nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gnome, roles: use user exec domain attribute

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2021-08-08 11:52:11 -04:00
parent d5246d98aa
commit 7cd14e0c49
5 changed files with 40 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
policy/modules/apps/gnome.if
View File

@ -6,18 +6,23 @@
## </summary>
## <param name="role_prefix">
## <summary>
## The prefix of the user domain (e.g., user
## is the prefix for user_t).
## </summary>
## </param>
## <param name="user_role">
## <summary>
## The role associated with the user domain.
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## The type of the user domain.
## User domain for the role.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access
## </summary>
## </param>
#
@ -35,7 +40,7 @@ template(`gnome_role_template',`
# Gconf declarations
#
roleattribute $2 gconfd_roles;
roleattribute $4 gconfd_roles;
########################################
#
@ -46,7 +51,7 @@ template(`gnome_role_template',`
userdom_user_application_domain($1_gkeyringd_t, gkeyringd_exec_t)
domain_user_exemption_target($1_gkeyringd_t)
role $2 types $1_gkeyringd_t;
role $4 types $1_gkeyringd_t;
########################################
#
@ -55,14 +60,18 @@ template(`gnome_role_template',`
domtrans_pattern($3, gconfd_exec_t, gconfd_t)
allow $3 { gconf_home_t gconf_tmp_t }:dir { manage_dir_perms relabel_dir_perms };
allow $3 { gconf_home_t gconf_tmp_t }:file { manage_file_perms relabel_file_perms };
userdom_user_home_dir_filetrans($3, gconf_home_t, dir, ".gconf")
userdom_user_home_dir_filetrans($3, gconf_home_t, dir, ".gconfd")
allow $2 { gconf_home_t gconf_tmp_t }:dir { manage_dir_perms relabel_dir_perms };
allow $2 { gconf_home_t gconf_tmp_t }:file { manage_file_perms relabel_file_perms };
userdom_user_home_dir_filetrans($2, gconf_home_t, dir, ".gconf")
userdom_user_home_dir_filetrans($2, gconf_home_t, dir, ".gconfd")
allow $3 gconfd_t:process { ptrace signal_perms };
ps_process_pattern($3, gconfd_t)
optional_policy(`
systemd_user_app_status($1, gconfd_t)
')
########################################
#
# Gkeyringd policy
@ -70,22 +79,22 @@ template(`gnome_role_template',`
domtrans_pattern($3, gkeyringd_exec_t, $1_gkeyringd_t)
allow $3 { gnome_home_t gnome_keyring_home_t gnome_keyring_tmp_t }:dir { relabel_dir_perms manage_dir_perms };
allow $3 { gnome_home_t gnome_keyring_home_t }:file { relabel_file_perms manage_file_perms };
allow $2 { gnome_home_t gnome_keyring_home_t gnome_keyring_tmp_t }:dir { relabel_dir_perms manage_dir_perms };
allow $2 { gnome_home_t gnome_keyring_home_t }:file { relabel_file_perms manage_file_perms };
userdom_user_home_dir_filetrans($3, gnome_home_t, dir, ".gnome")
userdom_user_home_dir_filetrans($3, gnome_home_t, dir, ".gnome2")
userdom_user_home_dir_filetrans($3, gnome_home_t, dir, ".gnome2_private")
userdom_user_home_dir_filetrans($2, gnome_home_t, dir, ".gnome")
userdom_user_home_dir_filetrans($2, gnome_home_t, dir, ".gnome2")
userdom_user_home_dir_filetrans($2, gnome_home_t, dir, ".gnome2_private")
gnome_home_filetrans($3, gnome_keyring_home_t, dir, "keyrings")
gnome_home_filetrans($2, gnome_keyring_home_t, dir, "keyrings")
allow $3 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms };
allow $2 gnome_keyring_tmp_t:sock_file { relabel_sock_file_perms manage_sock_file_perms };
ps_process_pattern($3, $1_gkeyringd_t)
allow $3 $1_gkeyringd_t:process { ptrace signal_perms };
corecmd_bin_domtrans($1_gkeyringd_t, $3)
corecmd_shell_domtrans($1_gkeyringd_t, $3)
corecmd_bin_domtrans($1_gkeyringd_t, $2)
corecmd_shell_domtrans($1_gkeyringd_t, $2)
gnome_stream_connect_gkeyringd($1, $3)
@ -106,6 +115,10 @@ template(`gnome_role_template',`
wm_dbus_chat($1, $1_gkeyringd_t)
')
')
optional_policy(`
systemd_user_app_status($1, $1_gkeyringd_t)
')
')
########################################

2
policy/modules/roles/staff.te
View File

@ -111,7 +111,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
gnome_role_template(staff, staff_r, staff_t)
gnome_role_template(staff, staff_t, staff_application_exec_domain, staff_r)
')
optional_policy(`

2
policy/modules/roles/sysadm.te
View File

@ -1242,7 +1242,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
gnome_role_template(sysadm, sysadm_r, sysadm_t)
gnome_role_template(sysadm, sysadm_t, sysadm_application_exec_domain, sysadm_r)
')
optional_policy(`

2
policy/modules/roles/unprivuser.te
View File

@ -75,7 +75,7 @@ ifndef(`distro_redhat',`
')
optional_policy(`
gnome_role_template(user, user_r, user_t)
gnome_role_template(user, user_t, user_application_exec_domain, user_r)
')
optional_policy(`

2
policy/modules/system/userdomain.if
View File

@ -1133,7 +1133,7 @@ template(`userdom_restricted_xwindows_user_template',`
')
optional_policy(`
gnome_role_template($1, $1_r, $1_t)
gnome_role_template($1, $1_t, $1_application_exec_domain, $1_r)
')
optional_policy(`