From 9b1907b217cb4c4d508b5130fcb6267e38182642 Mon Sep 17 00:00:00 2001 From: Chris PeBenito Date: Tue, 21 Jul 2009 10:05:38 -0400 Subject: [PATCH] add pulseaudio from dan. --- Changelog | 1 + policy/modules/apps/pulseaudio.fc | 1 + policy/modules/apps/pulseaudio.if | 145 ++++++++++++++++++++++++ policy/modules/apps/pulseaudio.te | 92 +++++++++++++++ policy/modules/kernel/corenetwork.te.in | 1 + 5 files changed, 240 insertions(+) create mode 100644 policy/modules/apps/pulseaudio.fc create mode 100644 policy/modules/apps/pulseaudio.if create mode 100644 policy/modules/apps/pulseaudio.te diff --git a/Changelog b/Changelog index f4ab83752..ea6ab0b34 100644 --- a/Changelog +++ b/Changelog @@ -29,6 +29,7 @@ pads (Dan Walsh) pingd (Dan Walsh) policykit (Dan Walsh) + pulseaudio (Dan Walsh) psad (Dan Walsh) portreserve (Dan Walsh) sssd (Dan Walsh) diff --git a/policy/modules/apps/pulseaudio.fc b/policy/modules/apps/pulseaudio.fc new file mode 100644 index 000000000..5164058ca --- /dev/null +++ b/policy/modules/apps/pulseaudio.fc @@ -0,0 +1 @@ +/usr/bin/pulseaudio -- gen_context(system_u:object_r:pulseaudio_exec_t,s0) diff --git a/policy/modules/apps/pulseaudio.if b/policy/modules/apps/pulseaudio.if new file mode 100644 index 000000000..e6d88c475 --- /dev/null +++ b/policy/modules/apps/pulseaudio.if @@ -0,0 +1,145 @@ +## Pulseaudio network sound server. + +######################################## +## +## Role access for pulseaudio +## +## +## +## Role allowed access +## +## +## +## +## User domain for the role +## +## +# +interface(`pulseaudio_role',` + gen_require(` + type pulseaudio_t, pulseaudio_exec_t, print_spool_t; + class dbus { send_msg }; + ') + + role $1 types pulseaudio_t; + + # Transition from the user domain to the derived domain. + domtrans_pattern($2, pulseaudio_exec_t, pulseaudio_t) + + ps_process_pattern($2, pulseaudio_t) + + allow pulseaudio_t $2:process { signal signull }; + allow $2 pulseaudio_t:process { signal signull }; + ps_process_pattern(pulseaudio_t, $2) + + allow pulseaudio_t $2:unix_stream_socket connectto; + allow $2 pulseaudio_t:unix_stream_socket connectto; + + userdom_manage_home_role($1, pulseaudio_t) + userdom_manage_tmp_role($1, pulseaudio_t) + userdom_manage_tmpfs_role($1, pulseaudio_t) + + allow $2 pulseaudio_t:dbus send_msg; + allow pulseaudio_t $2:dbus send_msg; +') + +######################################## +## +## Execute a domain transition to run pulseaudio. +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pulseaudio_domtrans',` + gen_require(` + type pulseaudio_t, pulseaudio_exec_t; + ') + + domtrans_pattern($1,pulseaudio_exec_t,pulseaudio_t) +') + +######################################## +## +## Execute pulseaudio in the pulseaudio domain, and +## allow the specified role the pulseaudio domain. +## +## +## +## Domain allowed access. +## +## +## +## +## The role to be allowed the pulseaudio domain. +## +## +# +interface(`pulseaudio_run',` + gen_require(` + type pulseaudio_t; + ') + + pulseaudio_domtrans($1) + role $2 types pulseaudio_t; +') + +######################################## +## +## Execute a pulseaudio in the current domain +## +## +## +## Domain allowed to transition. +## +## +# +interface(`pulseaudio_exec',` + gen_require(` + type pulseaudio_exec_t; + ') + + can_exec($1,pulseaudio_exec_t) +') + +######################################## +## +## Send and receive messages from +## pulseaudio over dbus. +## +## +## +## Domain allowed access. +## +## +# +interface(`pulseaudio_dbus_chat',` + gen_require(` + type pulseaudio_t; + class dbus send_msg; + ') + + allow $1 pulseaudio_t:dbus send_msg; + allow pulseaudio_t $1:dbus send_msg; +') + +######################################## +## +## pulsaudio connection template. +## +## +## +## The type of the user domain. +## +## +# +interface(`pulseaudio_stream_connect',` + gen_require(` + type pulseaudio_t; + ') + + allow $1 pulseaudio_t:process signull; + allow $1 pulseaudio_t:unix_stream_socket connectto; +') diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te new file mode 100644 index 000000000..542f4a926 --- /dev/null +++ b/policy/modules/apps/pulseaudio.te @@ -0,0 +1,92 @@ + +policy_module(pulseaudio,1.0.0) + +######################################## +# +# Declarations +# + +type pulseaudio_t; +type pulseaudio_exec_t; +application_domain(pulseaudio_t, pulseaudio_exec_t) +role system_r types pulseaudio_t; + +######################################## +# +# pulseaudio local policy +# + +allow pulseaudio_t self:process { getcap setcap setrlimit setsched getsched signal signull }; +allow pulseaudio_t self:fifo_file rw_file_perms; +allow pulseaudio_t self:unix_stream_socket create_stream_socket_perms; +allow pulseaudio_t self:unix_dgram_socket { sendto create_socket_perms }; +allow pulseaudio_t self:tcp_socket create_stream_socket_perms; +allow pulseaudio_t self:udp_socket create_socket_perms; + +kernel_read_kernel_sysctls(pulseaudio_t) + +corecmd_exec_bin(pulseaudio_t) + +corenet_all_recvfrom_unlabeled(pulseaudio_t) +corenet_all_recvfrom_netlabel(pulseaudio_t) +corenet_tcp_bind_pulseaudio_port(pulseaudio_t) +corenet_tcp_bind_soundd_port(pulseaudio_t) +corenet_tcp_sendrecv_generic_if(pulseaudio_t) +corenet_tcp_sendrecv_generic_node(pulseaudio_t) +corenet_udp_bind_sap_port(pulseaudio_t) +corenet_udp_sendrecv_generic_if(pulseaudio_t) +corenet_udp_sendrecv_generic_node(pulseaudio_t) + +dev_read_sound(pulseaudio_t) +dev_write_sound(pulseaudio_t) +dev_read_sysfs(pulseaudio_t) +dev_read_urand(pulseaudio_t) + +files_read_etc_files(pulseaudio_t) +files_read_usr_files(pulseaudio_t) + +fs_rw_anon_inodefs_files(pulseaudio_t) +fs_getattr_tmpfs(pulseaudio_t) + +term_use_all_user_ttys(pulseaudio_t) +term_use_all_user_ptys(pulseaudio_t) + +auth_use_nsswitch(pulseaudio_t) + +logging_send_syslog_msg(pulseaudio_t) + +miscfiles_read_localization(pulseaudio_t) + +optional_policy(` + gnome_manage_config(pulseaudio_t) +') + +optional_policy(` + dbus_system_bus_client(pulseaudio_t) + dbus_session_bus_client(pulseaudio_t) + + optional_policy(` + consolekit_dbus_chat(pulseaudio_t) + ') + + optional_policy(` + hal_dbus_chat(pulseaudio_t) + ') +') + +optional_policy(` + policykit_domtrans_auth(pulseaudio_t) + policykit_read_lib(pulseaudio_t) + policykit_read_reload(pulseaudio_t) +') + +optional_policy(` + udev_read_db(pulseaudio_t) +') + +optional_policy(` + xserver_read_xdm_pid(pulseaudio_t) + xserver_manage_xdm_tmp_files(pulseaudio_t) + xserver_read_xdm_lib_files(pulseaudio_t) +') + diff --git a/policy/modules/kernel/corenetwork.te.in b/policy/modules/kernel/corenetwork.te.in index 4b1ad9d2b..b470501d1 100644 --- a/policy/modules/kernel/corenetwork.te.in +++ b/policy/modules/kernel/corenetwork.te.in @@ -168,6 +168,7 @@ network_port(router, udp,520,s0, udp,521,s0, tcp,521,s0) network_port(rsh, tcp,514,s0) network_port(rsync, tcp,873,s0, udp,873,s0) network_port(rwho, udp,513,s0) +network_port(sap, tcp,9875,s0, udp,9875,s0) network_port(smbd, tcp,137-139,s0, tcp,445,s0) network_port(smtp, tcp,25,s0, tcp,465,s0, tcp,587,s0) network_port(snmp, udp,161,s0, udp,162,s0, tcp,199,s0)