Check in fixed for Chrome nacl support

diff --git a/policy/modules/apps/chrome.te b/policy/modules/apps/chrome.te
index 26aba30942041e230d961fcaba53f598f9d85c09..0eb3c2353cf5e7abf73bb8bbd659a9c8a6db8182 100644 (file)
--- a/policy/modules/apps/chrome.te
+++ b/policy/modules/apps/chrome.te
@@ -76,6 +76,7 @@ files_read_usr_files(chrome_sandbox_t)
 fs_dontaudit_getattr_all_fs(chrome_sandbox_t)
 
 userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_t)
+userdom_execute_user_tmpfs_files(chrome_sandbox_t)
 
 userdom_use_user_ptys(chrome_sandbox_t)
 userdom_write_inherited_user_tmp_files(chrome_sandbox_t)
@@ -141,7 +142,7 @@ allow chrome_sandbox_nacl_t self:process execmem;
 allow chrome_sandbox_nacl_t self:fifo_file manage_fifo_file_perms;
 allow chrome_sandbox_nacl_t self:unix_stream_socket create_stream_socket_perms;
 allow chrome_sandbox_nacl_t self:shm create_shm_perms;
-allow chrome_sandbox_nacl_t self:unix_dgram_socket create_socket_perms;
+allow chrome_sandbox_nacl_t self:unix_dgram_socket { create_socket_perms sendto };
 
 allow chrome_sandbox_nacl_t chrome_sandbox_t:shm rw_shm_perms;
 allow chrome_sandbox_nacl_t chrome_sandbox_tmpfs_t:file rw_inherited_file_perms;
@@ -169,3 +170,4 @@ corecmd_sbin_entry_type(chrome_sandbox_nacl_t)
 userdom_use_inherited_user_ptys(chrome_sandbox_nacl_t)
 userdom_rw_inherited_user_tmpfs_files(chrome_sandbox_nacl_t)
 userdom_execute_user_tmpfs_files(chrome_sandbox_nacl_t)
+userdom_read_inherited_user_tmp_files(chrome_sandbox_nacl_t)

diff --git a/policy/modules/system/libraries.fc b/policy/modules/system/libraries.fc
index 5447ff61c3e64bcb9afba20baf56a7d15d893601..4986f1b655f28dfb68325dbf2aa64869799445a7 100644 (file)
--- a/policy/modules/system/libraries.fc
+++ b/policy/modules/system/libraries.fc
@@ -343,6 +343,7 @@ ifdef(`distro_suse',`
 /opt/google-earth/.*\.so.*    --     gen_context(system_u:object_r:textrel_shlib_t,s0)
 /usr/google-earth/.*\.so.*    --     gen_context(system_u:object_r:textrel_shlib_t,s0)
 /opt/google/.*\.so.*    --     gen_context(system_u:object_r:textrel_shlib_t,s0)
+/opt/google/chrome/.*\.so.*    --     gen_context(system_u:object_r:textrel_shlib_t,s0)
 
 /usr/lib/nspluginwrapper/np.*\.so      -- gen_context(system_u:object_r:lib_t,s0)
 

diff --git a/policy/modules/system/userdomain.if b/policy/modules/system/userdomain.if
index c595fd232ed4dbdf3c19684a17069abb0ab09169..af433574cd1e9f234d8b80b653127305366ab1a3 100644 (file)
--- a/policy/modules/system/userdomain.if
+++ b/policy/modules/system/userdomain.if
@@ -4775,6 +4775,24 @@ interface(`userdom_dontaudit_setattr_user_tmp',`
        dontaudit $1 user_tmp_t:dir setattr;
 ')
 
+########################################
+## <summary>
+##     Read all inherited users files in /tmp
+## </summary>
+## <param name="domain">
+##     <summary>
+##     Domain allowed access.
+##     </summary>
+## </param>
+#
+interface(`userdom_read_inherited_user_tmp_files',`
+       gen_require(`
+               type user_tmp_t;
+       ')
+
+       allow $1 user_tmp_t:file read_inherited_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Write all inherited users files in /tmp