policy/modules/services/colord.te

   1 policy_module(colord, 1.0.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type colord_t;
   9 type colord_exec_t;
  10 dbus_system_domain(colord_t, colord_exec_t)
  11
  12 type colord_tmp_t;
  13 files_tmp_file(colord_tmp_t)
  14
  15 type colord_tmpfs_t;
  16 files_tmpfs_file(colord_tmpfs_t)
  17
  18 type colord_var_lib_t;
  19 files_type(colord_var_lib_t)
  20
  21 ########################################
  22 #
  23 # colord local policy
  24 #
  25 allow colord_t self:capability { dac_read_search dac_override };
  26 dontaudit colord_t self:capability sys_admin;
  27 allow colord_t self:process signal;
  28 allow colord_t self:fifo_file rw_fifo_file_perms;
  29 allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
  30 allow colord_t self:tcp_socket create_stream_socket_perms;
  31 allow colord_t self:udp_socket create_socket_perms;
  32 allow colord_t self:unix_dgram_socket create_socket_perms;
  33
  34 manage_dirs_pattern(colord_t, colord_tmp_t, colord_tmp_t)
  35 manage_files_pattern(colord_t, colord_tmp_t, colord_tmp_t)
  36 files_tmp_filetrans(colord_t, colord_tmp_t, { file dir })
  37
  38 manage_dirs_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
  39 manage_files_pattern(colord_t, colord_tmpfs_t, colord_tmpfs_t)
  40 fs_tmpfs_filetrans(colord_t, colord_tmpfs_t, { dir file })
  41
  42 manage_dirs_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
  43 manage_files_pattern(colord_t, colord_var_lib_t, colord_var_lib_t)
  44 files_var_lib_filetrans(colord_t, colord_var_lib_t, { file dir })
  45
  46 kernel_read_network_state(colord_t)
  47 kernel_read_system_state(colord_t)
  48 kernel_read_device_sysctls(colord_t)
  49 kernel_request_load_module(colord_t)
  50
  51 # reads *.ini files
  52 corecmd_exec_bin(colord_t)
  53 corecmd_exec_shell(colord_t)
  54
  55 corenet_all_recvfrom_unlabeled(colord_t)
  56 corenet_all_recvfrom_netlabel(colord_t)
  57 corenet_udp_bind_generic_node(colord_t)
  58 corenet_udp_bind_ipp_port(colord_t)
  59 corenet_tcp_connect_ipp_port(colord_t)
  60
  61 dev_read_raw_memory(colord_t)
  62 dev_write_raw_memory(colord_t)
  63 dev_read_video_dev(colord_t)
  64 dev_write_video_dev(colord_t)
  65 dev_rw_printer(colord_t)
  66 dev_read_rand(colord_t)
  67 dev_read_sysfs(colord_t)
  68 dev_read_urand(colord_t)
  69 dev_list_sysfs(colord_t)
  70 dev_rw_generic_usb_dev(colord_t)
  71
  72 domain_use_interactive_fds(colord_t)
  73
  74 files_list_mnt(colord_t)
  75 files_read_etc_files(colord_t)
  76 files_read_usr_files(colord_t)
  77
  78 fs_search_all(colord_t)
  79 fs_getattr_noxattr_fs(colord_t)
  80 fs_dontaudit_getattr_all_fs(colord_t)
  81 fs_list_noxattr_fs(colord_t)
  82 fs_read_noxattr_fs_files(colord_t)
  83
  84 storage_getattr_fixed_disk_dev(colord_t)
  85 storage_getattr_removable_dev(colord_t)
  86 storage_read_scsi_generic(colord_t)
  87 storage_write_scsi_generic(colord_t)
  88
  89 logging_send_syslog_msg(colord_t)
  90
  91 miscfiles_read_localization(colord_t)
  92
  93 fs_getattr_tmpfs(colord_t)
  94 userdom_rw_user_tmpfs_files(colord_t)
  95
  96 userdom_home_reader(colord_t)
  97
  98 tunable_policy(`use_nfs_home_dirs',`
  99         fs_getattr_nfs(colord_t)
 100         fs_read_nfs_files(colord_t)
 101 ')
 102
 103 tunable_policy(`use_samba_home_dirs',`
 104         fs_getattr_cifs(colord_t)
 105         fs_read_cifs_files(colord_t)
 106 ')
 107
 108 optional_policy(`
 109         cups_read_config(colord_t)
 110         cups_read_rw_config(colord_t)
 111         cups_stream_connect(colord_t)
 112         cups_dbus_chat(colord_t)
 113 ')
 114
 115 optional_policy(`
 116         policykit_dbus_chat(colord_t)
 117         policykit_domtrans_auth(colord_t)
 118         policykit_read_lib(colord_t)
 119         policykit_read_reload(colord_t)
 120 ')
 121
 122 optional_policy(`
 123         sysnet_exec_ifconfig(colord_t)
 124         sysnet_dns_name_resolve(colord_t)
 125 ')
 126
 127 optional_policy(`
 128         udev_read_db(colord_t)
 129 ')
 130
 131 optional_policy(`
 132         xserver_dbus_chat_xdm(colord_t)
 133         # /var/lib/gdm/.local/share/icc/edid-0a027915105823af34f99b1704e80336.icc
 134         xserver_read_inherited_xdm_lib_files(colord_t)
 135 ')