RepoMirrors
/
selinux-refpolicy
mirror of https://github.com/SELinuxProject/refpolicy
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

pulseaudio, roles: use user exec domain attribute 

Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-08-08 12:16:19 -04:00
parent 9554af912d
commit 0a78bb05eb
4 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
policy/modules/apps/pulseaudio.if
View File

@ -4,29 +4,41 @@
## <summary>
## Role access for pulseaudio.
## </summary>
## <param name="role">
## <param name="role_prefix">
## <summary>
## Role allowed access.
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="domain">
## <param name="user_domain">
## <summary>
## User domain for the role.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
#
interface(`pulseaudio_role',`
template(`pulseaudio_role',`
gen_require(`
attribute pulseaudio_tmpfsfile;
type pulseaudio_t, pulseaudio_home_t, pulseaudio_tmpfs_t;
type pulseaudio_tmp_t;
')
pulseaudio_run($2, $1)
pulseaudio_run($2, $4)
pulseaudio_domtrans($3)
allow $2 pulseaudio_t:process { ptrace signal_perms };
allow $2 pulseaudio_t:fd use;
ps_process_pattern($2, pulseaudio_t)
allow $3 pulseaudio_t:process { ptrace signal_perms };
allow $3 pulseaudio_t:fd use;
ps_process_pattern($3, pulseaudio_t)
allow $2 pulseaudio_home_t:dir { manage_dir_perms relabel_dir_perms };
allow $2 pulseaudio_home_t:file { manage_file_perms relabel_file_perms };
@ -39,8 +51,12 @@ interface(`pulseaudio_role',`
allow $2 pulseaudio_tmp_t:file { manage_file_perms relabel_file_perms };
allow $2 pulseaudio_tmp_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
allow pulseaudio_t $2:unix_stream_socket connectto;
allow pulseaudio_t $2:process signull;
allow pulseaudio_t $3:unix_stream_socket connectto;
allow pulseaudio_t $3:process signull;
optional_policy(`
systemd_user_app_status($1, pulseaudio_t)
')
')
########################################
@ -84,9 +100,12 @@ interface(`pulseaudio_domtrans',`
#
interface(`pulseaudio_run',`
gen_require(`
attribute pulseaudio_client;
attribute_role pulseaudio_roles;
')
typeattribute $1 pulseaudio_client;
pulseaudio_domtrans($1)
roleattribute $2 pulseaudio_roles;
')

2
policy/modules/roles/staff.te
View File

@ -151,7 +151,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
pulseaudio_role(staff_r, staff_t)
pulseaudio_role(staff, staff_t, staff_application_exec_domain, staff_r)
')
optional_policy(`

2
policy/modules/roles/unprivuser.te
View File

@ -123,7 +123,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
pulseaudio_role(user_r, user_t)
pulseaudio_role(user, user_t, user_application_exec_domain, user_r)
')
optional_policy(`

2
policy/modules/system/userdomain.if
View File

@ -1146,7 +1146,7 @@ template(`userdom_restricted_xwindows_user_template',`
')
optional_policy(`
pulseaudio_role($1_r, $1_t)
pulseaudio_role($1, $1_t, $1_application_exec_domain, $1_r)
')
optional_policy(`