nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #647 from gtrentalancia/x_fixes_pr

Browse Source 
Stricter yet more customizable xserver policy and three security bug fixes
This commit is contained in:
Chris PeBenito 2023-09-12 15:01:23 -04:00 committed by GitHub
commit d1759b92cb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 38 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
policy/modules/services/xserver.if
View File

@ -44,8 +44,6 @@ template(`xserver_restricted_role',`
allow xserver_t $2:process signal;
allow xserver_t $2:shm rw_shm_perms;
allow $2 user_fonts_t:dir list_dir_perms;
allow $2 user_fonts_t:file read_file_perms;
@ -125,8 +123,12 @@ template(`xserver_restricted_role',`
# Client write xserver shm
tunable_policy(`allow_write_xshm',`
allow $2 xserver_t:shm rw_shm_perms;
')
tunable_policy(`allow_write_xshm || xserver_client_writes_xserver_tmpfs',`
allow $2 xserver_tmpfs_t:file rw_file_perms;
')
tunable_policy(`xserver_allow_dri',`
dev_rw_dri($2)
')
@ -175,8 +177,14 @@ template(`xserver_role',`
xserver_restricted_role($1, $2, $3, $4)
# Communicate via System V shared memory.
allow $2 xserver_t:shm rw_shm_perms;
allow $2 xserver_tmpfs_t:file rw_file_perms;
tunable_policy(`allow_write_xshm',`
# Communicate via System V shared memory.
allow $2 xserver_t:shm rw_shm_perms;
')
tunable_policy(`allow_write_xshm || xserver_client_writes_xserver_tmpfs',`
allow $2 xserver_tmpfs_t:file rw_file_perms;
')
# XCB Event Queue: used by the Qt library for example
allow $2 xserver_tmp_t:file rw_file_perms;
@ -266,8 +274,8 @@ interface(`xserver_ro_session',`
#######################################
## <summary>
## Create sessions on the X server, with read and write
## access to the X server shared
## memory segments.
## access to the X server shared memory segments, but
## do not bypass existing tunable policy logic.
## </summary>
## <param name="domain">
## <summary>
@ -286,8 +294,14 @@ interface(`xserver_rw_session',`
')
xserver_ro_session($1,$2)
allow $1 xserver_t:shm rw_shm_perms;
allow $1 xserver_tmpfs_t:file rw_file_perms;
tunable_policy(`allow_write_xshm',`
allow $1 xserver_t:shm rw_shm_perms;
')
tunable_policy(`allow_write_xshm || xserver_client_writes_xserver_tmpfs',`
allow $1 xserver_tmpfs_t:file rw_file_perms;
')
')
#######################################
@ -482,6 +496,9 @@ template(`xserver_user_x_domain_template',`
# Client write xserver shm
tunable_policy(`allow_write_xshm',`
allow $2 xserver_t:shm rw_shm_perms;
')
tunable_policy(`allow_write_xshm || xserver_client_writes_xserver_tmpfs',`
allow $2 xserver_tmpfs_t:file rw_file_perms;
')
')
@ -1463,7 +1480,9 @@ interface(`xserver_rw_shm',`
type xserver_t;
')
allow $1 xserver_t:shm rw_shm_perms;
tunable_policy(`allow_write_xshm',`
allow $1 xserver_t:shm rw_shm_perms;
')
')
########################################

12
policy/modules/services/xserver.te
View File

@ -25,6 +25,13 @@ gen_require(`
# Declarations
#
## <desc>
## <p>
## Allow xdm logins as sysadm
## </p>
## </desc>
gen_tunable(xdm_sysadm_login, false)
## <desc>
## <p>
## Allows clients to write to the X server shared
@ -35,10 +42,11 @@ gen_tunable(allow_write_xshm, false)
## <desc>
## <p>
## Allow xdm logins as sysadm
## Allows clients to write to the X server tmpfs
## files.
## </p>
## </desc>
gen_tunable(xdm_sysadm_login, false)
gen_tunable(xserver_client_writes_xserver_tmpfs, false)
## <desc>
## <p>