Nicolas Iooss 59e00c5580 Label Xorg server binary correctly on Arch Linux ... On Arch Linux, /usr/bin/Xorg is only a shell script which executes /usr/lib/xorg-server/Xorg.wrap, which is a SUID binary wrapper around /usr/lib/xorg-server/Xorg. Even though Xorg.wrap is not a full X server, it reads X11 configuration files, uses the DRM interface to detect KMS, etc. (cf. http://cgit.freedesktop.org/xorg/xserver/tree/hw/xfree86/xorg-wrapper.c?id=xorg-server-1.18.0 for more details). Therefore label it as xserver_exec_t. This makes the following AVC appear: denied { execute_no_trans } for pid=927 comm="X" path="/usr/lib/xorg-server/Xorg.wrap" dev="dm-0" ino=3152592 scontext=system_u:system_r:xserver_t tcontext=system_u:object_r:xserver_exec_t tclass=file Allow /usr/bin/Xorg to execute Xorg.wrap with a can_exec statement.		2016-01-05 13:22:52 -05:00
..
metadata.xml	…
postgresql.fc	Also apply the new postgres labeling scheme on Debian	2014-08-20 14:36:13 -04:00
postgresql.if	Add systemd units for core refpolicy services.	2015-10-23 10:17:46 -04:00
postgresql.te	Bump module versions for release.	2015-12-08 09:53:02 -05:00
ssh.fc	Add fcontext for sshd pidfile and directory used for privsep	2014-02-06 09:14:31 -05:00
ssh.if	Allow ssh-agent to send signals to itself	2015-07-20 09:57:35 -04:00
ssh.te	Bump module versions for release.	2015-12-08 09:53:02 -05:00
xserver.fc	Label Xorg server binary correctly on Arch Linux	2016-01-05 13:22:52 -05:00
xserver.if	Rename new xserver interfaces.	2012-10-19 08:52:58 -04:00
xserver.te	Label Xorg server binary correctly on Arch Linux	2016-01-05 13:22:52 -05:00