { getattr read }; + allow $3 $1_iceauth_home_t:file { getattr read }; + + # for when /tmp/.X11-unix is created by the system + allow $3 xdm_t:fd use; + allow $3 xdm_t:fifo_file { getattr read write ioctl }; + allow $3 xdm_tmp_t:dir search; + allow $3 xdm_tmp_t:sock_file { read write }; + dontaudit $3 xdm_t:tcp_socket { read write }; + + # Allow connections to X server. + files_search_tmp($3) + + miscfiles_read_fonts($3) + + userdom_search_user_home_dirs($1,$3) + # for .xsession-errors + userdom_dontaudit_write_user_home_content_files($1,$3) + + xserver_ro_session_template(xdm,$3,$4) + xserver_rw_session_template($1,$3,$4) + xserver_use_user_fonts($1,$3) + + xserver_read_xdm_tmp_files($3) + + # X object manager + xserver_common_x_domain_template($1,$2,$3) + + # Client write xserver shm + tunable_policy(`allow_write_xshm',` + allow $3 $1_xserver_t:shm rw_shm_perms; + allow $3 $1_xserver_tmpfs_t:file rw_file_perms; + ') +') + ######################################## ## ## Read user fonts, user font configuration, @@ -1312,3 +1671,23 @@ interface(`xserver_stream_connect_xdm_xserver',` files_search_tmp($1) stream_connect_pattern($1,xdm_xserver_tmp_t,xdm_xserver_tmp_t,xdm_xserver_t) ') + +######################################## +## +## Interface to provide X object permissions on a given X server to +## an X client domain. Gives the domain complete control over the +## display. +## +## +## +## Domain allowed access. +## +## +# +interface(`xserver_unconfined',` + gen_require(` + attribute xserver_unconfined_type; + ') + + typeattribute $1 xserver_unconfined_type; +') diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 6fda6b2..dcafdcf 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -1,5 +1,5 @@ -policy_module(xserver,1.7.0) +policy_module(xserver,2.0.0) ######################################## # @@ -21,14 +21,58 @@ gen_tunable(allow_write_xshm,false) ## gen_tunable(xdm_sysadm_login,false) +## +##

+## Support X userspace object manager +##

+## +gen_tunable(xserver_object_manager,false) + attribute fonts_type; attribute fonts_cache_type; attribute fonts_config_type; attribute xauth_home_type; +# Domains +attribute xserver_unconfined_type; +attribute x_server_domain; + +# Per-object attributes +attribute rootwindow_type; +attribute x_domain; +attribute xproperty_type; +attribute xselection_type; +attribute xextension_type; +attribute xevent_type; + +type accelgraphics_xext_t, xextension_type; +type client_xevent_t, xevent_type; +type clipboard_xproperty_t, xproperty_type; +type clipboard_xselection_t, xselection_type; +type debug_xext_t, xextension_type; +type directhw_xext_t alias disallowed_xext_t, xextension_type; +type focus_xevent_t, xevent_type; + type iceauth_exec_t; application_executable_file(iceauth_exec_t) +type info_xproperty_t, xproperty_type; +type input_xevent_t, xevent_type; +type manage_xevent_t, xevent_type; +type output_xext_t, xextension_type; +type property_xevent_t, xevent_type; +type remote_xclient_t; +type screensaver_xext_t, xextension_type; +type security_xext_t, xextension_type; +type shmem_xext_t, xextension_type; +type std_xext_t, xextension_type; +type video_xext_t, xextension_type; +type unknown_xevent_t, xevent_type; +type xevent_t alias default_xevent_t, xevent_type; +type xext_t alias unknown_xext_t, xextension_type; +type xproperty_t alias default_xproperty_t, xproperty_type; +type xselection_t alias default_xselection_t, xselection_type; + type xauth_exec_t; application_executable_file(xauth_exec_t) @@ -79,6 +123,7 @@ type xserver_log_t; logging_log_file(xserver_log_t) xserver_common_domain_template(xdm) +xserver_common_x_domain_template(xdm,xdm,xdm_t) init_system_domain(xdm_xserver_t,xserver_exec_t) ifdef(`enable_mcs',` @@ -272,6 +317,7 @@ userdom_read_all_users_state(xdm_t) userdom_signal_all_users(xdm_t) xserver_rw_session_template(xdm,xdm_t,xdm_tmpfs_t) +xserver_unconfined(xdm_t) tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(xdm_t) @@ -441,6 +487,25 @@ optional_policy(` ') ') +######################################## +# +# Rules for unconfined access to this module +# + +allow xserver_unconfined_type x_server_domain:x_server *; +allow xserver_unconfined_type { x_domain rootwindow_type }:x_drawable *; +allow xserver_unconfined_type x_server_domain:x_screen *; +allow xserver_unconfined_type x_domain:x_gc *; +allow xserver_unconfined_type { x_domain rootwindow_type }:x_colormap *; +allow xserver_unconfined_type xproperty_type:x_property *; +allow xserver_unconfined_type xselection_type:x_selection *; +allow xserver_unconfined_type x_domain:x_cursor *; +allow xserver_unconfined_type { x_domain remote_xclient_t }:x_client *; +allow xserver_unconfined_type { x_domain x_server_domain }:x_device *; +allow xserver_unconfined_type xextension_type:x_extension *; +allow xserver_unconfined_type { x_domain x_server_domain }:x_resource *; +allow xserver_unconfined_type xevent_type:{ x_event x_synthetic_event } *; + ifdef(`TODO',` # Need to further investigate these permissions and # perhaps define derived types. diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if index 69a720d..14b419c 100644 --- a/policy/modules/system/unconfined.if +++ b/policy/modules/system/unconfined.if @@ -95,6 +95,10 @@ interface(`unconfined_domain_noaudit',` optional_policy(` storage_unconfined($1) ') + + optional_policy(` + xserver_unconfined($1) + ') ') ######################################## diff --git a/policy/modules/system/unconfined.te b/policy/modules/system/unconfined.te index 972d92a..0ca49cd 100644 --- a/policy/modules/system/unconfined.te +++ b/policy/modules/system/unconfined.te @@ -1,5 +1,5 @@ -policy_module(unconfined,2.1.0) +policy_module(unconfined,2.1.1) ######################################## # diff --git a/support/selinux-policy-refpolicy.spec b/support/selinux-policy-refpolicy.spec index 4ceaf73..b5c5d61 100644 --- a/support/selinux-policy-refpolicy.spec +++ b/support/selinux-policy-refpolicy.spec @@ -74,6 +74,7 @@ make NAME=%{polname2} TYPE=%{type2} DISTRO=%{distro} DIRECT_INITRC=%{direct_init %config(noreplace) %{_sysconfdir}/selinux/*/contexts/initrc_context %config(noreplace) %{_sysconfdir}/selinux/*/contexts/removable_context %config(noreplace) %{_sysconfdir}/selinux/*/contexts/userhelper_context +%config(noreplace) %{_sysconfdir}/selinux/*/contexts/x_contexts %dir %{_sysconfdir}/selinux/*/contexts/files #%ghost %config %{_sysconfdir}/selinux/*/contexts/files/file_contexts #%ghost %config %{_sysconfdir}/selinux/*/contexts/files/homedir_template @@ -117,6 +118,7 @@ SELinux Reference policy targeted base module. %config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/initrc_context %config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/removable_context %config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/userhelper_context +%config(noreplace) %{_sysconfdir}/selinux/%{polname1}/contexts/x_contexts %dir %{_sysconfdir}/selinux/%{polname1}/contexts/files #%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/file_contexts #%ghost %config %{_sysconfdir}/selinux/%{polname1}/contexts/files/homedir_template @@ -162,6 +164,7 @@ SELinux Reference policy strict base module. %config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/initrc_context %config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/removable_context %config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/userhelper_context +%config(noreplace) %{_sysconfdir}/selinux/%{polname2}/contexts/x_contexts %dir %{_sysconfdir}/selinux/%{polname2}/contexts/files #%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/file_contexts #%ghost %config %{_sysconfdir}/selinux/%{polname2}/contexts/files/homedir_template