systemd_logind needs to dbus chat and read state files of all login

program domains.

diff --git a/policy/modules/system/authlogin.if b/policy/modules/system/authlogin.if
index 66248040305dda973d63617339ec50ae83e928f5..c2dc2c5085562770b9b81688fa36027f6a9ed69e 100644 (file)
--- a/policy/modules/system/authlogin.if
+++ b/policy/modules/system/authlogin.if
@@ -218,6 +218,46 @@ interface(`auth_login_pgm_domain',`
        ')
 ')
 
+########################################
+## <summary>
+##     Send and receive messages from
+##     login program domains over dbus.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`authlogin_dbus_chat',`
+       gen_require(`
+               attribute polydomain;
+               class dbus send_msg;
+       ')
+
+       allow $1 polydomain:dbus send_msg;
+       allow polydomain $1:dbus send_msg;
+')
+
+########################################
+## <summary>
+##     Read authlogin state files.
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`authlogin_read_state',`
+       gen_require(`
+               attribute polydomain;
+       ')
+
+       kernel_search_proc($1)
+       ps_process_pattern($1, polydomain)
+')
+
 ########################################
 ## <summary>
 ##     Read and write a authlogin unnamed pipe.

diff --git a/policy/modules/system/systemd.te b/policy/modules/system/systemd.te
index 8f117838070366f84b819603d9157bd781fe2e28..83a1fd04ad391592593fd5e75a60c449d18fb916 100644 (file)
--- a/policy/modules/system/systemd.te
+++ b/policy/modules/system/systemd.te
@@ -103,6 +103,9 @@ term_use_unallocated_ttys(systemd_logind_t)
 # Actually only have proof of it creating dirs and symlinks (/run/user/$USER/X11/display)
 auth_manage_var_auth(systemd_logind_t)
 
+authlogin_dbus_chat(systemd_logind_t)
+authlogin_read_state(systemd_logind_t)
+
 dbus_connect_system_bus(systemd_logind_t)
 dbus_system_bus_client(systemd_logind_t)
 
@@ -121,8 +124,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-       xserver_dbus_chat_xdm(systemd_logind_t)
-       xserver_read_state_xdm(systemd_logind_t)
        # It links /run/user/$USER/X11/display to /tmp/.X11-unix/X* sock_file
        xserver_search_xdm_tmp_dirs(systemd_logind_t)
 ')