From 97c3e208f81e48202c1f66b54b5b398c98e3985c Mon Sep 17 00:00:00 2001 From: Sven Vermeulen Date: Wed, 28 May 2014 17:25:49 +0200 Subject: [PATCH] xserver_t needs to ender dirs labeled xdm_var_run_t The LightDM application stores its xauth file in a subdirectory (/var/run/lightdm/root) which is labeled as xdm_var_run_t. As a result, X11 (xserver_t) needs search rights to this location. With this setup, X is run as follows: /usr/bin/X :0 -auth /var/run/lightdm/root/:0 Changes since v1: - Use read_files_pattern instead of separate allow rules Signed-off-by: Jason Zaman Signed-off-by: Sven Vermeulen --- policy/modules/services/xserver.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te index f81fcacae..d57d09ff2 100644 --- a/policy/modules/services/xserver.te +++ b/policy/modules/services/xserver.te @@ -820,7 +820,7 @@ allow xserver_t xdm_t:shm rw_shm_perms; allow xserver_t xdm_var_lib_t:file { getattr read }; dontaudit xserver_t xdm_var_lib_t:dir search; -allow xserver_t xdm_var_run_t:file read_file_perms; +read_files_pattern(xserver_t, xdm_var_run_t, xdm_var_run_t) # Label pid and temporary files with derived types. manage_files_pattern(xserver_t, xdm_tmp_t, xdm_tmp_t)