RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Work with xdg module disabled 

These two cases I see when building on a system without graphical interface.
Move userdom_xdg_user_template into optional block
gpg module doesn't require a graphical front end, move xdg_read_data_files into optional block

Signed-off-by: Dave Sugar <dsugar@tresys.com>
This commit is contained in:
Dave Sugar 2021-01-28 17:13:57 -05:00
parent 3d8e755d85
commit 09bd4af708
2 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
policy/modules/apps/gpg.te
View File

@ -359,8 +359,6 @@ miscfiles_read_localization(gpg_pinentry_t)
userdom_use_user_terminals(gpg_pinentry_t) userdom_use_user_terminals(gpg_pinentry_t)
xdg_read_data_files(gpg_pinentry_t)
tunable_policy(`use_nfs_home_dirs',` tunable_policy(`use_nfs_home_dirs',`
fs_read_nfs_files(gpg_pinentry_t) fs_read_nfs_files(gpg_pinentry_t)
') ')
@ -382,6 +380,10 @@ optional_policy(`
pulseaudio_run(gpg_pinentry_t, gpg_pinentry_roles) pulseaudio_run(gpg_pinentry_t, gpg_pinentry_roles)
') ')
optional_policy(`
xdg_read_data_files(gpg_pinentry_t)
')
optional_policy(` optional_policy(`
xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t) xserver_user_x_domain_template(gpg_pinentry, gpg_pinentry_t, gpg_pinentry_tmpfs_t)
') ')

8
policy/modules/system/userdomain.if
View File

@ -1182,9 +1182,6 @@ template(`userdom_unpriv_user_template', `
fs_exec_noxattr($1_t) fs_exec_noxattr($1_t)
') ')
# Allow users to manage xdg content in their home directories
userdom_xdg_user_template($1)
# Allow users to run TCP servers (bind to ports and accept connection from # Allow users to run TCP servers (bind to ports and accept connection from
# the same domain and outside users) disabling this forces FTP passive mode # the same domain and outside users) disabling this forces FTP passive mode
# and may change other protocols # and may change other protocols
@ -1227,6 +1224,11 @@ template(`userdom_unpriv_user_template', `
systemd_write_inherited_logind_inhibit_pipes($1_t) systemd_write_inherited_logind_inhibit_pipes($1_t)
') ')
# Allow users to manage xdg content in their home directories
optional_policy(`
userdom_xdg_user_template($1)
')
# Allow controlling usbguard # Allow controlling usbguard
optional_policy(` optional_policy(`
tunable_policy(`usbguard_user_modify_rule_files',` tunable_policy(`usbguard_user_modify_rule_files',`