Merge nsplugin into mozilla_plugin domain

diff --git a/policy/modules/admin/prelink.te b/policy/modules/admin/prelink.te
index ec838bd1d7cec6547a27517dab3b1def5a5e67d0..5d940f841a2b16f11dbd1c957bf170b3314a81e6 100644 (file)
--- a/policy/modules/admin/prelink.te
+++ b/policy/modules/admin/prelink.te
@@ -126,7 +126,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-       nsplugin_manage_rw_files(prelink_t)
+       mozilla_plugin_manage_rw_files(prelink_t)
 ')
 
 optional_policy(`

diff --git a/policy/modules/apps/mozilla.fc b/policy/modules/apps/mozilla.fc
index 35b51ab4a0f1c46333ed37b73382f065a1fe43a5..800b5c882d4402eebadf94f8c545d5ddc68afad8 100644 (file)
--- a/policy/modules/apps/mozilla.fc
+++ b/policy/modules/apps/mozilla.fc
@@ -4,6 +4,11 @@ HOME_DIR/\.mozilla(/.*)?               gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.thunderbird(/.*)?           gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.netscape(/.*)?              gen_context(system_u:object_r:mozilla_home_t,s0)
 HOME_DIR/\.phoenix(/.*)?               gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.adobe(/.*)?                 gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.macromedia(/.*)?            gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.gnash(/.*)?                 gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.gcjwebplugin(/.*)?          gen_context(system_u:object_r:mozilla_home_t,s0)
+HOME_DIR/\.icedteaplugin(/.*)?         gen_context(system_u:object_r:mozilla_home_t,s0)
 
 #
 # /bin
@@ -15,6 +20,9 @@ HOME_DIR/\.phoenix(/.*)?              gen_context(system_u:object_r:mozilla_home_t,s0)
 /usr/bin/epiphany              --      gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/bin/mozilla-[0-9].*       --      gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/bin/mozilla-bin-[0-9].*   --      gen_context(system_u:object_r:mozilla_exec_t,s0)
+/usr/bin/nspluginscan          --      gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/bin/nspluginviewer                --      gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+/usr/lib/nspluginwrapper/npviewer.bin  --      gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
 
 #
 # /lib
@@ -27,4 +35,9 @@ HOME_DIR/\.phoenix(/.*)?              gen_context(system_u:object_r:mozilla_home_t,s0)
 /usr/lib/firefox[^/]*/mozilla-.* -- gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/lib/[^/]*firefox[^/]*/firefox-bin -- gen_context(system_u:object_r:mozilla_exec_t,s0)
 /usr/lib/[^/]*firefox[^/]*/firefox -- gen_context(system_u:object_r:mozilla_exec_t,s0)
+
 /usr/lib/xulrunner[^/]*/plugin-container               --      gen_context(system_u:object_r:mozilla_plugin_exec_t,s0)
+
+/usr/lib/mozilla/plugins-wrapped(/.*)?                 gen_context(system_u:object_r:mozilla_plugin_rw_t,s0)
+
+/usr/lib/nspluginwrapper/plugin-config                 --      gen_context(system_u:object_r:mozilla_plugin_config_exec_t,s0)

diff --git a/policy/modules/apps/mozilla.if b/policy/modules/apps/mozilla.if
index b9b8ac255254efb9e2605f25c0af06cd380bca6d..c5928477b9067e60407053eec6d04d97a93c1bde 100644 (file)
--- a/policy/modules/apps/mozilla.if
+++ b/policy/modules/apps/mozilla.if
@@ -208,10 +208,12 @@ interface(`mozilla_domtrans',`
 interface(`mozilla_domtrans_plugin',`
        gen_require(`
                type mozilla_plugin_t, mozilla_plugin_exec_t;
+               type mozilla_plugin_config_t, mozilla_plugin_config_exec_t;
                class dbus send_msg;
        ')
 
        domtrans_pattern($1, mozilla_plugin_exec_t, mozilla_plugin_t)
+       domtrans_pattern($2, mozilla_plugin_config_exec_t, mozilla_plugin_config_t)
        allow mozilla_plugin_t $1:process signull;
        allow $1 mozilla_plugin_t:unix_stream_socket { connectto rw_socket_perms };
        allow $1 mozilla_plugin_t:fd use;
@@ -247,6 +249,7 @@ interface(`mozilla_run_plugin',`
 
        mozilla_domtrans_plugin($1)
        role $2 types mozilla_plugin_t;
+       role $2 types mozilla_plugin_config_t;
 ')
 
 #######################################
@@ -266,6 +269,7 @@ interface(`mozilla_role_plugin',`
     ')
 
     role $1 types mozilla_plugin_t;
+    role $1 types mozilla_plugin_config_t;
 ')
 
 ########################################
@@ -360,3 +364,23 @@ interface(`mozilla_plugin_dontaudit_leaks',`
 
        dontaudit $1 mozilla_plugin_t:unix_stream_socket { read write };
 ')
+
+########################################
+## <summary>
+##     Create, read, write, and delete
+##     mozilla_plugin rw files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`mozilla_plugin_manage_rw_files',`
+       gen_require(`
+               type mozilla_plugin_rw_t;
+       ')
+
+       allow $1 mozilla_plugin_rw_t:file manage_file_perms;
+       allow $1 mozilla_plugin_rw_t:dir rw_dir_perms;
+')

diff --git a/policy/modules/apps/mozilla.te b/policy/modules/apps/mozilla.te
index 75d0b62c295b30eb71fff9291f5f5e16b96d90fb..c421a7846b38d0320fd564055b15c665c38de75e 100644 (file)
--- a/policy/modules/apps/mozilla.te
+++ b/policy/modules/apps/mozilla.te
@@ -23,7 +23,7 @@ type mozilla_conf_t;
 files_config_file(mozilla_conf_t)
 
 type mozilla_home_t;
-typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t };
+typealias mozilla_home_t alias { user_mozilla_home_t staff_mozilla_home_t sysadm_mozilla_home_t nsplugin_home_t };
 typealias mozilla_home_t alias { auditadm_mozilla_home_t secadm_mozilla_home_t };
 files_poly_member(mozilla_home_t)
 userdom_user_home_content(mozilla_home_t)
@@ -43,6 +43,13 @@ userdom_user_tmpfs_content(mozilla_plugin_tmpfs_t)
 files_tmpfs_file(mozilla_plugin_tmpfs_t)
 ubac_constrained(mozilla_plugin_tmpfs_t)
 
+type mozilla_plugin_rw_t alias nsplugin_rw_t;
+files_type(mozilla_plugin_rw_t)
+
+type mozilla_plugin_config_t;
+type mozilla_plugin_config_exec_t;
+application_domain(mozilla_plugin_config_t, mozilla_plugin_config_exec_t)
+
 type mozilla_tmp_t;
 files_tmp_file(mozilla_tmp_t)
 ubac_constrained(mozilla_tmp_t)
@@ -279,11 +286,6 @@ optional_policy(`
        mplayer_read_user_home_files(mozilla_t)
 ')
 
-optional_policy(`
-       nsplugin_manage_rw(mozilla_t)
-       nsplugin_manage_home_files(mozilla_t)
-')
-
 optional_policy(`
        pulseaudio_exec(mozilla_t)
        pulseaudio_stream_connect(mozilla_t)
@@ -330,6 +332,10 @@ manage_fifo_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plug
 manage_sock_files_pattern(mozilla_plugin_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t)
 fs_tmpfs_filetrans(mozilla_plugin_t, mozilla_plugin_tmpfs_t, { file lnk_file sock_file fifo_file })
 
+allow mozilla_plugin_t mozilla_plugin_rw_t:dir list_dir_perms;
+read_lnk_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+read_files_pattern(mozilla_plugin_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+
 can_exec(mozilla_plugin_t, mozilla_exec_t)
 
 kernel_read_kernel_sysctls(mozilla_plugin_t)
@@ -451,17 +457,6 @@ optional_policy(`
        mplayer_read_user_home_files(mozilla_plugin_t)
 ')
 
-optional_policy(`
-       nsplugin_domtrans(mozilla_plugin_t)
-       nsplugin_rw_exec(mozilla_plugin_t)
-       nsplugin_manage_home_dirs(mozilla_plugin_t)
-       nsplugin_manage_home_files(mozilla_plugin_t)
-       nsplugin_user_home_dir_filetrans(mozilla_plugin_t, dir)
-       nsplugin_user_home_filetrans(mozilla_plugin_t, file)
-       nsplugin_read_rw_files(mozilla_plugin_t);
-       nsplugin_signal(mozilla_plugin_t)
-')
-
 optional_policy(`
        pulseaudio_exec(mozilla_plugin_t)
        pulseaudio_stream_connect(mozilla_plugin_t)
@@ -491,3 +486,61 @@ optional_policy(`
        xserver_append_xdm_home_files(mozilla_plugin_t);
 ')
 
+########################################
+#
+# mozilla_plugin_config local policy
+#
+
+allow mozilla_plugin_config_t self:capability { dac_override dac_read_search sys_nice setuid setgid };
+allow mozilla_plugin_config_t self:process { setsched signal_perms getsched execmem };
+
+allow mozilla_plugin_config_t self:fifo_file rw_file_perms;
+allow mozilla_plugin_config_t self:unix_stream_socket create_stream_socket_perms;
+
+manage_files_pattern(mozilla_plugin_config_t, mozilla_home_t, mozilla_home_t)
+
+dev_search_sysfs(mozilla_plugin_config_t)
+dev_read_urand(mozilla_plugin_config_t)
+dev_dontaudit_read_rand(mozilla_plugin_config_t)
+dev_dontaudit_rw_dri(mozilla_plugin_config_t)
+
+fs_search_auto_mountpoints(mozilla_plugin_config_t)
+fs_list_inotifyfs(mozilla_plugin_config_t)
+
+can_exec(mozilla_plugin_config_t, mozilla_plugin_rw_t)
+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+manage_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_plugin_rw_t, mozilla_plugin_rw_t)
+
+manage_dirs_pattern(mozilla_plugin_config_t, mozilla_plugin_home_t, mozilla_plugin_home_t)
+manage_files_pattern(mozilla_plugin_config_t, mozilla_plugin_home_t, mozilla_plugin_home_t)
+manage_lnk_files_pattern(mozilla_plugin_config_t, mozilla_plugin_home_t, mozilla_plugin_home_t)
+
+corecmd_exec_bin(mozilla_plugin_config_t)
+corecmd_exec_shell(mozilla_plugin_config_t)
+
+kernel_read_system_state(mozilla_plugin_config_t)
+kernel_request_load_module(mozilla_plugin_config_t)
+
+domain_use_interactive_fds(mozilla_plugin_config_t)
+
+files_read_etc_files(mozilla_plugin_config_t)
+files_read_usr_files(mozilla_plugin_config_t)
+files_dontaudit_search_home(mozilla_plugin_config_t)
+files_list_tmp(mozilla_plugin_config_t)
+
+auth_use_nsswitch(mozilla_plugin_config_t)
+
+miscfiles_read_localization(mozilla_plugin_config_t)
+miscfiles_read_fonts(mozilla_plugin_config_t)
+
+userdom_search_user_home_content(mozilla_plugin_config_t)
+userdom_read_user_home_content_symlinks(mozilla_plugin_config_t)
+userdom_read_user_home_content_files(mozilla_plugin_config_t)
+userdom_dontaudit_search_admin_dir(mozilla_plugin_config_t)
+
+domtrans_pattern(mozilla_plugin_config_t, mozilla_plugin_exec_t, mozilla_plugin_t)
+
+optional_policy(`
+       xserver_use_user_fonts(mozilla_plugin_config_t)
+')

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 39b1056d7218248e73a270824c392d56608b0f46..cc3f02e2873b4c62f601918a5d5f8429e3c4939e 100644 (file)
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -4174,6 +4174,30 @@ interface(`dev_dontaudit_write_sysfs_dirs',`
        dontaudit $1 sysfs_t:dir write;
 ')
 
+########################################
+## <summary>
+##     Read cpu online hardware state information.
+## </summary>
+## <desc>
+##     <p>
+##     Allow the specified domain to read /sys/devices/system/cpu/online file.
+##     </p>
+## </desc>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`dev_read_cpu_online',`
+       gen_require(`
+               type cpu_online_t;
+       ')
+
+       dev_search_sysfs($1)
+       read_files_pattern($1, cpu_online_t, cpu_online_t)
+')
+
 ########################################
 ## <summary>
 ##     Read hardware state information.

diff --git a/policy/modules/kernel/devices.te b/policy/modules/kernel/devices.te
index 1c2562ccdf0b2ae47048d576ae0bd06cfe6b406c..112bebba737fc00c21a5b474263bd505b3d24392 100644 (file)
--- a/policy/modules/kernel/devices.te
+++ b/policy/modules/kernel/devices.te
@@ -225,6 +225,10 @@ files_mountpoint(sysfs_t)
 fs_type(sysfs_t)
 genfscon sysfs / gen_context(system_u:object_r:sysfs_t,s0)
 
+type cpu_online_t;
+allow cpu_online_t sysfs_t:filesystem associate;
+genfscon sysfs /devices/system/cpu/online gen_context(system_u:object_r:cpu_online_t,s0)
+
 #
 # Type for /dev/tpm
 #

diff --git a/policy/modules/kernel/domain.te b/policy/modules/kernel/domain.te
index f9a1bccb30e0f8fcc16569ace7f1d1343b04f197..a4784313fb9ea3200be18dd12468eeb262fc236e 100644 (file)
--- a/policy/modules/kernel/domain.te
+++ b/policy/modules/kernel/domain.te
@@ -115,6 +115,7 @@ kernel_dontaudit_search_debugfs(domain)
 allow domain self:process { fork getsched sigchld };
 
 # Use trusted objects in /dev
+dev_read_cpu_online(domain)
 dev_rw_null(domain)
 dev_rw_zero(domain)
 term_use_controlling_term(domain)

diff --git a/policy/modules/roles/unconfineduser.te b/policy/modules/roles/unconfineduser.te
index 11ad8fb17350cb2a3d9f0e944f42a820970685b3..35524d68fe7d80cf56107d625b8326300c15548e 100644 (file)
--- a/policy/modules/roles/unconfineduser.te
+++ b/policy/modules/roles/unconfineduser.te
@@ -6,13 +6,6 @@ policy_module(unconfineduser, 1.0.0)
 #
 attribute unconfined_login_domain;
 
-## <desc>
-## <p>
-##  allow unconfined users to transition to the nsplugin domains when running nspluginviewer
-## </p>
-## </desc>
-gen_tunable(allow_unconfined_nsplugin_transition, false)
-
 ## <desc>
 ## <p>
 ## allow unconfined users to transition to the chrome sandbox domains when running chrome-sandbox
@@ -128,14 +121,6 @@ optional_policy(`
                attribute unconfined_usertype;
        ')
 
-       nsplugin_role_notrans(unconfined_r, unconfined_usertype)
-       optional_policy(`
-               tunable_policy(`allow_unconfined_nsplugin_transition',`
-                     nsplugin_domtrans(unconfined_usertype)
-                     nsplugin_domtrans_config(unconfined_usertype)
-               ')
-       ')
-
        optional_policy(`
                abrt_dbus_chat(unconfined_usertype)
                abrt_run_helper(unconfined_usertype, unconfined_r)

diff --git a/policy/modules/roles/xguest.te b/policy/modules/roles/xguest.te
index 6f176f91672b6a758e611f8db514350ffc9f1bac..0258e247e4af7d331cec44d5053e8e80005eeb31 100644 (file)
--- a/policy/modules/roles/xguest.te
+++ b/policy/modules/roles/xguest.te
@@ -116,10 +116,6 @@ optional_policy(`
        mozilla_run_plugin(xguest_usertype, xguest_r)
 ')
 
-optional_policy(`
-       nsplugin_role(xguest_r, xguest_t)
-')
-
 optional_policy(`
        pcscd_read_pub_files(xguest_usertype)
        pcscd_stream_connect(xguest_usertype)

diff --git a/policy/modules/services/abrt.te b/policy/modules/services/abrt.te
index d5a9038ecc0c1435b499d3749e0496a3cea53c9f..a1cbdb4a7601f3538829567c2e3bedd47bed001e 100644 (file)
--- a/policy/modules/services/abrt.te
+++ b/policy/modules/services/abrt.te
@@ -207,11 +207,6 @@ optional_policy(`
        dbus_system_domain(abrt_t, abrt_exec_t)
 ')
 
-optional_policy(`
-       nsplugin_read_rw_files(abrt_t)
-       nsplugin_read_home(abrt_t)
-')
-
 optional_policy(`
        policykit_dbus_chat(abrt_t)
        policykit_domtrans_auth(abrt_t)

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index 0b3811da326fbb9cfd53068d6b0233aef442d222..0281618f6763fd1bcc18391b79cbc68b08fd3e5e 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -786,10 +786,6 @@ template(`userdom_common_user_template',`
                mta_filetrans_home_content($1_usertype)
        ')
 
-       optional_policy(`
-               nsplugin_role($1_r, $1_usertype)
-       ')
-
        optional_policy(`
                tunable_policy(`allow_user_mysql_connect',`
                        mysql_stream_connect($1_t)