From 04725f303b1b264442a55657f2fb57274d8b6dd8 Mon Sep 17 00:00:00 2001 From: Kenton Groombridge Date: Sun, 8 Aug 2021 12:34:50 -0400 Subject: [PATCH] telepathy, roles: use user exec domain attribute Signed-off-by: Kenton Groombridge --- policy/modules/apps/telepathy.if | 65 +++++++++++++++++------------- policy/modules/roles/staff.te | 2 +- policy/modules/roles/unprivuser.te | 2 +- 3 files changed, 39 insertions(+), 30 deletions(-) diff --git a/policy/modules/apps/telepathy.if b/policy/modules/apps/telepathy.if index d81dc193d..b0554ef0c 100644 --- a/policy/modules/apps/telepathy.if +++ b/policy/modules/apps/telepathy.if @@ -41,18 +41,23 @@ template(`telepathy_domain_template',` ## ## ## -## The prefix of the user domain (e.g., user -## is the prefix for user_t). -## -## -## -## -## The role associated with the user domain. +## The prefix of the user role (e.g., user +## is the prefix for user_r). ## ## ## ## -## The type of the user domain. +## User domain for the role. +## +## +## +## +## User exec domain for execute and transition access. +## +## +## +## +## Role allowed access ## ## # @@ -74,7 +79,7 @@ template(`telepathy_role_template',` type telepathy_mission_control_home_t; ') - role $2 types telepathy_domain; + role $4 types telepathy_domain; allow $3 telepathy_domain:process { ptrace signal_perms }; ps_process_pattern($3, telepathy_domain) @@ -93,34 +98,38 @@ template(`telepathy_role_template',` dbus_spec_session_domain($1, telepathy_stream_engine_t, telepathy_stream_engine_exec_t) dbus_spec_session_domain($1, telepathy_msn_t, telepathy_msn_exec_t) - allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms }; - allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms }; - allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms }; + allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:dir { manage_dir_perms relabel_dir_perms }; - allow $3 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms }; - allow $3 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms }; - allow $3 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms }; + allow $2 { telepathy_mission_control_xdg_cache_t telepathy_xdg_cache_t telepathy_logger_xdg_cache_t }:file { manage_file_perms relabel_file_perms }; + allow $2 { telepathy_gabble_xdg_cache_t telepathy_mission_control_home_t telepathy_xdg_data_t }:file { manage_file_perms relabel_file_perms }; + allow $2 { telepathy_mission_control_xdg_data_t telepathy_sunshine_home_t telepathy_logger_xdg_data_t }:file { manage_file_perms relabel_file_perms }; - filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble") - # gnome_cache_filetrans($3, telepathy_gabble_cache_home_t, dir, "wocky") + filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_gabble_xdg_cache_t, dir, "gabble") + # gnome_cache_filetrans($2, telepathy_gabble_cache_home_t, dir, "wocky") - filetrans_pattern($3, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger") - # gnome_data_filetrans($3, telepathy_logger_data_home_t, dir, "TpLogger") + filetrans_pattern($2, telepathy_xdg_cache_t, telepathy_logger_xdg_cache_t, dir, "logger") + # gnome_data_filetrans($2, telepathy_logger_data_home_t, dir, "TpLogger") - userdom_user_home_dir_filetrans($3, telepathy_mission_control_home_t, dir, ".mission-control") - filetrans_pattern($3, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control") - # gnome_cache_filetrans($3, telepathy_mission_control_cache_home_t, file, ".mc_connections") + userdom_user_home_dir_filetrans($2, telepathy_mission_control_home_t, dir, ".mission-control") + filetrans_pattern($2, telepathy_xdg_data_t, telepathy_mission_control_xdg_data_t, dir, "mission-control") + # gnome_cache_filetrans($2, telepathy_mission_control_cache_home_t, file, ".mc_connections") - userdom_user_home_dir_filetrans($3, telepathy_sunshine_home_t, dir, ".telepathy-sunshine") + userdom_user_home_dir_filetrans($2, telepathy_sunshine_home_t, dir, ".telepathy-sunshine") - # gnome_cache_filetrans($3, telepathy_cache_home_t, dir, "telepathy") - # gnome_data_filetrans($3, telepathy_data_home_t, dir, "telepathy") + # gnome_cache_filetrans($2, telepathy_cache_home_t, dir, "telepathy") + # gnome_data_filetrans($2, telepathy_data_home_t, dir, "telepathy") - allow $3 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms }; - allow $3 telepathy_tmp_content:file { manage_file_perms relabel_file_perms }; - allow $3 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms }; + allow $2 telepathy_tmp_content:dir { manage_dir_perms relabel_dir_perms }; + allow $2 telepathy_tmp_content:file { manage_file_perms relabel_file_perms }; + allow $2 telepathy_tmp_content:sock_file { manage_sock_file_perms relabel_sock_file_perms }; telepathy_mission_control_dbus_chat($3) + + optional_policy(` + systemd_user_app_status($1, telepathy_domain) + ') ') ######################################## diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te index e9f6e4dbe..d85f8de2a 100644 --- a/policy/modules/roles/staff.te +++ b/policy/modules/roles/staff.te @@ -179,7 +179,7 @@ ifndef(`distro_redhat',` ') optional_policy(` - telepathy_role_template(staff, staff_r, staff_t) + telepathy_role_template(staff, staff_t, staff_application_exec_domain, staff_r) ') optional_policy(` diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te index 32153e42f..829546399 100644 --- a/policy/modules/roles/unprivuser.te +++ b/policy/modules/roles/unprivuser.te @@ -163,7 +163,7 @@ ifndef(`distro_redhat',` ') optional_policy(` - telepathy_role_template(user, user_r, user_t) + telepathy_role_template(user, user_t, user_application_exec_domain, user_r) ') optional_policy(`