RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
selinux-refpolicy/policy/modules/services/xserver.fc

131 lines
5.9 KiB
Plaintext
Raw Normal View History

merge xdm into xserver
2006-01-30 22:51:35 +00:00
#
# HOME_DIR
#
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0)
HOME_DIR/\.fonts/auto(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0)
HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0)
HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
Rearrange lines for xauth change.
2011-03-16 12:47:40 +00:00
HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
move xconsole to xserver mod
2006-04-06 19:27:41 +00:00
#
# /dev
#
/dev/xconsole -p gen_context(system_u:object_r:xconsole_device_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
#
# /etc
#
Whitespace fix in xserver.fc.
2014-03-14 15:17:44 +00:00
/etc/gdm(3)?/PostSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/gdm(3)?/PreSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
Add Debian locations for GDM 3
2012-09-10 16:11:13 +00:00
/etc/gdm(3)?/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
add xauth and iceauth to xserver
2006-01-20 19:36:54 +00:00
Add in LightDM contexts
2014-11-22 21:16:39 +00:00
/etc/lightdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
/etc/kde[34]?/kdm/Xstartup -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/kde[34]?/kdm/Xreset -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
Label /etc/rc.d/init.d/x11-common as xdm_exec_t In Debian, this initscript is creating both /tmp/.X11-unix and /tmp/.ICE-unix. This allows the directory to transition to the context defined in the filecontext.
2012-12-05 20:39:27 +00:00
/etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0)
Use substititions for /usr/local/lib and /etc/init.d Introduce the substitutions for the /usr/local/lib* locations (towards /usr/lib) and /etc/init.d (towards /etc/rc.d/init.d). Update the file contexts of the translated locations. Rebased (collided with Guido's patch for commenting within the file_contexts.subs_dist file) since v3. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2012-08-15 14:12:39 +00:00
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
add gdm Xsession fc
2006-07-26 20:33:23 +00:00
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
/etc/X11/wdm/Xsetup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
#
# /opt
#
/opt/kde3/bin/kdm -- gen_context(system_u:object_r:xdm_exec_t,s0)
#
# /tmp
#
patch from dan, Thu, 2007-01-25 at 08:12 -0500
2007-02-16 23:01:42 +00:00
/tmp/\.ICE-unix -d gen_context(system_u:object_r:xdm_tmp_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
/tmp/\.ICE-unix/.* -s <<none>>
trunk: merge UBAC.
2008-11-05 16:10:46 +00:00
/tmp/\.X0-lock -- gen_context(system_u:object_r:xserver_tmp_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
/tmp/\.X11-unix -d gen_context(system_u:object_r:xdm_tmp_t,s0)
/tmp/\.X11-unix/.* -s <<none>>
merge xdm into xserver
2006-01-30 22:51:35 +00:00
#
# /usr
#
These regular expressions were not matched Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-24 13:39:02 +00:00
/usr/s?bin/gdm(3)? -- gen_context(system_u:object_r:xdm_exec_t,s0)
/usr/s?bin/gdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0)
Whitespace fix in xserver.fc.
2014-03-14 15:17:44 +00:00
/usr/s?bin/lxdm(-binary)? -- gen_context(system_u:object_r:xdm_exec_t,s0)
These regular expressions were not matched Signed-off-by: Dominick Grift <dominick.grift@gmail.com>
2013-09-24 13:39:02 +00:00
/usr/s?bin/[xkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
trunk: add core xselinux support.
2008-04-01 20:23:23 +00:00
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/usr/bin/slim -- gen_context(system_u:object_r:xdm_exec_t,s0)
patch from dan Sun, 19 Feb 2006 08:16:18 -0500
2006-02-20 16:31:54 +00:00
/usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0)
trunk: whitespace fix changing multiple spaces into tabs.
2008-12-03 18:33:19 +00:00
/usr/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
patch from dan Wed, 01 Feb 2006 08:33:30 -0500
2006-02-06 22:47:46 +00:00
/usr/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
Whitespace fixes from fc.subs changes.
2012-05-10 14:33:54 +00:00
/usr/lib/qt-.*/etc/settings(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
Label Xorg server binary correctly on Debian On Debian, /usr/bin/Xorg is only a shell script which executes /usr/lib/xorg/Xorg.wrap, which is a SUID binary wrapper around /usr/lib/xorg/Xorg.
2016-01-07 15:46:49 +00:00
/usr/lib/xorg/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/lib/xorg/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
Label Xorg server binary correctly on Arch Linux On Arch Linux, /usr/bin/Xorg is only a shell script which executes /usr/lib/xorg-server/Xorg.wrap, which is a SUID binary wrapper around /usr/lib/xorg-server/Xorg. Even though Xorg.wrap is not a full X server, it reads X11 configuration files, uses the DRM interface to detect KMS, etc. (cf. http://cgit.freedesktop.org/xorg/xserver/tree/hw/xfree86/xorg-wrapper.c?id=xorg-server-1.18.0 for more details). Therefore label it as xserver_exec_t. This makes the following AVC appear: denied { execute_no_trans } for pid=927 comm="X" path="/usr/lib/xorg-server/Xorg.wrap" dev="dm-0" ino=3152592 scontext=system_u:system_r:xserver_t tcontext=system_u:object_r:xserver_exec_t tclass=file Allow /usr/bin/Xorg to execute Xorg.wrap with a can_exec statement.
2015-12-20 15:28:48 +00:00
/usr/lib/xorg-server/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/lib/xorg-server/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
Move lightdm line in xserver.fc.
2014-03-14 15:17:22 +00:00
/usr/sbin/lightdm -- gen_context(system_u:object_r:xdm_exec_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/usr/X11R6/bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
add xauth and iceauth to xserver
2006-01-20 19:36:54 +00:00
/usr/X11R6/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
trunk: add core xselinux support.
2008-04-01 20:23:23 +00:00
/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0)
trunk: whitespace fix changing multiple spaces into tabs.
2008-12-03 18:33:19 +00:00
/usr/X11R6/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
/usr/X11R6/bin/XFree86 -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/bin/Xipaq -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/bin/Xwrapper -- gen_context(system_u:object_r:xserver_exec_t,s0)
/usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
/usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
ifndef(`distro_debian',`
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
')
merge xdm into xserver
2006-01-30 22:51:35 +00:00
#
# /var
#
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
Add in LightDM contexts
2014-11-22 21:16:39 +00:00
/var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
Add Debian locations for GDM 3
2012-09-10 16:11:13 +00:00
/var/lib/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
Add in LightDM contexts
2014-11-22 21:16:39 +00:00
/var/lib/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/var/lib/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/var/lib/[xkw]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
/var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/var/log/[kwx]dm\.log.* -- gen_context(system_u:object_r:xserver_log_t,s0)
Add in LightDM contexts
2014-11-22 21:16:39 +00:00
/var/log/lightdm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/var/log/lxdm\.log -- gen_context(system_u:object_r:xserver_log_t,s0)
Add Debian locations for GDM 3
2012-09-10 16:11:13 +00:00
/var/log/gdm(3)?(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/var/log/slim\.log -- gen_context(system_u:object_r:xserver_log_t,s0)
add xserver
2006-01-19 22:01:48 +00:00
/var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0)
/var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
Whitespace fix in xserver.fc.
2014-03-14 15:17:44 +00:00
/var/run/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
Add Debian locations for GDM 3
2012-09-10 16:11:13 +00:00
/var/run/gdm(3)?\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/xdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
Add in LightDM contexts
2014-11-22 21:16:39 +00:00
/var/run/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
Supporting lxdm and slim Update the xserver file contexts to support the slim and lxdm services. Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2011-12-10 15:07:44 +00:00
/var/run/lxdm\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/lxdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
/var/run/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
Extend slim /var/run expression On Gentoo, slim files are not in /var/run/slim, but directly in /var/run. All names start with slim though, so changing the expression to match those as well. There is already a file transition in place (xdm_t writing files in var_run_t -> xdm_var_run_t) so that needs no further changes. Reported-by: Luis Ressel <aranea@aixah.de> Signed-off-by: Sven Vermeulen <sven.vermeulen@siphos.be>
2013-09-25 18:26:31 +00:00
/var/run/slim.* gen_context(system_u:object_r:xdm_var_run_t,s0)
Debian file locations patch from Russell Coker.
2011-11-16 20:29:18 +00:00
/var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
merge xdm into xserver
2006-01-30 22:51:35 +00:00
/var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
ifdef(`distro_suse',`
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
')