Multiple fixes to stop telepathy domains from being transitioned to from unconfined_t...

diff --git a/policy/modules/apps/gnome.if b/policy/modules/apps/gnome.if
index 3ca01ecc9cf651684fcef9c1e98d6d534aaa73f3..c9f63b0a1d8f88d1a60aad2084ccb2b158c18aa1 100644 (file)
--- a/policy/modules/apps/gnome.if
+++ b/policy/modules/apps/gnome.if
@@ -98,7 +98,7 @@ interface(`gnome_role_gkeyringd',`
        allow $1_gkeyringd_t $3:dbus send_msg;
        allow $3 $1_gkeyringd_t:dbus send_msg;
        optional_policy(`
-               dbus_session_domain($1_gkeyringd_t, gkeyringd_exec_t)
+               dbus_session_domain($1, gkeyringd_exec_t, $1_gkeyringd_t)
                dbus_session_bus_client($1_gkeyringd_t)
                gnome_home_dir_filetrans($1_gkeyringd_t)
                gnome_manage_generic_home_dirs($1_gkeyringd_t)

diff --git a/policy/modules/apps/telepathy.if b/policy/modules/apps/telepathy.if
index 6878d689b692ac9e1dfb2cda09d76861175bb010..f6acf24951b0f5fc18f342cefd5ece0f8b53baf6 100644 (file)
--- a/policy/modules/apps/telepathy.if
+++ b/policy/modules/apps/telepathy.if
@@ -28,8 +28,6 @@ template(`telepathy_domain_template',`
        type telepathy_$1_tmp_t;
        files_tmp_file(telepathy_$1_tmp_t)
        ubac_constrained(telepathy_$1_tmp_t)
-
-       dbus_session_domain(telepathy_$1_t, telepathy_$1_exec_t)
 ')
 
 #######################################

diff --git a/policy/modules/roles/staff.te b/policy/modules/roles/staff.te
index ddb6f0a8602a991a9e7d2ebf4cd630ed2ad50b04..16635325bec3199cccbf54e718d8d1b0c45aeead 100644 (file)
--- a/policy/modules/roles/staff.te
+++ b/policy/modules/roles/staff.te
@@ -84,7 +84,6 @@ optional_policy(`
 
 optional_policy(`
        gnome_role(staff_r, staff_t)
-       gnome_role_gkeyringd(staff, staff_r, staff_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/roles/unprivuser.te b/policy/modules/roles/unprivuser.te
index dc6b88fe1e4a5fc58693afc92ce6a10807db7481..425ea6f11db35db3c931b7bced82d87cd42409e2 100644 (file)
--- a/policy/modules/roles/unprivuser.te
+++ b/policy/modules/roles/unprivuser.te
@@ -35,7 +35,6 @@ optional_policy(`
 
 optional_policy(`
        gnome_role(user_r, user_t)
-
 ')
 
 optional_policy(`
@@ -76,9 +75,9 @@ optional_policy(`
        setroubleshoot_dontaudit_stream_connect(user_t)
 ')
 
-optional_policy(`
-       telepathy_dbus_session_role(user_r, user_t)
-')
+#optional_policy(`
+#      telepathy_dbus_session_role(user_r, user_t)
+#')
 
 optional_policy(`
        vlock_run(user_t, user_r)

diff --git a/policy/modules/services/colord.te b/policy/modules/services/colord.te
index e79f6536fb5d06620afbb10ce28834aa6f82b472..5c1f4360a955ef161c97fab4b8819b5318e840a0 100644 (file)
--- a/policy/modules/services/colord.te
+++ b/policy/modules/services/colord.te
@@ -19,6 +19,7 @@ files_tmp_file(colord_tmp_t)
 #
 # colord local policy
 #
+allow colord_t self:process signal;
 allow colord_t self:fifo_file rw_fifo_file_perms;
 allow colord_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow colord_t self:udp_socket create_socket_perms;

diff --git a/policy/modules/services/dbus.if b/policy/modules/services/dbus.if
index 85a1dc0eb2533113a34089238d04f2afadd9a094..a0c951ec5b2198fbe00b0ea6b8540518a872d64f 100644 (file)
--- a/policy/modules/services/dbus.if
+++ b/policy/modules/services/dbus.if
@@ -377,13 +377,13 @@ interface(`dbus_connect_session_bus',`
 #
 interface(`dbus_session_domain',`
        gen_require(`
-               attribute session_bus_type;
+               type $1_dbusd_t;
        ')
 
-       domtrans_pattern(session_bus_type, $2, $1)
+       domtrans_pattern($1_dbusd_t, $2, $3)
 
-       dbus_session_bus_client($1)
-       dbus_connect_session_bus($1)
+       dbus_session_bus_client($3)
+       dbus_connect_session_bus($3)
 ')
 
 ########################################