policy/modules/apps/thumb.te

   1 policy_module(thumb, 1.0.0)
   2
   3 ########################################
   4 #
   5 # Declarations
   6 #
   7
   8 type thumb_t;
   9 type thumb_exec_t;
  10 application_domain(thumb_t, thumb_exec_t)
  11 ubac_constrained(thumb_t)
  12
  13 role system_r types thumb_t; # why is system_r needed
  14
  15 # this is for liborc: ~/orcexec.*
  16 # these should normally go to /tmp but it goes to ~ if not executable in /tmp
  17 # there is also a bug in liborc where it does to ~ by default
  18 # no longer needed orc fix available
  19 # type thumb_home_t;
  20 #userdom_user_home_content(thumb_home_t)
  21
  22 type thumb_tmp_t;
  23 files_tmp_file(thumb_tmp_t)
  24 ubac_constrained(thumb_tmp_t)
  25
  26 ########################################
  27 #
  28 # thumb local policy
  29 #
  30
  31 # execmem is for totem-video-thumbnailer
  32 allow thumb_t self:process { setsched signal setrlimit execmem };
  33
  34 allow thumb_t self:fifo_file manage_fifo_file_perms;
  35 allow thumb_t self:unix_stream_socket create_stream_socket_perms;
  36
  37 # please reproduce this, because i cannot
  38 # manage_dirs_pattern(thumb_t, thumb_home_t, thumb_home_t)
  39 # userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, dir)
  40
  41 # for totem-video-thumbnailer
  42 allow thumb_t self:netlink_route_socket r_netlink_socket_perms;
  43 allow thumb_t self:udp_socket create_socket_perms;
  44 allow thumb_t self:tcp_socket create_socket_perms;
  45
  46 # gst-plugin-scanner/liborc, ~/orcexec.*
  47 # no longer need fix in latest orc package
  48 # exec_files_pattern(thumb_t, thumb_home_t, thumb_home_t)
  49 # manage_files_pattern(thumb_t, thumb_home_t, thumb_home_t)
  50 # userdom_user_home_dir_filetrans(thumb_t, thumb_home_t, file)
  51
  52 manage_files_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t)
  53 manage_dirs_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t)
  54 exec_files_pattern(thumb_t, thumb_tmp_t, thumb_tmp_t)
  55 # please reproduce this, because it cannot
  56 # userdom_user_tmp_filetrans(thumb_t, thumb_tmp_t, file)
  57 files_tmp_filetrans(thumb_t, thumb_tmp_t, { file dir })
  58
  59 kernel_read_system_state(thumb_t)
  60
  61 domain_use_interactive_fds(thumb_t)
  62
  63 # /usr/libexec/gstreamer.*/gst-plugin-scanner
  64 corecmd_exec_bin(thumb_t)
  65
  66 # gst-plugin-scanner
  67 dev_read_sysfs(thumb_t)
  68
  69 domain_use_interactive_fds(thumb_t)
  70
  71 files_read_etc_files(thumb_t)
  72 files_read_usr_files(thumb_t)
  73
  74 miscfiles_read_fonts(thumb_t)
  75 miscfiles_read_localization(thumb_t)
  76
  77 # totem-video-thumbnailer
  78 sysnet_read_config(thumb_t)
  79
  80 # read files to be thumbed
  81 userdom_read_user_tmp_files(thumb_t)
  82 userdom_read_user_home_content_files(thumb_t)
  83 # .gnome_desktop_thumbnail.* is created by something in the user domain.
  84 # probably libgnome.
  85 userdom_write_user_tmp_files(thumb_t)
  86
  87 userdom_use_inherited_user_ptys(thumb_t)
  88
  89 optional_policy(`
  90         dbus_dontaudit_session_bus_connect(thumb_t)
  91 ')
  92
  93 # optional_policy(`
  94 #       gnome_read_gconf_home_files(thumb_t)
  95 #       gnome_read_gstreamer_home_content(thumb_t)
  96 # ')
  97
  98 # please reproduce this, because i cannot
  99 # optional_policy(`
 100 #       gnome_read_gconf_home_files(thumb_t)
 101 # ')
 102
 103 # these two are inherited
 104 # should probably create and call xserver_ra_inherited_xdm_home_files()
 105 xserver_read_xdm_home_files(thumb_t)
 106 xserver_append_xdm_home_files(thumb_t)
 107 # seems to not be needed
 108 xserver_dontaudit_read_xdm_pid(thumb_t)
 109 # this is required for totem-video-thumbnailer
 110 # although thumb does not need to write xserver_tmp_t sock_files
 111 # we probably want a xserver_connect to support but unix stream socket
 112 # connections as well tcp connections
 113 # allow thumb_t xserver_port_t:tcp_socket name_connect;
 114 xserver_stream_connect(thumb_t)
 115
 116 optional_policy(`
 117         # This seems not strictly needed
 118         dbus_dontaudit_stream_connect_session_bus(thumb_t)
 119 ')
 120
 121 optional_policy(`
 122         # this seems to work
 123         # thumb_t tries to search data_home_t, config_home_t and gconf_home_t
 124         gnome_dontaudit_search_config(thumb_t)
 125         # totem-video-thumbnailer
 126         gnome_manage_gstreamer_home_files(thumb_t)
 127 ')