Add colord from Fedora.

policy/modules/services/colord.fc

@@ -0,0 +1,4 @@
+/usr/libexec/colord	--	gen_context(system_u:object_r:colord_exec_t,s0)
+
+/var/lib/color(/.*)?		gen_context(system_u:object_r:colord_var_lib_t,s0)
+/var/lib/colord(/.*)?		gen_context(system_u:object_r:colord_var_lib_t,s0)

policy/modules/services/colord.if

@@ -0,0 +1,59 @@
+## <summary>GNOME color manager</summary>
+
+########################################
+## <summary>
+##	Execute a domain transition to run colord.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`colord_domtrans',`
+	gen_require(`
+		type colord_t, colord_exec_t;
+	')
+
+	domtrans_pattern($1, colord_exec_t, colord_t)
+')
+
+########################################
+## <summary>
+##	Send and receive messages from
+##	colord over dbus.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`colord_dbus_chat',`
+	gen_require(`
+		type colord_t;
+		class dbus send_msg;
+	')
+
+	allow $1 colord_t:dbus send_msg;
+	allow colord_t $1:dbus send_msg;
+')
+
+######################################
+## <summary>
+##	Read colord lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`colord_read_lib_files',`
+	gen_require(`
+		type colord_var_lib_t;
+	')
+
+	files_search_var_lib($1)
+	read_files_pattern($1, colord_var_lib_t, colord_var_lib_t)
+')

policy/modules/services/colord.te

@@ -0,0 +1,100 @@
+policy_module(colord, 1.0.0)
+
+########################################
+#
+# Declarations
+#
+
+type colord_t;
+type colord_exec_t;
+dbus_system_domain(colord_t, colord_exec_t)
+
+type colord_tmp_t;
+files_tmp_file(colord_tmp_t)
+
+type colord_tmpfs_t;
+files_tmpfs_file(colord_tmpfs_t)
+
+type colord_var_lib_t;
+files_type(colord_var_lib_t)
+
+########################################
+#
+# colord local policy
+#
+allow colord_t self:capability { dac_read_search dac_override };
+allow colord_t self:process signal;
+allow colord_t self:fifo_file rw_fifo_file_perms;
+allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
+allow colord_t self:udp_socket create_socket_perms;
+allow colord_t self:unix_dgram_socket create_socket_perms;
+
+manage_dirs_pattern(colord_t, colord_tmp_t, colord_tmp_t)
+manage_files_pattern(colord_t, colord_tmp_t, colord_tmp_t)
+files_tmp_filetrans(colord_t, colord_tmp_t, { file dir })
+
+manage_dirs_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
+manage_files_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
+fs_tmpfs_filetrans(colord_t, colord_tmpfs_t, { dir file })
+
+manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
+manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
+files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
+
+kernel_getattr_proc_files(colord_t)
+kernel_read_device_sysctls(colord_t)
+
+corenet_all_recvfrom_unlabeled(colord_t)
+corenet_all_recvfrom_netlabel(colord_t)
+corenet_udp_bind_generic_node(colord_t)
+corenet_udp_bind_ipp_port(colord_t)
+corenet_tcp_connect_ipp_port(colord_t)
+
+dev_read_video_dev(colord_t)
+dev_write_video_dev(colord_t)
+dev_rw_printer(colord_t)
+dev_read_rand(colord_t)
+dev_read_sysfs(colord_t)
+dev_read_urand(colord_t)
+dev_list_sysfs(colord_t)
+dev_rw_generic_usb_dev(colord_t)
+
+domain_use_interactive_fds(colord_t)
+
+files_list_mnt(colord_t)
+files_read_etc_files(colord_t)
+files_read_usr_files(colord_t)
+
+fs_read_noxattr_fs_files(colord_t)
+
+logging_send_syslog_msg(colord_t)
+
+miscfiles_read_localization(colord_t)
+
+sysnet_dns_name_resolve(colord_t)
+
+tunable_policy(`use_nfs_home_dirs',`
+	fs_read_nfs_files(colord_t)
+')
+
+tunable_policy(`use_samba_home_dirs',`
+	fs_read_cifs_files(colord_t)
+')
+
+optional_policy(`
+	cups_read_config(colord_t)
+	cups_read_rw_config(colord_t)
+	cups_stream_connect(colord_t)
+	cups_dbus_chat(colord_t)
+')
+
+optional_policy(`
+	policykit_dbus_chat(colord_t)
+	policykit_domtrans_auth(colord_t)
+	policykit_read_lib(colord_t)
+	policykit_read_reload(colord_t)
+')
+
+optional_policy(`
+	udev_read_db(colord_t)
+')