refpolicy/policy/modules/services/xserver.if

   1 ## <summary>X Windows Server</summary>
   2
   3 #######################################
   4 ## <summary>
   5 ##      Template to create types and rules common to
   6 ##      all X server domains.
   7 ## </summary>
   8 ## <param name="prefix">
   9 ##      <summary>
  10 ##      The prefix of the domain (e.g., user
  11 ##      is the prefix for user_t).
  12 ##      </summary>
  13 ## </param>
  14 #
  15 template(`xserver_common_domain_template',`
  16
  17         ##############################
  18         #
  19         # Declarations
  20         #
  21
  22         type $1_xserver_t;
  23         domain_type($1_xserver_t)
  24
  25         type $1_xserver_tmp_t;
  26         files_tmp_file($1_xserver_tmp_t)
  27
  28         type $1_xserver_tmpfs_t;
  29         files_tmpfs_file($1_xserver_tmpfs_t)
  30
  31         ##############################
  32         #
  33         # $1_xserver_t local policy
  34         #
  35
  36         # setuid/setgid for the wrapper program to change UID
  37         # sys_rawio is for iopl access - should not be needed for frame-buffer
  38         # sys_admin, locking shared mem?  chowning IPC message queues or semaphores?
  39         # admin of APM bios?
  40         # sys_nice is so that the X server can set a negative nice value
  41         # execheap needed until the X module loader is fixed.
  42         # NVIDIA Needs execstack
  43
  44         allow $1_xserver_t self:capability { dac_override fsetid setgid setuid ipc_owner sys_rawio sys_admin sys_nice sys_tty_config mknod net_bind_service };
  45         dontaudit $1_xserver_t self:capability chown;
  46         allow $1_xserver_t self:process ~{ ptrace setcurrent setexec setfscreate setrlimit execmem execstack execheap };
  47         allow $1_xserver_t self:process { execmem execheap execstack setsched };
  48         allow $1_xserver_t self:fd use;
  49         allow $1_xserver_t self:fifo_file rw_file_perms;
  50         allow $1_xserver_t self:sock_file r_file_perms;
  51         allow $1_xserver_t self:shm create_shm_perms;
  52         allow $1_xserver_t self:sem create_sem_perms;
  53         allow $1_xserver_t self:msgq create_msgq_perms;
  54         allow $1_xserver_t self:msg { send receive };
  55         allow $1_xserver_t self:unix_dgram_socket { create_socket_perms sendto };
  56         allow $1_xserver_t self:unix_stream_socket { create_stream_socket_perms connectto };
  57         allow $1_xserver_t self:netlink_route_socket r_netlink_socket_perms;
  58         allow $1_xserver_t self:tcp_socket create_stream_socket_perms;
  59         allow $1_xserver_t self:udp_socket create_socket_perms;
  60
  61         allow $1_xserver_t $1_xserver_tmp_t:dir manage_dir_perms;
  62         allow $1_xserver_t $1_xserver_tmp_t:file manage_file_perms;
  63         allow $1_xserver_t $1_xserver_tmp_t:sock_file manage_file_perms;
  64         files_tmp_filetrans($1_xserver_t, $1_xserver_tmp_t, { file dir sock_file })
  65
  66         allow $1_xserver_t xdm_xserver_tmp_t:dir rw_dir_perms;
  67         type_transition $1_xserver_t xdm_xserver_tmp_t:sock_file $1_xserver_tmp_t;
  68
  69         allow $1_xserver_t $1_xserver_tmpfs_t:dir manage_dir_perms;
  70         allow $1_xserver_t $1_xserver_tmpfs_t:file manage_file_perms;
  71         allow $1_xserver_t $1_xserver_tmpfs_t:lnk_file create_lnk_perms;
  72         allow $1_xserver_t $1_xserver_tmpfs_t:sock_file manage_file_perms;
  73         allow $1_xserver_t $1_xserver_tmpfs_t:fifo_file manage_file_perms;
  74         fs_tmpfs_filetrans($1_xserver_t,$1_xserver_tmpfs_t,{ dir file lnk_file sock_file fifo_file })
  75
  76         allow $1_xserver_t xkb_var_lib_t:dir rw_dir_perms;
  77         allow $1_xserver_t xkb_var_lib_t:file manage_file_perms;
  78         allow $1_xserver_t xkb_var_lib_t:lnk_file create_lnk_perms;
  79         files_search_var_lib($1_xserver_t)
  80
  81         # Create files in /var/log with the xserver_log_t type.
  82         allow $1_xserver_t xserver_log_t:file manage_file_perms;
  83         allow $1_xserver_t xserver_log_t:dir r_dir_perms;
  84         logging_log_filetrans($1_xserver_t,xserver_log_t,file)
  85
  86         kernel_read_system_state($1_xserver_t)
  87         kernel_read_device_sysctls($1_xserver_t)
  88         kernel_read_modprobe_sysctls($1_xserver_t)
  89         # Xorg wants to check if kernel is tainted
  90         kernel_read_kernel_sysctls($1_xserver_t)
  91         kernel_write_proc_files($1_xserver_t)
  92
  93         # Run helper programs in $1_xserver_t.
  94         corecmd_search_sbin($1_xserver_t)
  95         corecmd_exec_bin($1_xserver_t)
  96         corecmd_exec_shell($1_xserver_t)
  97
  98         corenet_non_ipsec_sendrecv($1_xserver_t)
  99         corenet_tcp_sendrecv_generic_if($1_xserver_t)
 100         corenet_udp_sendrecv_generic_if($1_xserver_t)
 101         corenet_raw_sendrecv_generic_if($1_xserver_t)
 102         corenet_tcp_sendrecv_all_nodes($1_xserver_t)
 103         corenet_udp_sendrecv_all_nodes($1_xserver_t)
 104         corenet_raw_sendrecv_all_nodes($1_xserver_t)
 105         corenet_tcp_sendrecv_all_ports($1_xserver_t)
 106         corenet_udp_sendrecv_all_ports($1_xserver_t)
 107         corenet_tcp_bind_all_nodes($1_xserver_t)
 108         corenet_udp_bind_all_nodes($1_xserver_t)
 109         corenet_tcp_bind_xserver_port($1_xserver_t)
 110         corenet_tcp_connect_all_ports($1_xserver_t)
 111
 112         dev_read_sysfs($1_xserver_t)
 113         dev_rw_mouse($1_xserver_t)
 114         dev_rw_mtrr($1_xserver_t)
 115         dev_rw_apm_bios($1_xserver_t)
 116         dev_rw_agp($1_xserver_t)
 117         dev_rw_framebuffer($1_xserver_t)
 118         dev_manage_dri_dev($1_xserver_t)
 119         dev_create_generic_dirs($1_xserver_t)
 120         dev_setattr_generic_dirs($1_xserver_t)
 121         # raw memory access is needed if not using the frame buffer
 122         dev_read_raw_memory($1_xserver_t)
 123         dev_write_raw_memory($1_xserver_t)
 124         # for other device nodes such as the NVidia binary-only driver
 125         dev_rw_xserver_misc($1_xserver_t)
 126         # read events - the synaptics touchpad driver reads raw events
 127         dev_rw_input_dev($1_xserver_t)
 128         dev_rwx_zero($1_xserver_t)
 129
 130         files_read_etc_files($1_xserver_t)
 131         files_read_etc_runtime_files($1_xserver_t)
 132         files_read_usr_files($1_xserver_t)
 133
 134         # brought on by rhgb
 135         files_search_mnt($1_xserver_t)
 136         # for nscd
 137         files_dontaudit_search_pids($1_xserver_t)
 138
 139         fs_getattr_xattr_fs($1_xserver_t)
 140         fs_search_nfs($1_xserver_t)
 141         fs_search_auto_mountpoints($1_xserver_t)
 142
 143         init_getpgid($1_xserver_t)
 144
 145         term_setattr_unallocated_ttys($1_xserver_t)
 146         term_use_unallocated_ttys($1_xserver_t)
 147
 148         libs_use_ld_so($1_xserver_t)
 149         libs_use_shared_libs($1_xserver_t)
 150
 151         logging_send_syslog_msg($1_xserver_t)
 152
 153         miscfiles_read_localization($1_xserver_t)
 154         miscfiles_read_fonts($1_xserver_t)
 155
 156         modutils_domtrans_insmod($1_xserver_t)
 157
 158         seutil_dontaudit_search_config($1_xserver_t)
 159
 160         sysnet_read_config($1_xserver_t)
 161
 162         optional_policy(`
 163                 auth_search_pam_console_data($1_xserver_t)
 164         ')
 165
 166         optional_policy(`
 167                 nis_use_ypbind($1_xserver_t)
 168         ')
 169
 170         optional_policy(`
 171                 nscd_socket_use($1_xserver_t)
 172         ')
 173
 174         optional_policy(`
 175                 xfs_stream_connect($1_xserver_t)
 176         ')
 177
 178         ifdef(`TODO',`
 179         ifdef(`distro_redhat',`
 180                 ifdef(`rpm.te', `
 181                         allow $1_xserver_t rpm_t:shm { unix_read unix_write read write associate getattr };
 182                         allow $1_xserver_t rpm_tmpfs_t:file { read write };
 183                         rpm_use_fds($1_xserver_t)
 184                 ')
 185         ')
 186         ') dnl end TODO
 187 ')
 188
 189 #######################################
 190 ## <summary>
 191 ##      The per user domain template for the xserver module.
 192 ## </summary>
 193 ## <desc>
 194 ##      <p>
 195 ##      Define a derived domain for the X server when executed
 196 ##      by a user domain (e.g. via startx).  See the xdm module
 197 ##      if using an X Display Manager.
 198 ##      </p>
 199 ##      <p>
 200 ##      This is invoked automatically for each user and
 201 ##      generally does not need to be invoked directly
 202 ##      by policy writers.
 203 ##      </p>
 204 ## </desc>
 205 ## <param name="prefix">
 206 ##      <summary>
 207 ##      The prefix of the user domain (e.g., user
 208 ##      is the prefix for user_t).
 209 ##      </summary>
 210 ## </param>
 211 ## <param name="user_domain">
 212 ##      <summary>
 213 ##      The type of the user domain.
 214 ##      </summary>
 215 ## </param>
 216 ## <param name="user_role">
 217 ##      <summary>
 218 ##      The role associated with the user domain.
 219 ##      </summary>
 220 ## </param>
 221 #
 222 template(`xserver_per_userdomain_template',`
 223
 224         ##############################
 225         #
 226         # Declarations
 227         #
 228
 229         xserver_common_domain_template($1)
 230         role $3 types $1_xserver_t;
 231
 232         type $1_fonts_t, fonts_type;
 233         userdom_user_home_content($1,$1_fonts_t)
 234
 235         type $1_fonts_cache_t, fonts_cache_type;
 236         userdom_user_home_content($1,$1_fonts_cache_t)
 237
 238         type $1_fonts_config_t, fonts_config_type;
 239         userdom_user_home_content($1,$1_fonts_cache_t)
 240
 241         type $1_iceauth_t;
 242         domain_type($1_iceauth_t)
 243         domain_entry_file($1_iceauth_t,iceauth_exec_t)
 244         role $3 types $1_iceauth_t;
 245
 246         type $1_iceauth_home_t alias $1_iceauth_rw_t;
 247         files_poly_member($1_iceauth_home_t)
 248         userdom_user_home_content($1,$1_iceauth_home_t)
 249
 250         type $1_xauth_t;
 251         domain_type($1_xauth_t)
 252         domain_entry_file($1_xauth_t,xauth_exec_t)
 253         role $3 types $1_xauth_t;
 254
 255         type $1_xauth_home_t alias $1_xauth_rw_t;
 256         files_poly_member($1_xauth_home_t)
 257         userdom_user_home_content($1,$1_xauth_home_t)
 258
 259         type $1_xauth_tmp_t;
 260         files_tmp_file($1_xauth_tmp_t)
 261
 262         ##############################
 263         #
 264         # $1_xserver_t Local policy
 265         #
 266
 267         domain_auto_trans($1_xserver_t, xauth_exec_t, $1_xauth_t)
 268         allow $1_xserver_t $1_xauth_t:fd use;
 269         allow $1_xauth_t $1_xserver_t:fd use;
 270         allow $1_xauth_t $1_xserver_t:fifo_file rw_file_perms;
 271         allow $1_xauth_t $1_xserver_t:process sigchld;
 272
 273         allow $1_xserver_t $1_xauth_home_t:file { getattr read };
 274
 275         domain_auto_trans($2, xserver_exec_t, $1_xserver_t)
 276         allow $2 $1_xserver_t:fd use;
 277         allow $1_xserver_t $2:fd use;
 278         allow $1_xserver_t $2:fifo_file rw_file_perms;
 279         allow $1_xserver_t $2:process { signal sigchld };
 280
 281         allow $1_xserver_t $2:shm rw_shm_perms;
 282
 283         allow $2 $1_fonts_t:dir manage_dir_perms;
 284         allow $2 $1_fonts_t:file manage_file_perms;
 285         allow $2 $1_fonts_t:{ dir file } { relabelto relabelfrom };
 286
 287         allow $2 $1_fonts_config_t:dir manage_dir_perms;
 288         allow $2 $1_fonts_config_t:file manage_file_perms;
 289         allow $2 $1_fonts_config_t:file { relabelto relabelfrom };
 290
 291         # For startup relabel
 292         allow $2 $1_fonts_cache_t:{ dir file } { relabelto relabelfrom };
 293
 294         allow $2 $1_xserver_tmp_t:dir r_dir_perms;
 295         allow $2 $1_xserver_tmp_t:sock_file rw_file_perms;
 296         allow $2 $1_xserver_t:unix_stream_socket connectto;
 297
 298         allow $2 $1_xserver_tmpfs_t:file rw_file_perms;
 299
 300         # Communicate via System V shared memory.
 301         allow $1_xserver_t $2:shm rw_shm_perms;
 302         allow $2 $1_xserver_t:shm rw_shm_perms;
 303
 304         getty_use_fds($1_xserver_t)
 305
 306         locallogin_use_fds($1_xserver_t)
 307
 308         userdom_search_user_home_dirs($1,$1_xserver_t)
 309         userdom_use_user_ttys($1,$1_xserver_t)
 310         userdom_setattr_user_ttys($1,$1_xserver_t)
 311         userdom_rw_user_tmpfs_files($1,$1_xserver_t)
 312
 313         xserver_use_user_fonts($1,$1_xserver_t)
 314
 315         optional_policy(`
 316                 userhelper_search_config($1_xserver_t)
 317         ')
 318
 319         ifdef(`TODO',`
 320         allow $1_t xdm_xserver_tmp_t:dir r_dir_perms;
 321         allow $1_t xdm_xserver_t:unix_stream_socket connectto;
 322
 323         ifdef(`xdm.te', `
 324                 allow $1_t xdm_tmp_t:sock_file unlink;
 325                 allow $1_xserver_t xdm_var_run_t:dir search;
 326         ')
 327         ') dnl end TODO
 328
 329         ##############################
 330         #
 331         # $1_xauth_t Local policy
 332         #
 333
 334         allow $1_xauth_t self:process signal;
 335         allow $1_xauth_t self:unix_stream_socket create_stream_socket_perms;
 336
 337         allow $1_xauth_t $1_xauth_home_t:file manage_file_perms;
 338         userdom_user_home_dir_filetrans($1,$1_xauth_t,$1_xauth_home_t,file)
 339
 340         allow $1_xauth_t $1_xauth_tmp_t:dir create_dir_perms;
 341         allow $1_xauth_t $1_xauth_tmp_t:file create_file_perms;
 342         files_tmp_filetrans($1_xauth_t, $1_xauth_tmp_t, { file dir })
 343
 344         domain_auto_trans($2, xauth_exec_t, $1_xauth_t)
 345         allow $2 $1_xauth_t:fd use;
 346         allow $1_xauth_t $2:fd use;
 347         allow $1_xauth_t $2:fifo_file rw_file_perms;
 348         allow $1_xauth_t $2:process sigchld;
 349
 350         allow $2 $1_xauth_t:process signal;
 351
 352         # allow ps to show xauth
 353         allow $2 $1_xauth_t:dir { search getattr read };
 354         allow $2 $1_xauth_t:{ file lnk_file } { read getattr };
 355         allow $2 $1_xauth_t:process getattr;
 356         # We need to suppress this denial because procps tries to access
 357         # /proc/pid/environ and this now triggers a ptrace check in recent kernels
 358         # (2.4 and 2.6).  Might want to change procps to not do this, or only if
 359         # running in a privileged domain.
 360         dontaudit $2 $1_xauth_t:process ptrace;
 361
 362         allow $2 $1_xauth_home_t:file manage_file_perms;
 363         allow $2 $1_xauth_home_t:file { relabelfrom relabelto };
 364
 365         allow xdm_t $1_xauth_home_t:file manage_file_perms;
 366         userdom_user_home_dir_filetrans($1,xdm_t,$1_xauth_home_t,file)
 367
 368         domain_use_interactive_fds($1_xauth_t)
 369
 370         files_read_etc_files($1_xauth_t)
 371         files_search_pids($1_xauth_t)
 372
 373         fs_getattr_xattr_fs($1_xauth_t)
 374         fs_search_auto_mountpoints($1_xauth_t)
 375
 376         # cjp: why?
 377         term_use_ptmx($1_xauth_t)
 378
 379         libs_use_ld_so($1_xauth_t)
 380         libs_use_shared_libs($1_xauth_t)
 381
 382         sysnet_dns_name_resolve($1_xauth_t)
 383
 384         userdom_use_user_terminals($1,$1_xauth_t)
 385         userdom_read_user_tmp_files($1,$1_xauth_t)
 386
 387         tunable_policy(`use_nfs_home_dirs',`
 388                 fs_manage_nfs_files($1_xauth_t)
 389         ')
 390
 391         tunable_policy(`use_samba_home_dirs',`
 392                 fs_manage_cifs_files($1_xauth_t)
 393         ')
 394
 395         optional_policy(`
 396                 nis_use_ypbind($1_xauth_t)
 397         ')
 398
 399         optional_policy(`
 400                 ssh_sigchld($1_xauth_t)
 401                 ssh_read_pipes($1_xauth_t)
 402                 ssh_dontaudit_rw_tcp_sockets($1_xauth_t)
 403         ')
 404
 405         ##############################
 406         #
 407         # $1_iceauth_t Local policy
 408         #
 409
 410         domain_auto_trans($2, iceauth_exec_t, $1_iceauth_t)
 411         allow $2 $1_iceauth_t:fd use;
 412         allow $1_iceauth_t $2:fd use;
 413         allow $1_iceauth_t $2:fifo_file rw_file_perms;
 414         allow $1_iceauth_t $2:process sigchld;
 415
 416         allow $1_iceauth_t $1_iceauth_home_t:file manage_file_perms;
 417         userdom_user_home_dir_filetrans($1,$1_iceauth_t,$1_iceauth_home_t,file)
 418
 419         # allow ps to show iceauth
 420         allow $2 $1_iceauth_t:dir { search getattr read };
 421         allow $2 $1_iceauth_t:{ file lnk_file } { read getattr };
 422         allow $2 $1_iceauth_t:process getattr;
 423         # We need to suppress this denial because procps tries to access
 424         # /proc/pid/environ and this now triggers a ptrace check in recent kernels
 425         # (2.4 and 2.6).  Might want to change procps to not do this, or only if
 426         # running in a privileged domain.
 427         dontaudit $2 $1_iceauth_t:process ptrace;
 428
 429         allow $2 $1_iceauth_home_t:file manage_file_perms;
 430         allow $2 $1_iceauth_home_t:file { relabelfrom relabelto };
 431
 432         fs_search_auto_mountpoints($1_iceauth_t)
 433
 434         libs_use_ld_so($1_iceauth_t)
 435         libs_use_shared_libs($1_iceauth_t)
 436
 437         userdom_use_user_terminals($1,$1_iceauth_t)
 438
 439         tunable_policy(`use_nfs_home_dirs',`
 440                 fs_manage_nfs_files($1_iceauth_t)
 441         ')
 442
 443         tunable_policy(`use_samba_home_dirs',`
 444                 fs_manage_cifs_files($1_iceauth_t)
 445         ')
 446 ')
 447
 448 #######################################
 449 ## <summary>
 450 ##      Template for creating sessions on a
 451 ##      prefix X server, with read-only
 452 ##      access to the X server shared
 453 ##      memory segments.
 454 ## </summary>
 455 ## <param name="prefix">
 456 ##      <summary>
 457 ##      The prefix of the domain (e.g., user
 458 ##      is the prefix for user_t).
 459 ##      </summary>
 460 ## </param>
 461 ## <param name="domain">
 462 ##      <summary>
 463 ##      Domain allowed access.
 464 ##      </summary>
 465 ## </param>
 466 ## <param name="tmpfs_type">
 467 ##      <summary>
 468 ##      The type of the domain SYSV tmpfs files.
 469 ##      </summary>
 470 ## </param>
 471 #
 472 template(`xserver_ro_session_template',`
 473         gen_require(`
 474                 type $1_xserver_t, $1_xserver_tmp_t, $1_xserver_tmpfs_t;
 475         ')
 476
 477         # Xserver read/write client shm
 478         allow $1_xserver_t $2:fd use;
 479         allow $1_xserver_t $2:shm rw_shm_perms;
 480         allow $1_xserver_t $3:file rw_file_perms;
 481
 482         # Connect to xserver
 483         allow $2 $1_xserver_t:unix_stream_socket connectto;
 484         allow $2 $1_xserver_t:process signal;
 485
 486         # Read /tmp/.X0-lock
 487         allow $2 $1_xserver_tmp_t:file { getattr read };
 488
 489         # Client read xserver shm
 490         allow $2 $1_xserver_t:fd use;
 491         allow $2 $1_xserver_t:shm r_shm_perms;
 492         allow $2 $1_xserver_tmpfs_t:file r_file_perms;
 493 ')
 494
 495 #######################################
 496 ## <summary>
 497 ##      Template for creating sessions on a
 498 ##      prefix X server, with read and write
 499 ##      access to the X server shared
 500 ##      memory segments.
 501 ## </summary>
 502 ## <param name="prefix">
 503 ##      <summary>
 504 ##      The prefix of the domain (e.g., user
 505 ##      is the prefix for user_t).
 506 ##      </summary>
 507 ## </param>
 508 ## <param name="domain">
 509 ##      <summary>
 510 ##      Domain allowed access.
 511 ##      </summary>
 512 ## </param>
 513 ## <param name="tmpfs_type">
 514 ##      <summary>
 515 ##      The type of the domain SYSV tmpfs files.
 516 ##      </summary>
 517 ## </param>
 518 #
 519 template(`xserver_rw_session_template',`
 520         gen_require(`
 521                 type $1_xserver_t, $1_xserver_tmpfs_t;
 522         ')
 523
 524         xserver_ro_session_template($1,$2,$3)
 525         allow $2 $1_xserver_t:shm rw_shm_perms;
 526         allow $2 $1_xserver_tmpfs_t:file rw_file_perms;
 527 ')
 528
 529 #######################################
 530 ## <summary>
 531 ##      Template for creating full client sessions
 532 ##      on a user X server.
 533 ## </summary>
 534 ## <param name="prefix">
 535 ##      <summary>
 536 ##      The prefix of the domain (e.g., user
 537 ##      is the prefix for user_t).
 538 ##      </summary>
 539 ## </param>
 540 ## <param name="domain">
 541 ##      <summary>
 542 ##      Domain allowed access.
 543 ##      </summary>
 544 ## </param>
 545 ## <param name="tmpfs_type">
 546 ##      <summary>
 547 ##      The type of the domain SYSV tmpfs files.
 548 ##      </summary>
 549 ## </param>
 550 #
 551 template(`xserver_user_client_template',`
 552
 553         gen_require(`
 554                 type xdm_t, xdm_tmp_t;
 555                 type $1_xauth_home_t, $1_xserver_t, $1_xserver_tmpfs_t;
 556         ')
 557
 558         allow $2 self:shm create_shm_perms;
 559         allow $2 self:unix_dgram_socket create_socket_perms;
 560         allow $2 self:unix_stream_socket { connectto create_stream_socket_perms };
 561
 562         # Read .Xauthority file
 563         allow $2 $1_xauth_home_t:file { getattr read };
 564
 565         # for when /tmp/.X11-unix is created by the system
 566         allow $2 xdm_t:fd use;
 567         allow $2 xdm_t:fifo_file { getattr read write ioctl };
 568         allow $2 xdm_tmp_t:dir search;
 569         allow $2 xdm_tmp_t:sock_file { read write };
 570         dontaudit $2 xdm_t:tcp_socket { read write };
 571
 572         # Allow connections to X server.
 573         files_search_tmp($2)
 574
 575         miscfiles_read_fonts($2)
 576
 577         userdom_search_user_home_dirs($1,$2)
 578         # for .xsession-errors
 579         userdom_dontaudit_write_user_home_content_files($1,$2)
 580
 581         xserver_ro_session_template(xdm,$2,$3)
 582         xserver_rw_session_template($1,$2,$3)
 583         xserver_use_user_fonts($1,$2)
 584
 585         # Client write xserver shm
 586         tunable_policy(`allow_write_xshm',`
 587                 allow $2 $1_xserver_t:shm rw_shm_perms;
 588                 allow $2 $1_xserver_tmpfs_t:file rw_file_perms;
 589         ')
 590
 591         # for X over a ssh tunnel
 592         optional_policy(`
 593                 kernel_tcp_recvfrom($2)
 594                 ssh_tcp_connect($2)
 595         ')
 596 ')
 597
 598 ########################################
 599 ## <summary>
 600 ##      Read user fonts, user font configuration,
 601 ##      and manage the user font cache.
 602 ## </summary>
 603 ## <desc>
 604 ##      <p>
 605 ##      Read user fonts, user font configuration,
 606 ##      and manage the user font cache.
 607 ##      </p>
 608 ##      <p>
 609 ##      This is a templated interface, and should only
 610 ##      be called from a per-userdomain template.
 611 ##      </p>
 612 ## </desc>
 613 ## <param name="userdomain_prefix">
 614 ##      <summary>
 615 ##      The prefix of the user domain (e.g., user
 616 ##      is the prefix for user_t).
 617 ##      </summary>
 618 ## </param>
 619 ## <param name="domain">
 620 ##      <summary>
 621 ##      Domain allowed access.
 622 ##      </summary>
 623 ## </param>
 624 #
 625 template(`xserver_use_user_fonts',`
 626         gen_require(`
 627                 type $1_fonts_t, $1_fonts_cache_t, $1_fonts_config_t;
 628         ')
 629
 630         # Read per user fonts
 631         allow $2 $1_fonts_t:dir list_dir_perms;
 632         allow $2 $1_fonts_t:file read_file_perms;
 633
 634         # Manipulate the global font cache
 635         allow $2 $1_fonts_cache_t:dir manage_dir_perms;
 636         allow $2 $1_fonts_cache_t:file manage_file_perms;
 637
 638         # Read per user font config
 639         allow $2 $1_fonts_config_t:dir list_dir_perms;
 640         allow $2 $1_fonts_config_t:file read_file_perms;
 641
 642         userdom_search_user_home_dirs($1,$2)
 643 ')
 644
 645 ########################################
 646 ## <summary>
 647 ##      Transition to a user Xauthority domain.
 648 ## </summary>
 649 ## <desc>
 650 ##      <p>
 651 ##      Transition to a user Xauthority domain.
 652 ##      </p>
 653 ##      <p>
 654 ##      This is a templated interface, and should only
 655 ##      be called from a per-userdomain template.
 656 ##      </p>
 657 ## </desc>
 658 ## <param name="userdomain_prefix">
 659 ##      <summary>
 660 ##      The prefix of the user domain (e.g., user
 661 ##      is the prefix for user_t).
 662 ##      </summary>
 663 ## </param>
 664 ## <param name="domain">
 665 ##      <summary>
 666 ##      Domain allowed access.
 667 ##      </summary>
 668 ## </param>
 669 #
 670 template(`xserver_domtrans_user_xauth',`
 671         gen_require(`
 672                 type $1_xauth_t, xauth_exec_t;
 673         ')
 674
 675         domain_auto_trans($2, xauth_exec_t, $1_xauth_t)
 676         allow $2 $1_xauth_t:fd use;
 677         allow $1_xauth_t $2:fd use;
 678         allow $1_xauth_t $2:fifo_file rw_file_perms;
 679         allow $1_xauth_t $2:process sigchld;
 680 ')
 681
 682 ########################################
 683 ## <summary>
 684 ##      Read all users fonts, user font configurations,
 685 ##      and manage all users font caches.
 686 ## </summary>
 687 ## <param name="domain">
 688 ##      <summary>
 689 ##      Domain allowed access.
 690 ##      </summary>
 691 ## </param>
 692 #
 693 interface(`xserver_use_all_users_fonts',`
 694         gen_require(`
 695                 attribute fonts_type, fonts_cache_type, fonts_config_type;
 696         ')
 697
 698         # Read per user fonts
 699         allow $1 fonts_type:dir list_dir_perms;
 700         allow $1 fonts_type:file read_file_perms;
 701
 702         # Manipulate the global font cache
 703         allow $1 fonts_cache_type:dir manage_dir_perms;
 704         allow $1 fonts_cache_type:file manage_file_perms;
 705
 706         # Read per user font config
 707         allow $1 fonts_config_type:dir list_dir_perms;
 708         allow $1 fonts_config_type:file read_file_perms;
 709
 710         userdom_search_all_users_home_dirs($1)
 711 ')
 712
 713 ########################################
 714 ## <summary>
 715 ##      Set the attributes of the X windows console named pipes.
 716 ## </summary>
 717 ## <param name="domain">
 718 ##      <summary>
 719 ##      Domain allowed access.
 720 ##      </summary>
 721 ## </param>
 722 #
 723 interface(`xserver_setattr_console_pipes',`
 724         gen_require(`
 725                 type xconsole_device_t;
 726         ')
 727
 728         allow $1 xconsole_device_t:fifo_file setattr;
 729 ')
 730
 731 ########################################
 732 ## <summary>
 733 ##      Read and write the X windows console named pipe.
 734 ## </summary>
 735 ## <param name="domain">
 736 ##      <summary>
 737 ##      Domain allowed access.
 738 ##      </summary>
 739 ## </param>
 740 #
 741 interface(`xserver_rw_console',`
 742         gen_require(`
 743                 type xconsole_device_t;
 744         ')
 745
 746         allow $1 xconsole_device_t:fifo_file { getattr read write };
 747 ')
 748
 749 ########################################
 750 ## <summary>
 751 ##      Connect to XDM over a unix domain
 752 ##      stream socket.
 753 ## </summary>
 754 ## <param name="domain">
 755 ##      <summary>
 756 ##      Domain allowed access.
 757 ##      </summary>
 758 ## </param>
 759 #
 760 interface(`xserver_stream_connect_xdm',`
 761         gen_require(`
 762                 type xdm_t;
 763         ')
 764
 765         allow $1 xdm_t:unix_stream_socket connectto;
 766 ')
 767
 768 ########################################
 769 ## <summary>
 770 ##      Read xdm-writable configuration files.
 771 ## </summary>
 772 ## <param name="domain">
 773 ##      <summary>
 774 ##      Domain allowed access.
 775 ##      </summary>
 776 ## </param>
 777 #
 778 interface(`xserver_read_xdm_rw_config',`
 779         gen_require(`
 780                 type xdm_rw_etc_t;
 781         ')
 782
 783         files_search_etc($1)
 784         allow $1 xdm_rw_etc_t:dir { getattr read };
 785 ')
 786
 787 ########################################
 788 ## <summary>
 789 ##      Set the attributes of XDM temporary directories.
 790 ## </summary>
 791 ## <param name="domain">
 792 ##      <summary>
 793 ##      Domain allowed access.
 794 ##      </summary>
 795 ## </param>
 796 #
 797 interface(`xserver_setattr_xdm_tmp_dirs',`
 798         gen_require(`
 799                 type xdm_tmp_t;
 800         ')
 801
 802         allow $1 xdm_tmp_t:dir setattr;
 803 ')
 804
 805 ########################################
 806 ## <summary>
 807 ##      Create a named socket in a XDM
 808 ##      temporary directory.
 809 ## </summary>
 810 ## <param name="domain">
 811 ##      <summary>
 812 ##      Domain allowed access.
 813 ##      </summary>
 814 ## </param>
 815 #
 816 interface(`xserver_create_xdm_tmp_sockets',`
 817         gen_require(`
 818                 type xdm_tmp_t;
 819         ')
 820
 821         files_search_tmp($1)
 822         allow $1 xdm_tmp_t:dir ra_dir_perms;
 823         allow $1 xdm_tmp_t:sock_file create;
 824 ')
 825
 826 ########################################
 827 ## <summary>
 828 ##      Read XDM pid files.
 829 ## </summary>
 830 ## <param name="domain">
 831 ##      <summary>
 832 ##      Domain allowed access.
 833 ##      </summary>
 834 ## </param>
 835 #
 836 interface(`xserver_read_xdm_pid',`
 837         gen_require(`
 838                 type xdm_var_run_t;
 839         ')
 840
 841         files_search_pids($1)
 842         allow $1 xdm_var_run_t:file r_file_perms;
 843 ')
 844
 845 ########################################
 846 ## <summary>
 847 ##      Read XDM var lib files.
 848 ## </summary>
 849 ## <param name="domain">
 850 ##      <summary>
 851 ##      Domain allowed access.
 852 ##      </summary>
 853 ## </param>
 854 #
 855 interface(`xserver_read_xdm_lib_files',`
 856         gen_require(`
 857                 type xdm_var_lib_t;
 858         ')
 859
 860         allow $1 xdm_var_lib_t:file { getattr read };
 861 ')
 862
 863 ########################################
 864 ## <summary>
 865 ##      Execute the X server in the XDM X server domain.
 866 ## </summary>
 867 ## <param name="domain">
 868 ##      <summary>
 869 ##      Domain allowed access.
 870 ##      </summary>
 871 ## </param>
 872 #
 873 interface(`xserver_domtrans_xdm_xserver',`
 874         gen_require(`
 875                 type xdm_xserver_t, xserver_exec_t;
 876         ')
 877
 878         domain_auto_trans($1,xserver_exec_t,xdm_xserver_t)
 879
 880         allow $1 xdm_xserver_t:fd use;
 881         allow xdm_xserver_t $1:fd use;
 882         allow xdm_xserver_t $1:fifo_file rw_file_perms;
 883         allow xdm_xserver_t $1:process sigchld;
 884 ')
 885
 886 ########################################
 887 ## <summary>
 888 ##      Make an X session script an entrypoint for the specified domain.
 889 ## </summary>
 890 ## <param name="domain">
 891 ##      <summary>
 892 ##      The domain for which the shell is an entrypoint.
 893 ##      </summary>
 894 ## </param>
 895 #
 896 interface(`xserver_xsession_entry_type',`
 897         gen_require(`
 898                 type xsession_exec_t;
 899         ')
 900
 901         domain_entry_file($1,xsession_exec_t)
 902 ')
 903
 904 ########################################
 905 ## <summary>
 906 ##      Execute an X session in the target domain.  This
 907 ##      is an explicit transition, requiring the
 908 ##      caller to use setexeccon().
 909 ## </summary>
 910 ## <desc>
 911 ##      <p>
 912 ##      Execute an Xsession in the target domain.  This
 913 ##      is an explicit transition, requiring the
 914 ##      caller to use setexeccon().
 915 ##      </p>
 916 ##      <p>
 917 ##      No interprocess communication (signals, pipes,
 918 ##      etc.) is provided by this interface since
 919 ##      the domains are not owned by this module.
 920 ##      </p>
 921 ## </desc>
 922 ## <param name="domain">
 923 ##      <summary>
 924 ##      Domain allowed access.
 925 ##      </summary>
 926 ## </param>
 927 ## <param name="target_domain">
 928 ##      <summary>
 929 ##      The type of the shell process.
 930 ##      </summary>
 931 ## </param>
 932 #
 933 interface(`xserver_xsession_spec_domtrans',`
 934         gen_require(`
 935                 type xsession_exec_t;
 936         ')
 937
 938         domain_trans($1,xsession_exec_t,$2)
 939 ')
 940
 941 ########################################
 942 ## <summary>
 943 ##      Get the attributes of X server logs.
 944 ## </summary>
 945 ## <param name="domain">
 946 ##      <summary>
 947 ##      Domain allowed access.
 948 ##      </summary>
 949 ## </param>
 950 #
 951 interface(`xserver_getattr_log',`
 952         gen_require(`
 953                 type xserver_log_t;
 954         ')
 955
 956         logging_search_logs($1)
 957         allow $1 xserver_log_t:file getattr;
 958 ')
 959
 960 ########################################
 961 ## <summary>
 962 ##      Do not audit attempts to write the X server
 963 ##      log files.
 964 ## </summary>
 965 ## <param name="domain">
 966 ##      <summary>
 967 ##      Domain to not audit
 968 ##      </summary>
 969 ## </param>
 970 #
 971 interface(`xserver_dontaudit_write_log',`
 972         gen_require(`
 973                 type xserver_log_t;
 974         ')
 975
 976         dontaudit $1 xserver_log_t:file { append write };
 977 ')
 978
 979 ########################################
 980 ## <summary>
 981 ##      Do not audit attempts to write the X server
 982 ##      log files.
 983 ## </summary>
 984 ## <param name="domain">
 985 ##      <summary>
 986 ##      Domain to not audit
 987 ##      </summary>
 988 ## </param>
 989 #
 990 interface(`xserver_delete_log',`
 991         gen_require(`
 992                 type xserver_log_t;
 993         ')
 994
 995         logging_search_logs($1)
 996         allow $1 xserver_log_t:dir rw_dir_perms;
 997         allow $1 xserver_log_t:file unlink;
 998 ')
 999
1000 ########################################
1001 ## <summary>
1002 ##      Read X keyboard extension libraries.
1003 ## </summary>
1004 ## <param name="domain">
1005 ##      <summary>
1006 ##      Domain to not audit
1007 ##      </summary>
1008 ## </param>
1009 #
1010 interface(`xserver_read_xkb_libs',`
1011         gen_require(`
1012                 type xkb_var_lib_t;
1013         ')
1014
1015         files_search_var_lib($1)
1016         allow $1 xkb_var_lib_t:dir list_dir_perms;
1017         allow $1 xkb_var_lib_t:file r_file_perms;
1018         allow $1 xkb_var_lib_t:lnk_file { getattr read };
1019 ')
1020
1021 ########################################
1022 ## <summary>
1023 ##      Read xdm temporary files.
1024 ## </summary>
1025 ## <param name="domain">
1026 ##      <summary>
1027 ##      Domain to not audit
1028 ##      </summary>
1029 ## </param>
1030 #
1031 interface(`xserver_read_xdm_xserver_tmp_files',`
1032         gen_require(`
1033                 type xdm_xserver_tmp_t;
1034         ')
1035
1036         allow $1 xdm_xserver_tmp_t:file { getattr read };
1037 ')
1038
1039 ########################################
1040 ## <summary>
1041 ##      Kill XDM X servers
1042 ## </summary>
1043 ## <param name="domain">
1044 ##      <summary>
1045 ##      Domain to not audit
1046 ##      </summary>
1047 ## </param>
1048 #
1049 interface(`xserver_kill_xdm_xserver',`
1050         gen_require(`
1051                 type xdm_xserver_t;
1052         ')
1053
1054         allow $1 xdm_xserver_t:process sigkill;
1055 ')
1056
1057 ########################################
1058 ## <summary>
1059 ##      Do not audit attempts to read and write to
1060 ##      a XDM X server socket.
1061 ## </summary>
1062 ## <param name="domain">
1063 ##      <summary>
1064 ##      Domain to not audit
1065 ##      </summary>
1066 ## </param>
1067 #
1068 interface(`xserver_dontaudit_rw_xdm_xserver_tcp_sockets',`
1069         gen_require(`
1070                 type xdm_xserver_t;
1071         ')
1072
1073         dontaudit $1 xdm_xserver_t:tcp_socket { read write };
1074 ')