Allow xserver_t to create nvidia devices with the correct label

diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 60394ecf3c16db9faabbcd28938e63c240a55cf9..e73a7fef6f60412a996eb8005a402188c0d7b614 100644 (file)
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -5001,6 +5001,26 @@ interface(`dev_rw_xserver_misc',`
        rw_chr_files_pattern($1, device_t, xserver_misc_device_t)
 ')
 
+########################################
+## <summary>
+##     Read and write X server miscellaneous devices.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`dev_manage_xserver_misc',`
+       gen_require(`
+               type device_t, xserver_misc_device_t;
+       ')
+
+       manage_chr_files_pattern($1, device_t, xserver_misc_device_t)
+
+       dev_filetrans_xserver_named_dev($1)
+')
+
 ########################################
 ## <summary>
 ##     Read and write to the zero device (/dev/zero).
@@ -5127,7 +5147,6 @@ interface(`dev_filetrans_all_named_dev',`
 gen_require(`
        type device_t;
        type usb_device_t;
-       type xserver_misc_device_t;
        type sound_device_t;
        type apm_bios_t;
        type mouse_device_t;
@@ -5171,7 +5190,6 @@ gen_require(`
        type mtrr_device_t;
 ')
 
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "3dfx")
        filetrans_pattern($1, device_t, sound_device_t, chr_file, "admmidi0")
        filetrans_pattern($1, device_t, sound_device_t, chr_file, "admmidi1")
        filetrans_pattern($1, device_t, sound_device_t, chr_file, "admmidi2")
@@ -5246,7 +5264,6 @@ gen_require(`
        filetrans_pattern($1, device_t, autofs_device_t, chr_file, "autofs9")
        filetrans_pattern($1, device_t, sound_device_t, chr_file, "beep")
        filetrans_pattern($1, device_t, lvm_control_t, chr_file, "btrfs-control")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "controlD64")
        filetrans_pattern($1, device_t, crash_device_t, chr_file, "crash")
        filetrans_pattern($1, device_t, dlm_control_device_t, chr_file, "dlm0")
        filetrans_pattern($1, device_t, dlm_control_device_t, chr_file, "dlm1")
@@ -5343,8 +5360,6 @@ gen_require(`
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "007")
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "008")
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "009")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "gfx")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "graphics")
        filetrans_pattern($1, device_t, clock_device_t, chr_file, "gtrsc0")
        filetrans_pattern($1, device_t, clock_device_t, chr_file, "gtrsc1")
        filetrans_pattern($1, device_t, clock_device_t, chr_file, "gtrsc2")
@@ -5462,16 +5477,6 @@ gen_require(`
        filetrans_pattern($1, device_t, kmsg_device_t, chr_file, "mcelog")
        filetrans_pattern($1, device_t, memory_device_t, chr_file, "mem")
        filetrans_pattern($1, device_t, memory_device_t, chr_file, "mergemem")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid0")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid1")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid2")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid3")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid4")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid5")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid6")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid7")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid8")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid9")
        filetrans_pattern($1, device_t, mouse_device_t, chr_file, "mice")
        filetrans_pattern($1, device_t, cpu_device_t, chr_file, "microcode")
        filetrans_pattern($1, device_t, sound_device_t, chr_file, "midi0")
@@ -5530,20 +5535,8 @@ gen_require(`
        filetrans_pattern($1, device_t, modem_device_t, chr_file, "noz8")
        filetrans_pattern($1, device_t, modem_device_t, chr_file, "noz9")
        filetrans_pattern($1, device_t, null_device_t, chr_file, "null")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia0")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia1")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia2")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia3")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia4")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia5")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia6")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia7")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia8")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia9")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidiactl")
        filetrans_pattern($1, device_t, nvram_device_t, chr_file, "nvram")
        filetrans_pattern($1, device_t, memory_device_t, chr_file, "oldmem")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "opengl")
        filetrans_pattern($1, device_t, printer_device_t, chr_file, "par0")
        filetrans_pattern($1, device_t, printer_device_t, chr_file, "par1")
        filetrans_pattern($1, device_t, printer_device_t, chr_file, "par2")
@@ -5691,17 +5684,6 @@ gen_require(`
        filetrans_pattern($1, device_t, v4l_device_t, chr_file, "vbi7")
        filetrans_pattern($1, device_t, v4l_device_t, chr_file, "vbi8")
        filetrans_pattern($1, device_t, v4l_device_t, chr_file, "vbi9")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox0")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox1")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox2")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox3")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox4")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox5")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox6")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox7")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox8")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox9")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vga_arbiter")
        filetrans_pattern($1, device_t, vmware_device_t, chr_file, "vmmon")
        filetrans_pattern($1, device_t, vmware_device_t, chr_file, "vmnet0")
        filetrans_pattern($1, device_t, vmware_device_t, chr_file, "vmnet1")
@@ -5758,16 +5740,6 @@ gen_require(`
        filetrans_pattern($1, device_t, v4l_device_t, chr_file, "winradio9")
        filetrans_pattern($1, device_t, crypt_device_t, chr_file, "z90crypt")
        filetrans_pattern($1, device_t, zero_device_t, chr_file, "zero")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card0")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card1")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card2")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card3")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card4")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card5")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card6")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card7")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card8")
-       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
        filetrans_pattern($1, device_t, smartcard_device_t, chr_file, "cmx0")
        filetrans_pattern($1, device_t, smartcard_device_t, chr_file, "cmx1")
        filetrans_pattern($1, device_t, smartcard_device_t, chr_file, "cmx2")
@@ -5882,4 +5854,70 @@ gen_require(`
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "uba")
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "ubb")
        filetrans_pattern($1, device_t, usb_device_t, chr_file, "ubc")
+       dev_filetrans_xserver_named_dev($1)
+')
+
+########################################
+## <summary>
+##     Create all named devices with the correct label
+## </summary>
+## <param name="domain">
+##     <summary>
+##      Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`dev_filetrans_xserver_named_dev',`
+
+       gen_require(`
+               type xserver_misc_device_t;
+       ')
+
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "3dfx")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "controlD64")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "gfx")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "graphics")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid0")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid1")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid2")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid3")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid4")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid5")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid6")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid7")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid8")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "mga_vid9")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia0")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia1")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia2")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia3")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia4")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia5")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia6")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia7")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia8")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidia9")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "nvidiactl")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "opengl")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox0")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox1")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox2")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox3")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox4")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox5")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox6")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox7")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox8")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vbox9")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "vga_arbiter")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card0")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card1")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card2")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card3")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card4")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card5")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card6")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card7")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card8")
+       filetrans_pattern($1, device_t, xserver_misc_device_t, chr_file, "card9")
 ')

diff --git a/policy/modules/services/xserver.te b/policy/modules/services/xserver.te
index c3e4d56f6269b5cca5cf64d5d1d28e73fd407300..c5df7e9bf3c201ddd518e7ce4589bf619257895f 100644 (file)
--- a/policy/modules/services/xserver.te
+++ b/policy/modules/services/xserver.te
@@ -1024,7 +1024,8 @@ dev_setattr_generic_dirs(xserver_t)
 dev_read_raw_memory(xserver_t)
 dev_wx_raw_memory(xserver_t)
 # for other device nodes such as the NVidia binary-only driver
-dev_rw_xserver_misc(xserver_t)
+dev_manage_xserver_misc(xserver_t)
+
 # read events - the synaptics touchpad driver reads raw events
 dev_rw_input_dev(xserver_t)
 dev_read_raw_memory(xserver_t)