diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if index a4bb416ce..c1cf30bf4 100644 --- a/policy/modules/kernel/devices.if +++ b/policy/modules/kernel/devices.if @@ -1431,6 +1431,24 @@ interface(`dev_manage_dri_dev',` ') manage_chr_files_pattern($1, device_t, dri_device_t) +') + +######################################## +## +## Automatic type transition to the type +## for DRI device nodes when created in /dev. +## +## +## +## Domain allowed access. +## +## +# +interface(`dev_filetrans_dri',` + gen_require(` + type device_t, dri_device_t; + ') + filetrans_pattern($1, device_t, dri_device_t, chr_file) ') diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te index 782241b84..6c2f05d3c 100644 --- a/policy/modules/kernel/devices.te +++ b/policy/modules/kernel/devices.te @@ -1,5 +1,5 @@ -policy_module(devices, 1.8.0) +policy_module(devices, 1.8.1) ######################################## # diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index 976fb9082..546296853 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -671,6 +671,7 @@ dev_rw_apm_bios(xserver_t) dev_rw_agp(xserver_t) dev_rw_framebuffer(xserver_t) dev_manage_dri_dev(xserver_t) +dev_filetrans_dri(xserver_t) dev_create_generic_dirs(xserver_t) dev_setattr_generic_dirs(xserver_t) # raw memory access is needed if not using the frame buffer