d76d9e13b1
The dangerous execheap permission is removed from xdm and the dangerous execmem permission is only enabled for the Gnome Display Manager (gnome-shell running in gdm mode) through a new "xserver_gnome_xdm" boolean. This patch also updates the XKB libs file context with their default location (which at the moment is not compliant with FHS3 due to the fact that it allows by default to write the output from xkbcomp), adds the ability to read udev pid files and finally adds a few permissions so that xconsole can run smoothly. The anomalous permission to execute XKB var library files has been removed and the old X11R6 library location has been updated so that subdirectories are also labeled as xkb_var_lib. This patch includes various improvements and bug fixes as kindly suggested in reviews made by Christopher PeBenito. Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
137 lines
6.2 KiB
Plaintext
137 lines
6.2 KiB
Plaintext
#
|
|
# HOME_DIR
|
|
#
|
|
HOME_DIR/\.dmrc -- gen_context(system_u:object_r:dmrc_home_t,s0)
|
|
HOME_DIR/\.fonts\.conf -- gen_context(system_u:object_r:user_fonts_config_t,s0)
|
|
HOME_DIR/\.fonts(/.*)? gen_context(system_u:object_r:user_fonts_t,s0)
|
|
HOME_DIR/\.fonts/auto(/.*)? gen_context(system_u:object_r:user_fonts_cache_t,s0)
|
|
HOME_DIR/\.fonts\.cache-.* -- gen_context(system_u:object_r:user_fonts_cache_t,s0)
|
|
HOME_DIR/\.ICEauthority.* -- gen_context(system_u:object_r:iceauth_home_t,s0)
|
|
HOME_DIR/\.serverauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
|
HOME_DIR/\.xauth.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
|
HOME_DIR/\.xsession-errors -- gen_context(system_u:object_r:xsession_log_t,s0)
|
|
HOME_DIR/\.Xauthority.* -- gen_context(system_u:object_r:xauth_home_t,s0)
|
|
|
|
#
|
|
# /dev
|
|
#
|
|
/dev/xconsole -p gen_context(system_u:object_r:xconsole_device_t,s0)
|
|
|
|
#
|
|
# /etc
|
|
#
|
|
/etc/gdm(3)?/PostSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/gdm(3)?/PreSession/.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/gdm(3)?/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
|
|
/etc/lightdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
|
|
/etc/kde[34]?/kdm/Xstartup -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/kde[34]?/kdm/Xreset -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/kde[34]?/kdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/kde[34]?/kdm/backgroundrc gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
|
|
/etc/rc\.d/init\.d/x11-common -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
|
|
/etc/X11/[wx]dm/Xreset.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
|
|
/etc/X11/wdm/Xsetup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
/etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
|
|
#
|
|
# /opt
|
|
#
|
|
|
|
/opt/kde3/bin/kdm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
|
|
#
|
|
# /tmp
|
|
#
|
|
|
|
/tmp/\.ICE-unix -d gen_context(system_u:object_r:xdm_tmp_t,s0)
|
|
/tmp/\.ICE-unix/.* -s <<none>>
|
|
/tmp/\.X0-lock -- gen_context(system_u:object_r:xserver_tmp_t,s0)
|
|
/tmp/\.X11-unix -d gen_context(system_u:object_r:xdm_tmp_t,s0)
|
|
/tmp/\.X11-unix/.* -s <<none>>
|
|
/tmp/xses-%{USERNAME} -- gen_context(system_u:object_r:xsession_log_t,s0)
|
|
|
|
#
|
|
# /usr
|
|
#
|
|
|
|
/usr/s?bin/gdm(3)? -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/s?bin/gdm-binary -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/s?bin/lxdm(-binary)? -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/s?bin/[xkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
|
|
/usr/bin/slim -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/bin/Xair -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
|
|
/usr/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
|
|
/usr/lib/qt-.*/etc/settings(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/usr/lib/xorg/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/lib/xorg/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/lib/xorg-server/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/lib/xorg-server/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/lib/X11/xdm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
|
|
|
|
/usr/sbin/lightdm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
|
|
# xserver default configure bug: not FHS-compliant because not read-only !
|
|
/usr/share/X11/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
|
|
/usr/X11R6/bin/[xgkw]dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
|
|
/usr/X11R6/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
|
|
/usr/X11R6/bin/X -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/X11R6/bin/xauth -- gen_context(system_u:object_r:xauth_exec_t,s0)
|
|
/usr/X11R6/bin/XFree86 -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/X11R6/bin/Xipaq -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/X11R6/bin/Xorg -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/X11R6/bin/Xwrapper -- gen_context(system_u:object_r:xserver_exec_t,s0)
|
|
/usr/X11R6/lib/X11/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
|
|
ifndef(`distro_debian',`
|
|
/usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
|
|
')
|
|
|
|
#
|
|
# /var
|
|
#
|
|
|
|
/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
|
|
|
|
/var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
|
|
/var/lib/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/lib/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/lib/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/lib/[xkw]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
/var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
|
|
|
|
/var/log/[kwx]dm\.log.* -- gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/lightdm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/lxdm\.log -- gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/gdm(3)?(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/slim\.log -- gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/XFree86.* -- gen_context(system_u:object_r:xserver_log_t,s0)
|
|
/var/log/Xorg.* -- gen_context(system_u:object_r:xserver_log_t,s0)
|
|
|
|
/run/gdm(3)?(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/gdm(3)?\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/xdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/lxdm\.auth -- gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/lxdm\.pid -- gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/lxdm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/slim.* gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
|
|
|
|
ifdef(`distro_suse',`
|
|
/var/lib/pam_devperm/:0 -- gen_context(system_u:object_r:xdm_var_lib_t,s0)
|
|
')
|